Appeals Court Says Government Email Stored On Private Servers Is Still Subject To FOIA Requests

from the not-really-about-Clinton,-but-pretty-much-about-Clinton dept

A recent decision by the DC Circuit Court of Appeals may not directly reference the Hillary Clinton email fiasco, but the conclusion reached set off irony detectors all over as it arrived the same day FBI director James Comey announced that Clinton's private email server may have been a stupid idea, but not a criminally stupid one.

There were indications that Clinton's use of a private email address was an attempt to route around FOIA requests. As her server was being set up, communications from both her staff and the State Department's noted that an account in her name existed already, but would be subject to FOIA requests.

This has been a problem elsewhere. Several government officials have conducted an inordinate amount of government business using private email accounts or personal devices in hopes of skirting public records requests. The DC Circuit Court's case deals with a little-known government agency, but an all-too-familiar dodge by public officials.

In a decision Tuesday in a case not involving Clinton directly, the U.S. Court of Appeals for the D.C. Circuit held that messages contained in a personal email account can sometimes be considered government records subject to Freedom of Information Act requests.

The case ruled on by the D.C. Circuit focused on a relatively obscure White House unit: the Office of Science and Technology Policy.

The Competitive Enterprise Institute FOIA'ed work-related emails sent to and from the administration's science advisor, John Holdren. Holdren demurred, leading to this lawsuit that has worked its way up to the Appeals Court. The lower court decided the government was under no obligation to search private email accounts for responsive communications. The Appeals Court -- while not necessarily saying the government IS obligated to do this -- found that the lower court had been too hasty in its dismissal of CEI's complaint. From the decision [PDF]:

As relevant here, we held in Burka, that the agency must search and disclose records that were not on its premises but were under its “constructive control.”

[...]

In other words, an agency always acts through its employees and officials. If one of them possesses what would otherwise be agency records, the records do not lose their agency character just because the official who possesses them takes them out the door or because he is the head of the agency.

This seems to us to be the only resolution that makes sense. If the agency head controls what would otherwise be an agency record, then it is still an agency record and still must be searched or produced.

[...]

If a department head can deprive the citizens of their right to know what his department is up to by the simple expedient of maintaining his departmental emails on an account in another domain, that purpose is hardly served. It would make as much sense to say that the department head could deprive requestors of hard-copy documents by leaving them in a file at his daughter’s house and then claiming that they are under her control.

A solid conclusion, and one that hopefully discourages officials from playing keepaway with public documents by hosting them anywhere other than on government servers. But here's the caveat: this still may not result in any additional emails making their way into CEI's hands.

We make clear that we are not ordering the specific disclosure of any document. It may be that OSTP has valid exemption claims, or even that no document found among the jholdren@whrc.org email falls within the definition of “agency records.” However, those questions are for litigation in the district court in the first instance.

It's good to know where the DC Circuit Court of Appeals stands on the issue, seeing as nearly every federal FOIA lawsuit is handled in this jurisdiction. And if Clinton hoped to use the "private email account" excuse to withhold communications from FOIA requesters, it would appear to be a far less effective tactic than it was prior to this decision.

Filed Under: foia, government, private email

FBI Vacuums Up Local Law Enforcement Documents To Block Open Records Requests About Orlando Shooting

from the PROPERTY-OF-THE-FBI-stamp-ink-running-dangerously-low dept

The FBI has decided to insert itself into another public records battle. The agency has long been known to cc: itself to public records requests for Stingray documents, but this time it's claiming any requests for local law enforcement documents related to the Orlando nightclub shooting need to be routed through it.

A June 20 letter from the FBI, attached to the City or Orlando's lawsuit over withholding 911 calls and other records from 25 media outlets including the Orlando Sentinel, was also sent to the Seminole County Sheriff's Office with instructions pertaining to how they should respond to records requests.

The letter requests that agencies deny inquiries and directs departments to "immediately notify the FBI of any requests your agency received" so "the FBI can seek to prevent disclosure through appropriate channels, as necessary."

Notice the FBI says "prevent disclosure," rather than, say, "assist in determining which documents can be released." The letter [PDF] claims that all records generated by local law enforcement agencies are now the FBI's by proxy and that the "investigative documents" exemption [Exemption 7(A)] prevents the release of all documents related to the shooting.

The FBI flat-out states all documents are belong to it.

The FBI considers information obtained from state and local law enforcement agencies in furtherance of its investigation to be evidence, or potential evidence.

Presto! Instant blanket exemption from disclosure at both federal and state level. The FBI takes care to point out which Florida Sunshine Law exemption local agencies can use to withhold documents from requesters.

There's significant public interest in these documents, especially those related to EMS/police response to emergency calls. This obviously conflicts with the FBI's determination that its ongoing investigation -- which now apparently contains every document created by every responding law enforcement agency in Florida -- should preempt any and all requests for documents via Florida open records laws.

Not for nothing have there been several efforts mounted to alter blanket exemptions like the one the FBI is using to insert itself into local level records requests. Unfortunately, it's very likely the FBI's wielding of this "open investigation" exemption will be granted deference by the federal court currently presiding over an open records lawsuit between the Orlando Sentinel and the City of Orlando, even though this fight never should have included a federal agency conducting its own concurrent investigation of the mass shooting.

Filed Under: fbi, foia, imsi catcher, law enforcement, orlando, public records, stingray

Judge Responds To Open Records Request By Having Requester Indicted, Arrested

from the FOIA-TO-JAIL.-FOIA-DIRECTLY-TO-JAIL.-DO-NOT-PASS-GO. dept

We've seen government officials do some pretty questionable things to avoid turning over documents to FOIA requesters. The most common method is just to stick requesters with a bill they can't pay. Stonewalling is popular, too -- so much so that the federal government sends out "Still interested?" notices to people whose requests have been backburnered for years.

More rarely, officials will race requesters to the courthouse, hoping to secure a judgment in their favor stating that they've already fully complied with a FOIA request -- even when they've done nothing but withhold and redact. Stripped of all the legal wrangling, this is basically the government suing individuals for asking for documents, forcing taxpayers to go out-of-pocket if they hope to counter the officials' assertions.

But one thing we haven't seen is a government official securing a grand jury indictment against open records requesters… for making open records requests.

A North Georgia newspaper publisher was indicted on a felony charge and jailed overnight last week – for filing an open-records request.

Fannin Focus publisher Mark Thomason, along with his attorney Russell Stookey, were arrested on Friday and charged with attempted identity fraud and identity fraud. Thomason was also accused of making a false statement in his records request.

The pair had been going after local judge Brenda Weaver and other court staff for some time, tracing back to her predecessor's (former judge Roger Bradley) use of a racial slur in the courtroom. The slur was attached to a defendant's name, and this slur was repeated by the district attorney and court deputies. Thomason acquired a copy of a transcript only to find the repeated use of the slur by court deputies had been removed. He asked for the audio recording of the hearing and was rejected.

This led to an article by Thomason in which he noted the missing slurs and presumably questioned the court stenographer's skills/honesty. The court stenographer sued Thomason for defamation, seeking $1.6 million in damages. The suit was dropped when it became clear Thomason, like many journalists, is judgment-proof -- i.e., there's no way he had anything close to $1.6 million laying around. The case was closed by a judge who determined Thomason had no proof that the transcript was inaccurate.

The court stenographer then filed a motion to recover legal fees, despite the fact that then-Judge Bradley had already cut her a check for $16,000 to reimburse her for her legal costs. That led to the current run of subpoenas and records requests in which Thomason hoped to show a judge that the stenographer had already recovered her legal fees.

Judge Weaver's response to this lawful dig for pertinent records was to work in concert with the district attorney to bring charges against the pair -- claiming ridiculously that "Thomason would use the banking information on those checks for himself."

Weaver's accusations -- pushed past a grand jury by District Attorney Alison Sosebee -- are exactly that: she's accusing Thomason of seeking to take funds from Weaver's bank account. According to Count One of the indictment [PDF], Thomason's subpoena -- which sought front/back copies of checks issued from the account -- was nothing more than a failed attempt at identity fraud.

...with intent to unlawfully appropriate resources of said victim, contrary to the laws of this State…

The next count is just charge stacking: attempt to commit identity fraud. The third, however, seeks to make the filing of a public records request a criminal act.

…[w]hen the accused requested documents pursuant to the Open Records Act… to Robert P. Jones [Chairman of the Pickens County Board of Commissioners] and specifically requested "the actual cleared checks (front/back) that Pickens County had written to Judge Brenda Weaver and Judge Roger Bradley for Pickens County's portion of the quarterly operating account expenses for the judges from the years 2013, 2014, and 2015" and further stated "after reviewing only the checks written on behalf of Fannin County for the 2015 year and finding that, according to several banks, some of these checks appear to have not been deposited but cashed illegally," knowing the same to contain a false and fictitious representation…

In short, Judge Weaver claims the requesters lied on their request... which is apparently against the law... somehow. While the statute does forbid the use of false statements in documents submitted to officials, there's no indication it was meant to cover allegedly inaccurate assertions made in open records requests. On top of that, the quoted request makes it clear the assertion of illegality was made by "several banks," not the requesters themselves.

It could be that Judge Weaver is simply trying to shield courtroom employees from what she apparently views as harassing behavior. But the decision to handle the situation with a grand jury indictment, rather than litigating the open records request itself, definitely gives the situation the appearance of a concerted coverup. The subpoenas may be more legally questionable, but the application of this statute to an open records request looks like someone with a keen interest in keeping requested documents out of the hands of the journalist seeking them.

Filed Under: brenda weaver, foia, identity fraud, mark thomason, open records, press freedom, punishment, russell stookey
Companies: fannin focus

'Most Transparent' President Signs Into Law FOIA Reform Bill That Won't Affect His Administration

from the 'I'll-take-the-credit-but-not-the-responsibility.' dept

At long last -- after annual assaults on entrenched government secrecy interests -- FOIA reform has finally been signed into law.

Nearly a half-century to the day after President Lyndon B. Johnson reluctantly signed the Freedom of Information Act (FOIA) into law, granting the public the right to access federal government records, President Barack Obama signed into law a historic FOIA reform bill that aims to make it easier for the public to file FOIA requests and obtain government documents.

While this is cause for some celebration, let's not overlook what's actually happened here. Obama has signed a bill he can saddle his successors with. Neither leading candidate seems particularly amenable to openness and transparency -- not Donald Trump with his big ideas on how to change laws to make things better for him rather than for the nation, and not Hillary Clinton, who set up her own email server to route around FOIA requests.

While touting his administration as the Openest Place on Earth, FOIA responsiveness actually took several steps backward during his tenure. His administration also spent several years fighting FOIA reform, something that was ironically uncovered by documents obtained via a FOIA request.

What this one-foot-out-the-door signing does is provide the Obama Administration with a last-minute burnishing of its transparency record -- a brief hat tip to openness as he exits office with a largely-unearned reputation for government accountability.

Moving past the negatives, the new law institutes some interesting new measures, including the somewhat controversial "release to one, release to all" policy. This will provide for the public release -- via agency websites -- of any documents obtained by any FOIA requester. This is good news for the public, which won't have to rely on news agencies for controlled release of FOIAed documents. For news agencies, and the journalists putting in the effort to ask the right questions and push agencies into compliance with requests, this undercuts any level of "exclusivity" they may have used to attract more readers.

"In addition to the feedback OIP [Office of Information Policy] received directly, several journalists wrote about the pilot and voiced their potential concerns with the adoption of this policy," the report said. "The thrust of many of the journalists' concerns, although not always exactly the same, was an unease that posting the records requested by journalists without giving them any lead time with sole access to the records, could take away their 'scoop' or 'exclusive' story. Additionally, there were concerns that routine posting of FOIA- processed records would act as a disincentive for journalists to use the FOIA given that they often invest considerable time and resources into building a story and those efforts would be impacted by loss of the ability to be the first with access to the requested records. At the same time, there were others in the community of journalists who applauded the idea of agencies posting all FOIA responses."

FOIA warrior Jason Leopold is one of many who have commented on this policy, requesting a "lead time" of one week between the requester obtaining the documents and full release to the public. This is not an unreasonable request -- especially when Leopold works for sites like Vice which posts documents it receives when it reports on them. Other news agencies -- far too many to count/name-and-shame -- do not publish the documents they obtain, forcing readers to accept their interpretation of the content.

In terms of the greater public good, the new policy is the better policy, even if it contains the potential to strip away exclusivity. The Freedom of Information Act's purpose is to make the government more transparent and accountable, not act as a lead generator for news agencies. Journalistic agencies are also a huge contributor to holding the government accountable, so it's difficult to flatly state that FOIA enthusiasts like Leopold should just suck it up and deal with the new reality. But it's also impossible to ignore the fact that windowed releases of FOIA docs is just another form of gatekeeping that separates the public from its public servants, even if the separation is only temporary.

Also of note is the law's revamping of Exemption B(5), which is a current government favorite:

The bill radically overhauls one of the FOIA's most abused and overused exemptions: B5, referred to by open government advocates as the "withhold it because you can" exemption. Currently, when government agencies cite B5, which applies to internal deliberations and attorney-client privileged communications, government agencies can withhold records under that exemption forever. Under the FOIA Improvement Act, however, government agencies can withhold records pertaining to internal deliberations for only 25 years. Attorney-client privilege records, which also fall under B5, will not be part of the reform.

And, because the process of filing a FOIA request is often less than straightforward, the law provides for the creation of a single FOIA request portal -- one that will hopefully streamline the process and allow for easier tracking of submitted requests.

Undoubtedly, agencies are already working on ways to comply with the new law without actually being more open and transparent. Certain agencies -- like the Office of the Director of National Intelligence and the DOJ -- will be sure to use the new "release to all" policy to "scoop" journalists who have spent years (and possibly thousands of dollars in fees/litigation expenses) forcing embarrassing documents out of their hands by dumping these into the public's lap prior to news agencies' publication dates. This is a net win for the general public, but it also creates a route for agencies to act out of sheer vindictiveness.

Filed Under: foia, obama, transparency

Emails Show Hillary Clinton's Email Server Was A Massive Security Headache, Set Up To Route Around FOIA Requests

from the breaking-badly dept

More bad news for Hillary Clinton and her ill-advised personal email server. Another set of emails released by the State Department shows the government agency had to disable several security processes just to get its server to accept email from Clinton's private email address.

The emails, reviewed by The Associated Press, show that State Department technical staff disabled software on their systems intended to block phishing emails that could deliver dangerous viruses. They were trying urgently to resolve delivery problems with emails sent from Clinton's private server.

"This should trump all other activities," a senior technical official, Ken LaVolpe, told IT employees in a Dec. 17, 2010, email. Another senior State Department official, Thomas W. Lawrence, wrote days later in an email that deputy chief of staff Huma Abedin personally was asking for an update about the repairs. Abedin and Clinton, who both used Clinton's private server, had complained that emails each sent to State Department employees were not being reliably received.

After technical staffers turned off some security features, Lawrence cautioned in an email, "We view this as a Band-Aid and fear it's not 100 percent fully effective."

While trial-and-error is generally useful when solving connection problems, the implication is undeniable: to make Clinton's private, insecure email server connect with the State Department's, it had to -- at least temporarily -- lower itself to Clinton's security level. The other workaround -- USE A DAMN STATE DEPARTMENT EMAIL ADDRESS -- was seriously discussed.

This latest stack of emails also exposed other interesting things... like the fact that Clinton's private email server was attacked multiple times in one day, resulting in staffers taking it offline in an attempt to prevent a breach. (h/t Pwn All The Things)

In addition to the security issues, there's also some discussion about why Clinton was choosing to use her own server.

In one email, the State Department's IT person explains the agency already has an email address set up for Clinton, but offers to delete anything contained in it -- and points out that using the State Dept. address would make future emails subject to FOIA requests.

[W]e actually have an account previously set up: SSHRC@state.gov. There are some old emails but none since Jan '11 -- we could get rid of them.

You should be aware that any email would go through the Department's infrastructure and subject to FOIA searches.

So, there's one reason Clinton would have opted to use a personal email address and server. More confirmation of the rationale behind this decision appears in an earlier email (2010) from Clinton to her aide, Huma Abedin.

Abedin: We should talk about putting you on state email or releasing your email to the department so you are not going to spam.

Clinton: Let's get separate address or device but I don't want any risk of the personal being accessible.

There appears to be some intent to dodge FOIA requests -- either by ensuring "no documents found" when Clinton's State Department email address was searched, or by being able to control any release by being the chokepoint for responsive documents.

To accomplish this, Clinton's team set up a private email server that was insecure and did not follow State Department guidelines. In fact, her team brushed off the agency more than once before finally informing it that they simply would not comply with State Department regulations.

In a blistering audit released last month, the State Department's inspector general concluded that Clinton and her team ignored clear internal guidance that her email setup broke federal standards and could leave sensitive material vulnerable to hackers. Her aides twice brushed aside concerns, in one case telling technical staff "the matter was not to be discussed further," the report said.

The FBI investigation that Clinton refuses to call an investigation continues. There may be no criminal charges forthcoming, but there's already plenty of evidence that Clinton's use of a private email server was not only dangerously insecure, but put into place in hopes of limiting her accountability.

Filed Under: email, foia, hillary clinton, security, state department, vulnerabilities

Baltimore Transit Officials Won't Release Footage Of Freddie Gray Protests Because Everything Is Always About 'Terrorism'

from the an-excuse-with-a-universal-adapter dept

The excuse that worked so well for so long -- "because terrorism" -- seems to have lost its luster. Despite having a locked iPhone tied to a mass shooting with terrorist overtones, the FBI was unable to budge the needle on encryption backdoors or magical "lawful access" crypto keys.

However, that doesn't mean any number of government entities aren't willing to use the ever present "threat" of terrorism as fuel for their various civil liberties-endangering bonfires. Or that they won't use it as a profoundly cheap excuse to withhold information from the American public -- like the Indiana State Police's refusal to turn over Stingray docs because doing so might allow terrorists to plan attacks on cherished annual state events like the Mule Day Parade.

The Maryland Transit Authority has been ducking a Public Information Act (PIA) request from the Baltimore Sun for nearly a year at this point. The paper asked for surveillance footage from the Mondawin Metro station, captured in April of last year as police shut down mass transit in anticipation of protests following the death of Freddie Gray in the back of Baltimore PD van.

The MTA's first refusal utilized another very popular law enforcement excuse.

In denying the Sun's first PIA request last year, the MTA said that the office of Baltimore State's Attorney Marilyn Mosby had asked it not to release the footage because it was still being used in criminal investigations.

The Sun took this in stride and issued another request almost a year later.

The Sun sent the MTA another PIA request for the footage last month, noting that there is a statute of limitations of one year for misdemeanor charges, and that it had been a year since the incident in question — limiting the number of pending investigations there could be.

If some footage remained relevant to open investigations, The Sun said, that footage could be redacted and the rest made available.

The MTA's bluff had been called but it still had no interest in turning over the requested footage. So, it reached for the bluff that can never be called -- because it is existential, wholly subjective, and without an expiration date.

When the MTA responded last week, it made no mention of pending investigations in the state's attorney's office. It said instead that the footage could not be released because of Homeland Security concerns.

If you thought that was the end of the stupidity, you're mistaken. The Sun asked for clarification -- did this mean the MTA would never release footage from its security cameras? The MTA clarified with a bullshit-laden buck pass:

The MTA responded Friday, explaining that The Sun would have to ask the federal Transportation Security Administration for written permission to review any of the footage from the cameras, because they were funded through Homeland Security grants.

The MTA controls the cameras. It acquired them with grant money, but they are still the sole property of the MTA. The TSA is a completely unconnected third party. The DHS hands out grant money, not the TSA. And even if the TSA was somehow connected because of the grant, the footage requested only involved local law enforcement.

But it gets even worse. Even if the Sun were able to talk the TSA into granting permission (that really isn't its to grant) for the release of the requested footage, the MTA would still refuse to hand it over.

[I]f The Sun were to get that permission, it said, the MTA still would deny the footage based on its belief that the footage "would reveal the facility's safety and support systems, surveillance techniques, and security systems and technologies," as well as "jeopardize the security of the facility; facilitate the planning of a terrorist attack; and endanger the life or physical safety of the public."

This is the problem with public records laws. The government still maintains far too much control. Officials may occasionally talk big about "presumption of transparency," but when push comes to shove, its agencies like these doing all the pushing and shoving -- and routinely delivering the government equivalent of the playground rebuttal: "Make me."

Filed Under: baltimore, foia, freddie gray, protests, terrorism, transit, tsa

FBI Sues To Block Disclosure Of Surveillance Cameras Locations Because It Would Violate The Privacy Of Those Surveilled

from the we-don't-negotiate-with-(FOIA)-terrorists dept

Another injunction request has been filed in response to a Phil Mocek public records request pertaining to Seattle's power utility. This time, Mocek and MuckRock (through which Mocek's requests have been routed) are not named as defendants. It's only the city of Seattle and its public utility (Seattle City Light) being named as defendants, but Mocek's public records request is specified in the federal court filing [PDF]. (h/t Mike Scarcella)

This time, the plaintiff isn't a multinational corporation. It's the Federal Bureau of Investigation. The nexus for the FBI's attempt to block further disclosures to Mocek (and other requesters like local new station KIRO) is its remora-esque relationship with Seattle's public utility. After a long paragraph utilizing terms like "tradecraft," "concealments," and "advanced electronic surveillance," we finally get to the real reason the FBI wants the court to keep the city of Seattle from handing out any more public utility documents to requesters.

Among other types of video surveillance techniques and methods, the FBI may lawfully install a video camera on an existing utility structure, such as a power pole (“pole camera”), in furtherance of an authorized investigation, when use of the method is reasonably likely to achieve investigative objectives.

The FBI then goes on to argue that despite the cameras being attached to publicly-owned property, they're still sensitive and secret -- unlike countless other cameras serving pretty much the same purpose.

The FBI’s use of surveillance cameras must be distinguished from that of any other state or federal law enforcement agency on two principal grounds. First, in light of the FBI’s unique law enforcement and national security missions, there are particular sensitivities attached to the FBI’s use of surveillance equipment and the tradecraft associated with that use. Second, unlike the use of surveillance cameras by other entities, such as state and local governments or private businesses, which may operate video surveillance cameras in public locations to deter crime or promote public safety generally, the FBI utilizes surveillance cameras only in furtherance of an authorized investigation of a particular subject(s).

It also restyles its anti-FOIA "mosaic" theory into something a bit more relatable.

Disclosure of even minor details about them may cause jeopardy to important federal interests because, much like a jigsaw puzzle, each detail may aid adversaries in piecing together information about the capabilities, limitations, and circumstances of equipment’s use, and would allow law enforcement subjects, or national security adversaries, to accumulate information and draw conclusions about the FBI’s use of this technology, in order to evade effective, lawful investigation by the FBI.

If the location of these cameras were disclosed, suspects would seek to avoid being recorded by them. This is a logical argument. But it's followed by one that's much harder to accept at face value. The FBI claims -- engage your paradox-absorbing crumple zones now -- that disclosing the location of the cameras would result in the violation of privacy of suspects the FBI alread has cameras aimed at.

Because of their close proximity to the subjects of surveillance, unauthorized disclosure of the locations of current or previously installed pole cameras can reasonably be expected to constitute an unwarranted invasion of privacy for those persons under investigation who have not yet been charged.

The FBI can watch anyone 24/7, but if a citizen works their way backward from a camera's location to speculate on who might be the target, that person's privacy will have been invaded.

But this sort of math has a low probability of arriving at the correct conclusion. Hence, the FBI also points out that location disclosure would violate the privacy of everyone in the general vicinity.

It can also reasonably be expected to constitute an unwarranted invasion of the privacy of innocent third parties not under investigation but geographically near the current or past location of the camera, who may falsely be assumed to be the subject of an FBI investigation.

Because the FBI doesn't want Seattle City of Light employees removing its concealed cameras, it has shared the locations of its extra eyeballs with the utility. But the FBI wants the city to withhold more than just the location of FBI cameras. It wants everything related to the FBI blocked from release in order to prevent jigsaw assembly by public records recipients. The city, so far, has refused to do so and appears to be challenging the FBI's secrecy demands.

In January 2016, the City informally notified the U.S. Attorney’s Office that, following the City’s release of the partially redacted FBI information to KIRO, City Light had received a second PRA request from Phil Mocek, challenging the City’s withholding of the redacted information. Shortly thereafter, the City formally notified the FBI of this request by letter. In the same notice, the City also stated that it did not intend to withhold any of the confidential and sensitive information which it had redacted in connection with the earlier request, and that it would release all FBI information at issue unless the FBI obtained an injunction prohibiting such release.

The city did agree to give the FBI time to seek an injunction. This may look like deference, but it could very well be that the city is hoping to have the court more clearly define the limits of public records disclosure exemptions. If this moves far enough ahead, the FBI will be forced to justify its demands for the redaction of all information related to its use of city property to conduct surveillance.

As a result of previous "unauthorized" disclosures, the FBI has stopped sharing the locations of its cameras with the city's light utility. The theoretical destruction of its cameras by utility employees is the basis for the FBI's "we've already been injured by records releases" claim. The FBI then goes on to claim that challenging federal agency demands for secrecy isn't in the public's interest.

[T]he absence of communications with City Light has placed FBI equipment at risk of inadvertently being removed or destroyed by City Light personnel. Such lack of coordination and communication between state and federal government entities is contrary to effective law enforcement and otherwise contrary to public interest in good government.

All the FBI wants is the complete control of any public records request response that might somehow involve it.

On the Fifth cause of action, for an Declaratory Judgment that any similar Protected Information the FBI has shared in the past or may in the future share with the City or City Light for law enforcement purposes is:

a. exempt under the PRA;

b. subject to the federal law enforcement privilege;

c. subject to a federal common law duty of confidentiality;

d. subject to a common law property interest; and

e. that the Protected Information may not be disclosed by the City for any other secondary purpose, without the express permission of the FBI.

The FBI, it would appear, wants the federal court system to put its weight behind an ad hoc non-disclosure agreement, a la the Stingray-related demands it places on every law enforcement agency that acquires this surveillance tech.

It's looking to have federal FOIA exemptions (along with some made-up stuff like "duty of confidentiality") override local public records statutes even as it's using city property as tripods for its cameras. Rather than try to have it all, it could simply cut the city out of the loop (as it's doing now) and run the risk of losing a few cameras. Instead, it's seeking to make the city of Seattle a wholly subservient "partner" in its surveillance efforts.

A judge has already granted a temporary injunction. If it's made permanent, it will give the FBI final say on public records responses in Seattle -- and presumably elsewhere in the same federal district.

Filed Under: fbi, foia, seattle, surveillance cameras

NSA Emails Provide Little Insight Into Snowden's Pre-Leak Concerns, But Speak Volumes About Agency's Internal Controls

from the a-smoking,-tangentially-related-gun dept

Jason Leopold has secured another comprehensive set of Snowden-related documents from the NSA, dealing with the agency's search for evidence backing up his claim that he tried to take his complaints to intelligence community officials before heading to Hong Kong with a drive full of secret documents.

The long, detailed post -- written with the help of Marcy Wheeler and Ky Henderson -- covers the 800+ pages of internal emails released to Vice in response to a FOIA request. The headline suggests there's a smoking gun, but a few thousand words later, the conclusion seems to be, "There's possibly a smoking gun... and the NSA, due to malice or just incompetence, is going to be of no help in locating it."

What is undoubtedly true is that there was more to Snowden's concerns than the single email released to shore up the NSA's side of the story. There is evidence Snowden contacted other officials about his concerns, but the agency decided to present the single email as though that were the extent of Snowden's complaints.

This posed problems later as Snowden repeated his assertion to other news outlets, including NBC and Vanity Fair. These resulted in further search efforts from the agency which had already claimed to have uncovered everything that could be considered evidence of Snowden's "proper channels" claims.

The following morning, [NSA General Counsel Rajesh] De sent someone at NSA an email with the subject line "NBC/email."

"I need very senior confirmation [Kemp/Moultrie) [a reference to the NSA's director of security and Ron Moultrie, then the NSA's deputy SIGINT director] that all possible steps have been taken to ensure there are no other emails from [Snowden] to OGC," De wrote.

Those assurances apparently could not be provided — even though the agency had publicly been saying over the course of a year that no other relevant communications from Snowden existed.

What's been released by the NSA seems at odds with Snowden's claims that he made several efforts to bring his concerns to the proper authorities. Other communications were uncovered, but none of those dealt with privacy concerns or other whistleblowing attempts.

That certainly doesn't mean the NSA's first assertion that Snowden didn't raise concerns internally is correct either. The released documents show that its ability to search its own files is far less robust than the systems it uses to dig through the rest of the world's communications. For one, the agency appears to have been unable to retrieve emails related to Snowden's work with Booz Allen. Another heavily-redacted email says the NSA was able to gather and read through everything from Snowden's NSAnet and NSAgov accounts, but appends the phrase "that we've been able to obtain," suggesting the results of its search aren't as comprehensive as it would have the public believe.

What's far more disconcerting is the fact that the NSA -- the king of metadata -- isn't able to keep its own email metadata in working order.

What's remarkable about this FOIA release, however, is that the NSA has admitted that it altered emails related to its discussions about Snowden. In a letter disclosed to VICE News Friday morning, Justice Department attorney Brigham Bowen said, "Due to a technical flaw in an operating system, some timestamps in email headers were unavoidably altered. Another artifact from this technical flaw is that the organizational designators for records from that system have been unavoidably altered to show the current organizations for the individuals in the To/From/CC lines of the header for the overall email, instead of the organizational designators correct at the time the email was sent."

There's no telling where this falls on the stupid/malicious scale, but either way, it helps the NSA muddy the timeline waters and obscure the agencies/personnel involved in these email discussions. That admission is downright frightening considering what the agency does with the metadata it harvests.

Remember, this is the agency that “kills people based on metadata,” per its former Director, Michael Hayden.

But “due to a technical flaw in an operational system,” it could not preserve the integrity of either the time or the aliases on emails obtained under FOIA.

That's the scary part. Here's the hypocritical part, as pointed out by attorney and CUNY law professor Douglas Cox, in response to Marcy Wheeler's post on the NSA's metadata problem:

[Y]our point is right on, even in more mundane contexts not involving drone strikes it is remarkable the disconnect between standards agencies impose and those they practice. When you are producing docs to a govt agency in response to doc requests, eg, you often have to abide by exacting standards in format including careful capture of metadata, but with FOIA you get things like this.

Among the things this careless approach to internal metadata accomplished was obscuring the genesis of one official's recounting of a face-to-face meeting with Snowden over surveillance concerns.

As noted, the compliance woman's story had to be corrected to match the dates up to when Snowden would have been at Fort Meade. "We received a call from D4 [Office of the Director of Compliance] questioning the dates (11 or 12 Jun) that [redacted] annotated during the discussions on" the Section 702 course, one of the other people in Oversight and Compliance wrote on April 10. She "has modified her dates to reflect 5-12 April 2013."

NSA did not provide a version of the draft of the email with the incorrect date. When the chief of Oversight and Compliance provided a description of all the department's interactions with Snowden to the NSA chief of staff, Elizabeth Brooks, in June 2014, there was no mention of any other paper trail of the exchange, though earlier that same day the deputy chief had stated, generally, that that information had been provided to Ensor on June 10, 2013.

One thing that is clear, however, is that the apology laying all these details out, written after several days of fact checking at the NSA and document review in June 2014, leaves out at least one key detail — that the OGC email and the face-to-face communication could have happened the same day, making it far more likely they should be treated as parts of the same exchange. More significantly, the apology claims that "in response to the June 2013 Agency All... she provided in writing her account of these engagements." If the timestamps on documents provided to VICE News are correct (something that the NSA has admitted is a problem with this FOIA response), she actually provided her side of at least the OGC contact even before the Agency All email. But there is no record she provided her written account, to either of these exchanges, until a year after the event, a detail — if true — that Rogers should have known.

Beyond that, there's the NSA's ongoing obsession with controlling this narrative. The agency refused to answer questions from Vice pertaining to these documents but it did send it an email informing it that it had already made the FOIA documents available at the ODNI's website, presumably in an attempt to undercut Leopold/Vice's "exclusive."

The jury is still out on Snowden's claims he took his complaints to the proper officials before deciding to leak the documents he obtained. The NSA's assertions of it just being one email would be far more believable if it could provide any evidence that it can handle its own internal email systems with any sort of competence. But as far as this release goes, there's nothing in it definitively pointing to multiple attempts by Snowden to raise concerns. But it's also a stack of documents whose release was overseen by the same agency he exposed and one that still needs every "victory" it can earn… or take.

Filed Under: ed snowden, emails, foia, internal controls, jason leopold, nsa, whistleblowing

FBI Won't Tell Me How Much It Paid To Break Into Syed Farook's iPhone, Saying It Might Jeopardize Its Investigation

from the say-what-now? dept

As you probably recall, several months ago, after going to court to try to force Apple to write some software to allow the FBI to hack into Syed Farook's work iPhone, the DOJ and FBI abruptly called off the case, claiming that it had been able to get an exploit that let it into the phone. A few weeks later, FBI Director James Comey suggested that the government paid over $1.2 million to get that exploit from some "hackers." Some later news reports indicated that the FBI quietly tried to talk down those numbers, and suggested that perhaps Comey was just bad at math (rather than name a number, he said that the FBI had paid "more than I will make in the remainder of this job, which is seven years and four months....").

Either way, I sent a FOIA request into the FBI that day asking for either the invoice or any other documentation showing how much the FBI had paid to get into Farook's work iPhone. The FBI has now rejected my FOIA request, arguing that since this is an "ongoing investigation," responding to such a request might somehow "interfere" with the case. This is complete hogwash, for a variety of reasons. First, Farook is dead. Second, what investigation is there left to do? We know that Farook and his wife shot up Farook's office party and killed a bunch of people. We also know that the FBI was so unconcerned about further investigation that it allowed reporters to ransack Farook's townhouse soon after the shooting. Third, how the hell would revealing the price impact the investigation? The answer is that it will not. There is nothing in saying "it cost us $1 million" or "it cost us $653,000" or whatever, that in any way interferes with whatever investigation remains to be done.

This is nothing more than the FBI doing what the FBI frequently does with FOIA requests. Denying them because the FBI doesn't want to answer.

Filed Under: exploit, fbi, foia, iphone, james comey, syed farook, vulnerability

Court Dumps Hastily-Granted Restraining Order, Says MuckRock Can Publish Smart Meter Documents

from the prior-restraint-much? dept

It took a little less than a week, but the EFF, with the invaluable assistance of Venkat Balasubramani of FOCAL PLLC, has persuaded a Washington state judge to strike down the temporary restraining order against MuckRock he hastily granted back on May 27th.

Landis+Gyr, a multinational corporation owned by Toshiba, recently secured a contract to upgrade Seattle's "dumb" meters to smart meters. Privacy activist Phil Mocek requested information on the city's smart meter plan through MuckRock and was handed two Landis+Gyr documents in unredacted form by the city.

These documents worth suing over spent a month uploaded to MuckRock before Landis+Gyr took notice. Once it had secured the city contract, L+G then demanded -- via a request for a temporary restraining order -- that MuckRock take the documents down, turn over info on site users who may have seen/downloaded them, and somehow help L+G shove its smart meter genie back into the bottle.

Fortunately, the judge has now struck down the restraining order he issued earlier in the week.

Agreeing with EFF, King County Superior Court Judge William Downing ruled that the previous order amounted to a prior restraint on speech that violated the First Amendment, and rescinded it along with denying plaintiffs’ request to extend it.

Not that Landis+Gyr didn't try to keep its restraining order alive -- despite openly acknowledging that one of the two documents contained nothing worth withholding. In its final attempt to salvage its request, L+G claimed that an internet full of evildoers now has access to sensitive information that could place citizens in danger.

Defendants knowingly posted Landis+Gyr’s protected information on its publicly-accessible website, where Landis+Gyr’s competitors, as well as hackers and saboteurs, had access to the information. In fact, internet traffic surrounding the disclosure reveals the danger caused by Defendants’ refusal to remove the information. See Second Supplemental Declaration of Eric Lee Christensen in Support of Motion for Preliminary Injunction, ¶¶ 2, Exhs. A. (“I read all your secret information, you [expletives deleted]”), ¶ 4, Exh. C, p. 8 (“visit the link below to download disputed documents”).

Without access to the exhibits, I can only assume the deleted expletives were "censorious asshats" and that "visit the link below to download disputed documents" is internet code for "seize the means of production, starting with the power grid."

Landis+Gyr's fears of terrorism are overblown, if these are the best pull quotes it could find to illustrate its "hackers n' saboteurs" theory. It may be that its trade secret claims are more based in reality, but that still doesn't explain its attempt to silence a third-party FOIA clearinghouse for doing nothing more than publishing documents handed to it by a government body.

Filed Under: foia, prior restraint, seattle, smart meters, streisand effect
Companies: eff, landis+gyr, muckrock