FOIA'ed Documents Show NSA Abuse Of Pen Register Statutes To Collect Content

from the subpoena-an-inch,-take-a-mile dept

New FISA court documents have been handed over to the EFF as the result of its long-running FOIA lawsuit. The new pile of documents is, unfortunately, very heavily-redacted, forcing readers to extrapolate a lot from the missing data.

One of the few released FISA court docs leaving anything legible concerns the NSA's use of pen register/trap-and-trace orders to collect content, rather than just dialed phone numbers. The NSA (along with the FBI) has been admonished for its abuse of these orders before, thanks to its insistence any numbers dialed are fair game, even if they could be construed as partial contents of calls -- i.e., communications.

What the NSA liked to scoop up were "post cut through dialing digits" -- any numbers dialed after the phone number itself. These numbers could contain such things as credit card numbers, menu selections for automated services, and other information that could not be considered a dialed phone number.

The FISA court put an end to this, noting (all the way back in 2006) the government's complaints it couldn't segregate phone numbers from post cut through digits were laughable. It cites a magistrate judge's denial of the government's PR/TT order for these very reasons and asks the government to explain what actions it had taken in response to this denial.

On July 19, 2006, the Honorable Stephen WM Smith denied a government application to acquire post-cut-through digits in a criminal investigation, expressly rejecting the government's argument that 18 U.S.C.3121(c) implicitly authorizes the acquisition of contents using a pen register/trap and trace device, given the current state of filtering technology In re Application of the United States for an Order Authorizing (1) Installation and Use of a Pen Register and Trap and Trace Device or Process. (2) Access to Customer Records, and Cell Phone Tracking, F.Supp.2d 2006 WL 2033877, at 6, 9 (SD. Texas, 2006).

Accordingly, the government is ordered to submit a written brief to the Court, no later than [redacted] discussing how, if at all, Magistrate Judge Smith's opinion affects the government's analysis of this issue as set forth in its Memorandum.

It also should be noted -- as the EFF's Aaron Mackey points out -- the NSA spent nearly eight years collecting internet metadata with pen register/trap-and-trace orders before being forced to give up this bastardization of this zero oversight collection method, which was written specifically to target dialed phone numbers only.

Ultimately, the EFF is disappointed with this document dump and will likely challenge the NSA's withholding of 12 requested documents in full. The NSA is supposed to deliver another set of documents from this lawsuit before the end of the year. But it's falling behind on its other obligations. The USA Freedom Act mandated timely declassification of FISA court opinions, but the ODNI (Office of the Director of National Intelligence) appears to be moving forward with as little transparency as possible. Twelve documents withheld, eleven documents delivered composed mainly of blacked-out text. Hopefully, we'll have more to work with when the NSA delivers its next batch sometime in the next couple of months.

Filed Under: fisa, foia, nsa, pen register, surveillance

Unnamed Tech Company Challenged 702 Surveillance Order

from the all-hail-the-mystery-men/women-at-[REDACTED] dept

In response to FOIA lawsuits, the Office of the Director of National Intelligence turned over two (!) stacks of FISC documents pertaining to Section 702 surveillance. One document [PDF] (from an ACLU lawsuit) reveals a tech company (whose name is redacted) refused to hand over (or provide access to) communications requested with a Section 702 order. This order was issued in 2014, so it's a post-Snowden challenge. The end result -- determined with almost zero participation from the tech company -- is an order from Judge Rosemary Collyer demanding the tech company produce the records.

Discussed along the way to this conclusion are several things, including the NSA's problems with the Section 215 collection. There are also discussions about the adequacy of the NSA's minimization processes, meant to protect the privacy of US persons caught in the agency's internet dragnet. Unfortunately, we're not able to see much of this discussion, thanks to the opinion being heavily-redacted.

But we may be one step ahead of the mystery tech company, which had to fight this legal battle completely blind. All arguments and evidence were provided by the government, in camera and ex parte. The tech company was apparently allowed to submit its arguments, but was otherwise sidelined by the national security nature of the legal proceeding.

The opinion notes that the ODNI had issued a new 702 directive in 2014, presumably expanding the NSA's collection powers, which seems like a really odd decision post-Snowden. This is apparently what the tech company challenged. There's not much else that can be gleaned from the court's discussion of the expanded powers and their effect on the Fourth Amendment, other than it disagrees with the tech company's assessment. At one point, the court states "This argument is simply not supported by the facts" before heading into six fully-redacted pages apparently discussing the facts that don't support the company's arguments.

The court also finds, despite evidence to the contrary, NSA "incidental" collection of US persons' communications does not happen "frequently, or even on a regular basis." Any discussion of what the court feels is an acceptable amount of violations is, again, hidden under page after page of redaction.

To sum up, the court concludes that even if it's a close call on the Fourth Amendment (and even if the company had standing to bring this challenge), the national security purpose of the collection outweighs most possible privacy concerns. It expresses a great deal of faith in the NSA's internal oversight -- which seems odd considering the admissions by the NSA about its collection tactics in other released documents, including the fact that it relies almost completely on self-reporting and spot checks to minimize use of incidentally-collected US persons' communications.

The good news is that the NSA's inability to stop incidental collection resulted in the shutdown of the "about" collection. The other good news is some mystery company took a strong stand to protect its users' privacy. The downside, however, is the challenge failed. Worse, it appears the NSA's other 702 collection methods are still capable of grabbing US persons' communications and its internal oversight hasn't gotten much better over the years.

Filed Under: challenge, doj, fisa, fisa court, fisc, nsa, section 702, surveillance

Oh, Sure, Suddenly Now The House Intelligence Boss Is Concerned About Surveillance... Of Mike Flynn

from the high-court,-low-court dept

We've written a few times about Rep. Devin Nunes, who heads the House Intelligence Committee. He's been a long-time vocal supporter of NSA surveillance. He insisted that there was no need for reform after the Snowden leaks and he actively misled the public and other members of Congress to shoot down an amendment that would have stopped so-called backdoor searches of "incidentally collected" information on Americans. Nunes falsely claimed that by blocking backdoor searches of the 702 database, it would have blocked things such as tracking whether or not the Orlando nightclub shooter had overseas contacts (it would not have done that at all).

So it's fairly hilarious to see that Nunes' first reaction to the news of National Security Advisor Mike Flynn's resignation was to demand answers on why Flynn's calls with Russian officials were recorded.

“I expect for the FBI to tell me what is going on, and they better have a good answer,” said Rep. Devin Nunes (R-Calif.), chairman of the House Permanent Select Committee on Intelligence, which is conducting a review of Russian activities to influence the election. “The big problem I see here is that you have an American citizen who had his phone calls recorded.”

Uh, dude, you approved this kind of thing (loudly and proudly), and not only that, but you actively blocked suggested amendments that would have blocked the using of this information to dig into information on US persons. Maybe it's time to rethink that one, huh? Of course, (former assistant Attorney General) David Kris (who knows this stuff probably better than anyone else) has made it clear that Flynn's calls with a Russian official wouldn't need to be "minimized" (i.e., have his identity excluded) because "a U.S. person’s name can be used when it is necessary to understand the foreign intelligence information in the report."

Of course, there's lots of irony to go around here. Timothy Edgar -- who was the director of privacy and civil liberties for the White House National Security staff under Obama (and also did privacy/civil liberties work in the Bush administration) has noted that the leaking of the contents of his phone calls actually means that Flynn's own civil rights have been violated and even suggests he gives the ACLU a call (oh, and another layer of irony: Edgar has been warning about how Flynn and others in the Trump administration might trample on civil liberties... and yet here, he's arguing that Flynn's civil liberties have been violated.)

Along those lines, Glenn Greenwald notes that the leaking of actual content from intercepted communications is a really serious crime, but one that should be seen as totally justified here, as it was clearly a form of whistleblowing (even as he admits that the motives of the leakers likely weren't pure, but were possibly for revenge against Flynn, who many in the intelligence world disliked).

It is a big deal to actually leak the contents of an intercepted communication (most leaks and whistleblowing tend to be about programs, not the actual intercepted communications). Of course, this should raise other questions about why the NSA and FBI are surveilling so many people -- and will the content of those other calls be used for political vendettas rather than true whistleblowing? Unfortunately, it seems unlikely that someone like Devin Nunes is going to care about all that. In typical "high court/low court" fashion, he's only concerned that someone on his team was hurt by such surveillance, not that such surveillance regularly occurs.

Filed Under: devin nunes, fisa, house intelligence committee, michael flynn, minimization, surveillance

Appeals Court Affirms NSA Surveillance Can Be Used To Investigate Domestic Criminal Suspects

from the spooks-in-the-federal-cop-shop dept

The Seventh Circuit Court of Appeals confirms what's already known about the NSA's domestic surveillance: it's not just for terrorism.

The NSA collections -- done in the FBI's name -- are supposed to only gather info related to international terrorism. But that requirement has been phased out. The NSA "tips" a certain amount of data to the FBI for its own use and it has been shown in the past to do the same for the DEA, which it then instructs to obscure the origin of its info.

An opinion [PDF] just released by the Appeals Court, says basically the same thing: although the NSA's surveillance is supposed to be used to sniff out terrorists, there's nothing in the law that prevents it from using its collections to go after criminals.

Gregory Turner was convicted of conspiring with Prince Asiel Ben Israel (both US persons) to provide aid to Zimbabwean "Specially Designated Nationals" -- in this case a group working to block the institution of more democratic processes and procedures in that country.

Turner moved to suppress the evidence, claiming that the government's use of a FISA order to obtain information on his activities violated the NSAs foreign intelligence directives. But the court finds the directive does not limit FISA warrants to terrorism only. The government only needs to "reasonably believe" a target is an "agent of a foreign power."

The government informed Turner it had gathered evidence using FISA-authorized surveillance. Then it refused to turn over information to him with regards to its activities. From the redacted, terribly-reproduced decision:

On February 27, 2014, Turner filed a motion for disclosure of FISA materials and motion to suppress evidence obtained or derived from FISA. The government responded to these motions with a classified brief and a sealed appendix submitted ex parte to the district court and redacted, unclassified version served to Turner. Additionally, the government filed a "Declaration and Claim of Privilege" by the Attorney General that declared, "it would harm the national security of the United States to disclose or hold an adversarial hearing with regards to the FISA materials…"

Both motions by Turner were denied. These denials have been upheld by the Appeals Court. Turner claimed the government failed to meet its probable cause requirements for the FISA warrant and also violated his First Amendment rights with its surveillance.

Much of the court's reasoning is redacted but it does have this to say about Turner's assertions.

Turner contends that "FISA appears to require the communications subject to surveillance of a United States person must related directly to activities involving international terrorism as defined in FISA." Turner misstates the law. FISA is not limited to activities involving international terrorism. FISA authorizes surveillance and searches based on probable cause that the target is an "agent of foreign power," which relates to "any person" engaged in certain activities… on behalf of a foreign power, including "clandestine intelligence gathering activities" and "enter[ing] the United States under a false or fraudulent identity… or while in the United States… assum[ing] a false or fraudulent identity." These activities are listed in addition to "international terrorism."

Not only that, but the laws governing FISA-ordered activities were loosened in 2008 to encompass all sorts of criminal activity not related to foreign powers or international terrorism.

FISA, as amended in 2008, "eliminated any justification for the FISA court to balance the relative weight the government places on criminal prosecution as compared to other counterintelligence responses." [...] [T]he amended FISA statute "does not oblige the government to demonstrate to the FISA court that its primary purpose in conducting electronic surveillance is not criminal prosecution."

As for Turner's First Amendment claims, the court finds the activities he engaged in were not covered under the First Amendment, no matter how "right" Turner may have believed undermining the installation of a democratic government was. As the court sees it, the government established Turner was an "agent of a foreign power," something that strips away protections normally afforded to political activity. Or maybe just political activity the US government doesn't approve of.

Either way, it's very clear FISA court orders can be used to engage in domestic surveillance purely to investigate criminal activity, something the NSA hasn't exactly been forthcoming about. As long as a foreign power is somehow involved, the NSA and the FBI are interchangeable surveillance pieces, even though one of them is assumed to be mostly uninvolved in domestic surveillance of US persons.

Filed Under: 7th circuit, crime, domestic, fisa, gregory turner, nsa, surveillance, terrorism

Court Says FBI Must Review Its NSL Gag Orders Every Three Years, Rather Than Almost Never

from the a-small-shift-in-the-secrecy-status-quo dept

The magical, wonderful, oft-abused National Security Letters have been deemed Constitutional, thanks to the vague promise of reviews by courts and government agencies to determine whether or not the normally-indefinite gag orders accompanying them can stay in place.

The USA Freedom Act took away the "indefinite" part of the equation, stipulating that NSL gag orders must be justified by periodic reviews. Unfortunately, "periodic" was left open-ended. The language only specifies "appropriate intervals." It does place the burden on the government to prove that a NSL's gag order is still necessary, but makes no specific demands on how often the government should have to make these assertions.

The FISA DC District Court, however, has specified what a "periodic review" should entail -- at least narrowing down what period "periodic" should mean.

In this order [PDF], a redacted company exercised its USA Freedom Act option to demand a review of gag orders connected to two NSLs it had received. After some in camera presentations to the FISA court, along with some discussion between the NSL recipient and the FBI, it was agreed that the gag orders could stay in place for the time being, but that the FBI should be given the burden of specifying a time frame for periodic reviews, rather than forcing the recipient to file petitions repeatedly until the gag orders were finally determined to be no longer necessary.

The order redacts the number of years these gag orders have been in place, but it's safe to assume the number hidden behind the gray box is larger than one.

The court looks to the Attorney General's own gag order termination policy, crafted in response to stipulations in the USA Freedom Act. Unfortunately, it doesn't do much to narrow down what sort of "period" a "periodic review" covers. The policy says the FBI only needs to review its NSL gag orders every three years or at the close of an investigation. As the court notes, this is far from satisfactory.

Such procedures, as [REDACTED] points out, leave several large loopholes. First, there is no further review beyond these two, meaning that where a nondisclosure provision is justified at the close of an investigation, it could remain in place indefinitely thereafter. Second, these procedures by their own terms apply only to "investigations that close and/or reach their three-year anniversary date on or after the effective date of these procedures;" as a result "a large swath of NSL nondisclosure provisions… may never be reviewed and could remain unlimited in duration." Third, for long-running investigations, there could be an extended period of time -- indefinite for unsolved cases -- between the third-year anniversary and the close date.

The court points out that the loopholes pretty much nullify the legislation's demand for periodic NSL gag order reviews. The court ordered the FBI to explain why it should not be able to handle annual reviews of its NSL nondisclosure requirements.

The FBI complained that doing so would be "cumbersome." The court agreed that reviewing every NSL every year would be too burdensome for the agency. However, the decision just glides past the jaw-dropping number of NSLs issued by the FBI -- 16,000 annually -- without further comment.

So, the FBI, having burdened itself by using NSLs rather than court orders or warrants, isn't required to perform annual reviews of its gag orders. Fortunately, it's no longer allowed to simply follow the loophole-filled policy issued by the Attorney General. The opinion notes that the AG's policy "seems inconsistent with the intent of the law." Recent FISA court addition Judge James Boasberg pulls a number out of the air and declares it good:

The Court believes that, given both the facts and the circumstances of this particular case and the legal authority discussed above, a triennial review fairly balances the specific burdens on the FBI against the countervailing interest that [REDACTED] has in avoiding a lengthy and indefinite nondisclosure bar.

The gag orders that are currently in place (and have been in place for an indeterminate number of years) are allowed to remain. The FBI will have to review these every three years from now on. This is better than the AG's policy and much better than the open-ended language of the USA Freedom Act.

But it's unclear whether this order is meant to govern the FBI's other NSLs, or simply the two involved in this particular case. There's nothing in the opinion that suggests this is a blanket policy change, but as the court notes earlier in the decision, it seems likely that anything granted to this particular entity will be requested by others in the same position. Given the reasoning used to make this determination, it would be difficult to imagine a situation where similarly-situated recipients would not be able to avail themselves of the court-ordered review process -- rather than being forced to file review petition after review petition for the rest of whatever.

Filed Under: doj, fbi, fisa, fisa court, fisc, gag orders, nsl, nsls, reviews

Documents Show FISA Court Refusing To Grant FBI's Requests To Scoop Up Communications Along With Phone Metadata

from the rubber-stamp-runs-dry dept

A handful of FOIA documents [PDF] obtained by EPIC (Electronic Privacy Information Center) are shedding some new light on the FISA court and its relationship with the FBI. The good news is that the court is not quite the rubber stamp it's often been portrayed as. Even though a vast majority of requests are improved, there appears to be a significant amount of modification happening behind the scenes.

The documents reveal that the Foreign Intelligence Surveillance Court (FISA) told the FBI several times between 2005 and 2007 that using some incidental information it collected while monitoring communications in an investigation — specifically, numbers people punch into their phones after they’ve placed a call — would require an explicit authorization from the court, even in an emergency.

The FBI wanted to trap these digits using its pen register orders, which are only supposed to provide numbers called and received. This additional information had been considered "content," as these post-cut-through digits could reveal details such as credit card info or social security numbers.

The FBI's collection of content -- along with the call metadata it was actually authorized to receive -- appears to have continued until a FISA judge finally asked it what it was doing with this "incidentally collected" content. The DOJ, of course, argued that is was entitled to this information.

In May 2006, the government told the court that it had the authority to collect that sensitive information, and would “in some cases … specifically seek authority for secondary orders requiring a service provider to provide all dialing, routing, addressing or signaling information transmitted by a target telephone, which, in light of technological constraints, may include content and non-content digits alike,” the report continues.

It also claimed that, although it specifically sought to collect this info with modified pen register orders, it was only accessed for a limited number of reasons: national security, emergencies, exigent circumstances, etc. The FISA court doesn't appear to have believed the FBI's claims that it was seeking this information just to use it only in the rarest of circumstances.

The court “had made modifications to the government’s proposed pen register orders,” reads the biannual report to Congress obtained by EPIC. “Although the [FISA Court] has authorized the government to record and decode all post-cut-through digits dialed by the targeted telephone, it has struck the language specifically authorizing the government to make affirmative investigative use of possible content” unless permission is specifically granted by the court.

This pushback wasn't just limited to the nation's most secret court. The FBI also met resistance at local levels when trying to scoop up content with its metadata.

In July 2006, a magistrate judge in Texas denied an application for a pen register because filtering technology would not eliminate the additional content information.

This lower-level refusal was addressed by the FISA court, which asked the FBI how it expected this magistrate's refusal to affect its FISA court requests. The FBI replied it no longer had to worry about it as revisions to the US Patriot Act had given it permission to collect it all -- even stuff the agency treated as content when crafting its altered pen register requests.

This failed to move the court. It also failed to alter the FBI's tactics. The FBI continued to submit requests for post-cut-through content and the court, quite frequently, continued to strip this part of the agency's request from its approved orders. After several years, this became standard operating procedure for the FISA court, which instituted a blanket refusal on FBI requests for post-cut-through content, even for "emergency" reasons. This resistance is likely what prompted the FBI to turn something it wasn't being allowed to obtain into formal agency policy by 2011.

The new documents shed some new, somewhat surprising, light on the inner workings of the mostly-opaque FISA court, showing that it is not always inclined to give the government what it wants. It also shows the government doesn't seem to handle rejection very well, having to be told "no" repeatedly before the message sinks in.

Filed Under: fbi, fisa, fisa court, fisc, mass surveillance, metadata, requests, rubber stamp, surveillance

FBI Used FISA Warrant To Prosecute Boeing Employee For Child Porn Possession

from the regular-crime;-special-warrant dept

Ellen Nakashima of the Washington Post has the disturbing story of former Boeing employee Keith Gartenlaub, whose home was searched for evidence of his alleged spying for the Chinese. Specifically, the FBI was looking for documents about the military's C-17 transport plane. Instead, FBI agents came across something else.

[S]ince the search in January 2014, no spy or hacking charges have been brought against him.

Instead, seven months later, he was charged with the possession and receipt of child pornography. He has denied the charges, but a jury convicted him in December.

Questions have been raised about the evidence obtained during the search.

In Gartenlaub’s case, the defense unsuccessfully argued that he could not be linked to identical copies of child pornography videos found on four hard drives in his house. Two of the hard drives had been in a computer that was kept at a beach house where numerous people had access to it, Gartenlaub said.

[...]

Jeff Fischbach, a forensic technologist for the defense, said there is no evidence that the child pornography was ever seen by anyone who used the computer, much less Gartenlaub.

The government’s own forensic expert, Bruce W. Pixley, said he could not find any evidence of the material being downloaded onto any of the computers, the defense noted. That means it had to have been copied onto the computer — but by whom is unknown.

The defense had more difficulty than usual in challenging the evidence. The search wasn't performed with a standard FBI warrant, but instead -- due to its supposed national security implications -- with a warrant issued by the FISA court. That the FBI found child pornography instead is unfortunate, but that fact shouldn't nullify the original warrant or result in the suppression of the evidence, at least according to the DOJ.

While the DOJ is correct in the fact that the FBI wasn't going to call off the search after it uncovered evidence of other wrongdoing, its defense of the way the evidence was obtained is disingenuous. Unlike a regular warrant, a FISA warrant is almost completely unchallengeable. The entire process is ex parte, including the submission of evidence obtained -- even if the evidence has nothing to do with national security.

In Gartenlaub's case, every submission by the government was done under seal. His legal representation had no access to the government's presentation of evidence. The possession of child porn is certainly nothing the government takes lightly, but once the focus of the investigation shifted away from alleged espionage, the process likewise should have changed. At the very least, the FBI should have had a new warrant issued, signed by a regular magistrate judge -- one that would have allowed the defense to examine the affidavit and the results of the search.

JoAnne Musick of Fault Lines points out just how much the FISA Court's involvement screwed Gartenlaub.

Once the warrant issued, there was virtually no means by which Gartenlaub could challenge the basis for the warrant. Of course, the court found the pornography material “obtained pursuant to FISA was lawfully acquired” and did not violate the defendant’s Fourth Amendment rights. Additionally, after ex parte pre-trial briefings between the court and government, the judge found:

"[T]here is no indication of any false statements having been included in the FISA materials."

Surely the government would not have proven any false statements in their private discussions with the court. Perhaps had the defense had an opportunity to review or challenge the basis for the warrant, the court might have found false statements. Yet, we will never know as the defense was unable to review the evidence or otherwise challenge it. It’s disturbing that the accused was unable to obtain even basic information on how the information was obtained and why the warrant was issued.

The ability to challenge presented evidence is a key part of the justice system. Wrongs committed by the government during the search for evidence can only be righted through this process. But the use of a FISA warrant deprives the accused of that potential remedy. When it became apparent the investigation was no longer focused on matters of national security, the FBI should have unsealed documents and turned over evidence to Gartenlaub's legal reps. Instead, it chose to keep operating under the pretense it was investigating espionage and availed itself of all the advantages that come with national security-related investigations.

Then there's this: even though the FBI had enough evidence of child porn possession to prosecute (successfully) Gartenlaub and nothing in the way of evidence he was involved in spying for the Chinese, it still attempted to leverage what it had obtained to turn Gartenlaub into a government informant.

During his initial appearance in a federal courthouse in Santa Ana, Calif., the prosecutors indicated a willingness to reduce or drop the child pornography charges if he would tell them about the C-17, said Sara Naheedy, Gartenlaub’s attorney at the time.

So, not only did the government use its additional national security benefits to keep Gartenlaub from mounting a serious challenge to submitted evidence, but it also used evidence it gathered with an unrelated search to pressure him into admitting he was a spy -- something it had no evidence of at all.

Filed Under: child porn, fbi, fisa, law enforcement, national security, warrant

EFF Sues DOJ Over Its Refusal To Release FISA Court Documents Pertaining To Compelled Technical Assistance

from the EFF:DOJ::Coroner:Dr.-Nick dept

Given the heightened interest in the government's efforts to compel companies like Apple to break into their own products for them, the EFF figured it would be a good time to ask the government whether it had used FISA court orders to achieve these ends.

Naturally, the government would rather not discuss its efforts to force Apple, et al. to cough up user data and communications. Hence the secrecy surrounding its use of NSLs, subpoenas and gag orders. Hence, also, its desire to keep cases involving All Writs Acts orders under seal if possible. Hence also (also) its refusal to discuss the secret happenings in its most secret court.

The EFF filed FOIA requests with the DOJ in October of last year and followed up with more in March. The October request sought documents about FISA court decisions related to requests for technical assistance from US companies. After a few months of back-and-forth, the DOJ claimed only two responsive documents were found -- neither of which was a court decision… and neither of which would be released.

The EFF's most recent request broadened the search parameters in hopes of landing more responsive documents.

Any “decision, order, or opinion issued by the Foreign Intelligence Surveillance Court or the Foreign Intelligence Surveillance Court of Review (as defined in section 601(e)),” issued from 1978 to June 1, 2015, “that includes a significant construction or interpretation of any provision of law, including any novel or significant construction or interpretation of the term ‘specific selection term.’”

It also requested the same documents for the period of June 2015 to the present. As of this point, it has yet to receive a response.

The EFF is now suing the DOJ for wrongfully withholding responsive documents and other violations of FOIA regulations, including "performing inadequate searches."

The documents it's seeking are of significant public interest, especially now that the FBI's All Writs-enabled technical assistance demands are at the center of a second war over encryption. As staff attorney Nate Cardozo points out, the devices and services used by millions of Americans shouldn't be subject to the whims of secret courts relying wholly on government ex parte presentations and submissions.

“If the government is obtaining FISC orders to force a company to build backdoors or decrypt their users’ communications, the public has a right to know about those secret demands to compromise people’s phones and computers,” said Cardozo. “The government should not be able to conscript private companies into weakening the security of these devices, particularly via secret court orders.”

Filed Under: all writs act, doj, fisa, fisa court, foia, technical assistance, usa freedom act
Companies: eff

FISA Court Still Uncovering Surveillance Abuses By NSA, FBI

from the pretty-much-why-the-transparency-should-have-been-in-place-the-whole-time dept

With multiple redactions and having survived a declassification review, another FISA court opinion has been released to the public. The opinion dates back to November of last year, but was only recently dumped into the public domain by the Office of the Director of National Intelligence. While the five-month delay seems a bit long, the alternative is no public release at all. The small miracle that is the public release of FISA court opinions can be traced directly to Ed Snowden and a handful of FOIA lawsuits -- not that you'll see either credited by the ODNI when handing over documents.

The bad news is that the FISA court has uncovered still more abuse by the NSA and FBI. While there appears to be no imminent danger of the court yanking the agencies' surveillance privileges (as nearly happened in 2008), the presiding judge (Thomas Hogan) isn't impressed with the agencies and their cavalier attitude towards mass surveillance. The stipulations put in place to offset the potential damages of untargeted mass surveillance -- strict retention periods and minimization procedures -- are the very things being ignored by the NSA and FBI.

Josh Gerstein of Politico has dug into the 80-page decision and discovered that the NSA is still holding onto collected data indefinitely.

"The court was extremely concerned about NSA's failure to comply with its minimization procedures—and potentially" a provision in federal law, Hogan wrote. The NSA violations appeared to involve preserving surveillance data in its systems beyond the two or five years after which it was supposed to be deleted.

"Perhaps more disappointing than the NSA's failure to purge this information for more than four years, was the Government's failure to convey to the Court explicitly during that time that the NSA was continuing to retain this information," the judge wrote in the Nov. 6, 2015, opinion made public Tuesday.

The NSA apparently can't even tell the truth to a court in which it has the luxury of making its submissions ex parte and whose decisions aren't released until months after the fact in heavily-redacted form.

The ODNI has defended its actions using the "sins of omission" clause (not actually a thing).

"The Government has informed the Court that there was no intent to leave the FISC with a misimpression or misunderstanding, and it has acknowledged that its prior representations could have been clearer..."

Not mentioned in the pseudo-mea culpa is the fact that the "misimpressions" were based on "prior representations" made by the government over a period of several years. Judge Hogan refers to the NSA and FBI's abuses as "compliance issues," which sort of undercuts the irritation shown in the opinion -- as if illegal surveillance were nothing more than misplaced MSDS sheets.

Fortunately, Judge Hogan doesn't let the NSA's co-signer -- the FBI -- off the hook for its abuses. While the FBI is allowed to partake in the NSA's data haul to collect info on criminal investigation targets located overseas, the communications collected must be reviewed by a "taint team" to ensure that any privileged communications (suspects' correspondence with legal representation, etc.) are removed from the collection. Privilege, schmilege.

Hogan said the FBI revealed some such incidents in 2014, but the number was redacted from the opinion made public Tuesday. "The government generally attributed those instances to individual failures or confusion, rather than a 'systematic issue,' " Hogan wrote. However, more incidents occurred from mid-2014 and through 2015, although again the precise number was not released. In some instances, FBI agents believed, incorrectly, that they didn't need to set up a review team if the indictment was under seal or outside the U.S.

The FBI's excuses for these failures range from merely sad to WTF. It's almost impossible to see how it could reach the conclusion that it should have access to privileged communications simply because of a sealed indictment. Sealed indictments are the bread-and-butter of FBI-related prosecutions, especially now that it's a full-time participant in the War on Terror. According to this assertion, the FBI apparently believes it should have access to scooped up attorney-client communications in a vast majority of its investigations.

The decision notes the FBI has put new minimization procedures in place. Much like the FBI, the judge won't discuss the new procedures in detail. The opinion only notes that he is "satisfied" the FBI is "addressing the issue." Hopefully, the new controls are much tighter than the previous set, as the administration has announced it's granting the FBI even more access to NSA data hauls. Of course, the FBI has shown repeatedly -- over the entire history of the agency -- that it will craft policies stipulating inches and help itself to several yards.

Filed Under: abuse, fbi, fisa, fisa court, nsa, surveillance

US Government Has Apparently Demanded, And Obtained, Tech Companies' Source Code In The Past

from the ask-(FISC_)-and-ye-shall-receive dept

From Zack Whittaker at ZDNet comes the alarming revelation that it's not just Apple looking at possibly having to turn over its source code and/or encryption keys to the government, much like what happened to Lavabit. Many other companies have done this previously as the result of orders granted by the nation's most opaque, non-adversarial court.

The US government has made numerous attempts to obtain source code from tech companies in an effort to find security flaws that could be used for surveillance or investigations.

The government has demanded source code in civil cases filed under seal but also by seeking clandestine rulings authorized under the secretive Foreign Intelligence Surveillance Act (FISA), a person with direct knowledge of these demands told ZDNet. We're not naming the person as they relayed information that is likely classified.

With these hearings held in secret and away from the public gaze, the person said that the tech companies hit by these demands are losing "most of the time."

That's hardly heartening. The DOJ would only go so far as to confirm this has happened before, likely because there's no way to deny it. The documents from the Lavabit case have been made public -- with the DOJ using a formerly-sealed document to hint at what could be in store for Apple if it refuses to write FBiOS for it.

Unfortunately, because of the secrecy surrounding the government's requests for source code -- and the court where those requests have been made -- it's extremely difficult to obtain outside confirmation. Whittaker contacted more than a dozen Fortune 500 companies about the unnamed official's claims and received zero comments.

A few, however, flatly denied ever having handed over source code to the US government.

Cisco said in an emailed statement: "We have not and we will not hand over source code to any customers, especially governments."

IBM referred to a 2014 statement saying that the company does not provide "software source code or encryption keys to the NSA or any other government agency for the purpose of accessing client data." A spokesperson confirmed that the statement is still valid, but did not comment further on whether source code had been handed over to a government agency for any other reason.

Cisco is likely still stinging from leaked documents showing its unwitting participation in an NSA unboxing photo shoot and has undoubtedly decided to take a stronger stance against government meddling since that point. As for IBM, its statement is a couple of years old and contains a major qualifying statement.

Previously-leaked documents somewhat confirm the existence of court orders allowing the NSA to perform its own hardware/software surgery. Presumably, the introduction of backdoors and exploits is made much easier with access to source code. Whittaker points to a Kaspersky Lab's apparent discovery of evidence pointing to the NSA being in possession of "several hard drive manufacturers'" source code -- another indication that the government's history of demanding source code from manufacturers and software creators didn't begin (or end) with Lavabit.

The government may be able to talk the FISA court into granting these requests, given that its purview generally only covers foreign surveillance (except for all the domestic dragnets and "inadvertent" collections) and national security issues. The FBI's open air battle with Apple has already proceeded far past the point that any quasi-hearing in front of the FISC would have. That's the sort of thing an actually adversarial system -- unlike the mostly-closed loop of the FISA court -- tends to result in: a give-and-take played out (mostly) in public, rather than one party saying "we need this" and the other applying ink to the stamp.

Filed Under: doj, fbi, fisa, fisa court, fisc, privacy, security, signing keys, software, source code, tech companies