FISA Court: Government Can Collect Content Along With Dialing Data Using Pen Register Orders

from the national-security-says-the-rules-don't-apply dept

The Director of National Intelligence's office has cleared another FISA court opinion [PDF] for release. These are getting far more interesting to read, even if little seems to be changing about the FBI/NSA's collection methods. The process is now a little bit more adversarial, thanks to the USA Freedom Act, which introduced the possibility of someone arguing on behalf of the surveilled and in the interest of privacy and the Fourth Amendment.

Unfortunately, this opinion finds the FISA court mostly unimpressed with the counterarguments. The discussion involved the use of pen register orders to capture "post-cut through" dialing digits -- the sort of thing the court determined to be content, rather than metadata in the past.

This time around, the court seems more amenable to the government's arguments that any digits obtained along with dialed phone numbers is fair game -- whether or not the orders actually allow for the collection of communications content.

The government claimed it had no technical ability to capture only dialing information. Everything entered on a phone keypad would make its way back to government with the pen register. Past the point of interception, the government was supposed to discard the extra digits because they might be considered content. This is what the court determined in 2006:

The court “had made modifications to the government’s proposed pen register orders,” reads the biannual report to Congress obtained by EPIC. “Although the [FISA Court] has authorized the government to record and decode all post-cut-through digits dialed by the targeted telephone, it has struck the language specifically authorizing the government to make affirmative investigative use of possible content” unless permission is specifically granted by the court.

A decade later, the FISA court is seeing things differently.

We have reviewed the record and considered briefs from the government and from amicus curiae appointed by the court under 50 U.S.C. 1803(i) to present argument in this matter. We conclude that section 1842 authorizes, and the Fourth Amendment to the Constitution of the United States does not prohibit, an order of the kind described in the certification. Read fairly and as a whole, the governing statutes evince Congress's understanding that pen registers and trap-and-trace devices will, under some circumstances, inevitably collect content information. Congress has addressed this difficulty by requiring the government to minimize the incidental collection of content through the employment of such technological measures as are reasonably available -- not by barring entirely, as a form of prophylaxis, the use of pen registers and trap-and~trace devices simply because they might gather content incidentally.

Nor does an order authorizing such surveillance run afoul of the Fourth Amendment's guarantee against unreasonable searches and seizures. The warrant requirement is generally a tolerable proxy for "reasonableness" when the government is seeking to unearth evidence of criminal wrongdoing, but it fails properly to balance the interests at stake when the government is instead seeking to preserve and protect the nation's security from foreign threat. We therefore hold that surveillance of this type may be constitutionally reasonable even when it is not authorized by a probable-cause warrant. We further hold, on the facts presented here, that the order under review reasonably balances the investigative needs of the government and the privacy interests of the people.

In other words, the Fourth Amendment is perfectly fine for criminal investigations, but doesn't really apply to national security investigations. Not really a comforting place to draw the line, considering the FBI's shift in focus from law enforcement to becoming the NSA's unofficial domestic wing over the past 15 years.

The problem with the removal of restrictions the court had erected earlier is that this decision doesn't just influence the collection of dialed digits through pen register orders. Other metadata collected from other forms of communications are also affected by this ruling, as is pointed out by Marc Zwillinger, the court-appointed amicus acting on behalf of the Fourth Amendment and the general public.

The amicus curiae contends that if the government's argument were applied to Internet pen registers, the government could collect information generated by a wide variety of activities on the Internet, including searching, uploading documents, and drafting emails.

The court leaves it up to Congress to solve the problem -- which to a certain extent it has. The laws surrounding pen register orders have been updated periodically, but the most recent changes are still more than 20 years old: the Communications Assistance for Law Enforcement Act (CALEA) was passed in 1994. At that point, Congress added statutory language that said the FBI, et al, must use "technology reasonably available to it" to restrict the recording/decoding of post-cut-through digits. Twenty years later, the government is still claiming it has no way of limiting this collection. I guess "nerd harder" is only applicable to the private sector.

The point made by Zwillinger isn't some form of privacy advocate paranoia. The Patriot Act allowed pen register orders to be deployed to capture internet metadata. As is pointed out in the opinion, Sen. Patrick Leahy expressed concern over this broadened collection and noted that without additional restrictions, the new law could be read as allowing the interception of a broad range of content, rather than just routing information. The court, however, interprets Congress's minimal actions post-Patriot Act as being indicative of its support for the collection of content (however inadvertently) with pen register orders. In fact, it goes so far as to claim the stipulations Congress did enact did not narrow the breadth of the collections, but rather only prevented the definition from being expanded further than it already had been.

According to the FISA court, the national security ends justify the Fourth Amendment-bruising means.

[T]he relevant statute at issue in this case authorizes the use of a pen register "to protect against… clandestine intelligence activities." 50 U.S.C. 1842(a)(1). Pursuant to that statute, the government seeks to monitor the dealings of a person, currently in the United States, who is suspected of collecting intelligence in the service of a foreign power. The purpose of the proposed monitoring is the preservation of national security. Few government interests are of a higher order. The interest at stake is no less -- and may even be greater -- for the foreign agent's being present in this country. And were we to insist on a showing of probable cause and the issuance of a judicial warrant in this setting, we would impede the Executive's ability to bring to bear against the threat those faculties -- "stealth, speed, and secrecy" -- needed to secure the nation's well-being in this most fundamental and sensitive of government endeavors.

The streak continues. The Fourth Amendment is mostly null and void when it comes to national security, whether it's the FBI using pen register orders to collect communications content or the DHS/CBP pawing through electronics/traveling dozens of miles from the border to hassle inland citizens.

Filed Under: fisa court, fisc, metadata, pen register, surveillance

Court Says FBI Must Review Its NSL Gag Orders Every Three Years, Rather Than Almost Never

from the a-small-shift-in-the-secrecy-status-quo dept

The magical, wonderful, oft-abused National Security Letters have been deemed Constitutional, thanks to the vague promise of reviews by courts and government agencies to determine whether or not the normally-indefinite gag orders accompanying them can stay in place.

The USA Freedom Act took away the "indefinite" part of the equation, stipulating that NSL gag orders must be justified by periodic reviews. Unfortunately, "periodic" was left open-ended. The language only specifies "appropriate intervals." It does place the burden on the government to prove that a NSL's gag order is still necessary, but makes no specific demands on how often the government should have to make these assertions.

The FISA DC District Court, however, has specified what a "periodic review" should entail -- at least narrowing down what period "periodic" should mean.

In this order [PDF], a redacted company exercised its USA Freedom Act option to demand a review of gag orders connected to two NSLs it had received. After some in camera presentations to the FISA court, along with some discussion between the NSL recipient and the FBI, it was agreed that the gag orders could stay in place for the time being, but that the FBI should be given the burden of specifying a time frame for periodic reviews, rather than forcing the recipient to file petitions repeatedly until the gag orders were finally determined to be no longer necessary.

The order redacts the number of years these gag orders have been in place, but it's safe to assume the number hidden behind the gray box is larger than one.

The court looks to the Attorney General's own gag order termination policy, crafted in response to stipulations in the USA Freedom Act. Unfortunately, it doesn't do much to narrow down what sort of "period" a "periodic review" covers. The policy says the FBI only needs to review its NSL gag orders every three years or at the close of an investigation. As the court notes, this is far from satisfactory.

Such procedures, as [REDACTED] points out, leave several large loopholes. First, there is no further review beyond these two, meaning that where a nondisclosure provision is justified at the close of an investigation, it could remain in place indefinitely thereafter. Second, these procedures by their own terms apply only to "investigations that close and/or reach their three-year anniversary date on or after the effective date of these procedures;" as a result "a large swath of NSL nondisclosure provisions… may never be reviewed and could remain unlimited in duration." Third, for long-running investigations, there could be an extended period of time -- indefinite for unsolved cases -- between the third-year anniversary and the close date.

The court points out that the loopholes pretty much nullify the legislation's demand for periodic NSL gag order reviews. The court ordered the FBI to explain why it should not be able to handle annual reviews of its NSL nondisclosure requirements.

The FBI complained that doing so would be "cumbersome." The court agreed that reviewing every NSL every year would be too burdensome for the agency. However, the decision just glides past the jaw-dropping number of NSLs issued by the FBI -- 16,000 annually -- without further comment.

So, the FBI, having burdened itself by using NSLs rather than court orders or warrants, isn't required to perform annual reviews of its gag orders. Fortunately, it's no longer allowed to simply follow the loophole-filled policy issued by the Attorney General. The opinion notes that the AG's policy "seems inconsistent with the intent of the law." Recent FISA court addition Judge James Boasberg pulls a number out of the air and declares it good:

The Court believes that, given both the facts and the circumstances of this particular case and the legal authority discussed above, a triennial review fairly balances the specific burdens on the FBI against the countervailing interest that [REDACTED] has in avoiding a lengthy and indefinite nondisclosure bar.

The gag orders that are currently in place (and have been in place for an indeterminate number of years) are allowed to remain. The FBI will have to review these every three years from now on. This is better than the AG's policy and much better than the open-ended language of the USA Freedom Act.

But it's unclear whether this order is meant to govern the FBI's other NSLs, or simply the two involved in this particular case. There's nothing in the opinion that suggests this is a blanket policy change, but as the court notes earlier in the decision, it seems likely that anything granted to this particular entity will be requested by others in the same position. Given the reasoning used to make this determination, it would be difficult to imagine a situation where similarly-situated recipients would not be able to avail themselves of the court-ordered review process -- rather than being forced to file review petition after review petition for the rest of whatever.

Filed Under: doj, fbi, fisa, fisa court, fisc, gag orders, nsl, nsls, reviews

Documents Show FISA Court Refusing To Grant FBI's Requests To Scoop Up Communications Along With Phone Metadata

from the rubber-stamp-runs-dry dept

A handful of FOIA documents [PDF] obtained by EPIC (Electronic Privacy Information Center) are shedding some new light on the FISA court and its relationship with the FBI. The good news is that the court is not quite the rubber stamp it's often been portrayed as. Even though a vast majority of requests are improved, there appears to be a significant amount of modification happening behind the scenes.

The documents reveal that the Foreign Intelligence Surveillance Court (FISA) told the FBI several times between 2005 and 2007 that using some incidental information it collected while monitoring communications in an investigation — specifically, numbers people punch into their phones after they’ve placed a call — would require an explicit authorization from the court, even in an emergency.

The FBI wanted to trap these digits using its pen register orders, which are only supposed to provide numbers called and received. This additional information had been considered "content," as these post-cut-through digits could reveal details such as credit card info or social security numbers.

The FBI's collection of content -- along with the call metadata it was actually authorized to receive -- appears to have continued until a FISA judge finally asked it what it was doing with this "incidentally collected" content. The DOJ, of course, argued that is was entitled to this information.

In May 2006, the government told the court that it had the authority to collect that sensitive information, and would “in some cases … specifically seek authority for secondary orders requiring a service provider to provide all dialing, routing, addressing or signaling information transmitted by a target telephone, which, in light of technological constraints, may include content and non-content digits alike,” the report continues.

It also claimed that, although it specifically sought to collect this info with modified pen register orders, it was only accessed for a limited number of reasons: national security, emergencies, exigent circumstances, etc. The FISA court doesn't appear to have believed the FBI's claims that it was seeking this information just to use it only in the rarest of circumstances.

The court “had made modifications to the government’s proposed pen register orders,” reads the biannual report to Congress obtained by EPIC. “Although the [FISA Court] has authorized the government to record and decode all post-cut-through digits dialed by the targeted telephone, it has struck the language specifically authorizing the government to make affirmative investigative use of possible content” unless permission is specifically granted by the court.

This pushback wasn't just limited to the nation's most secret court. The FBI also met resistance at local levels when trying to scoop up content with its metadata.

In July 2006, a magistrate judge in Texas denied an application for a pen register because filtering technology would not eliminate the additional content information.

This lower-level refusal was addressed by the FISA court, which asked the FBI how it expected this magistrate's refusal to affect its FISA court requests. The FBI replied it no longer had to worry about it as revisions to the US Patriot Act had given it permission to collect it all -- even stuff the agency treated as content when crafting its altered pen register requests.

This failed to move the court. It also failed to alter the FBI's tactics. The FBI continued to submit requests for post-cut-through content and the court, quite frequently, continued to strip this part of the agency's request from its approved orders. After several years, this became standard operating procedure for the FISA court, which instituted a blanket refusal on FBI requests for post-cut-through content, even for "emergency" reasons. This resistance is likely what prompted the FBI to turn something it wasn't being allowed to obtain into formal agency policy by 2011.

The new documents shed some new, somewhat surprising, light on the inner workings of the mostly-opaque FISA court, showing that it is not always inclined to give the government what it wants. It also shows the government doesn't seem to handle rejection very well, having to be told "no" repeatedly before the message sinks in.

Filed Under: fbi, fisa, fisa court, fisc, mass surveillance, metadata, requests, rubber stamp, surveillance

Unsealed Yahoo/FISA Documents Show NSA Expected Company, FISC Judge To Operate On Zero Information

from the shame-this-whole-system-of-checks-and-balances-can't-just-be-eradicated dept

Late last week, the Office of the Director of National Intelligence released a stack of documents from Yahoo's challenge of the NSA's internet dragnet. The new declassified and unsealed documents have been dumped into one, 309-page PDF along with everything the ODNI has already released -- one of the small things the office routinely does to slow the dissemination of previously-unseen information.

Marcy Wheeler, being the hero she is, has waded into the bloated PDF and recovered more damning statements from FISA judge Reggie Walton -- one of few presiding judges to seriously challenge the NSA's methods and techniques.

What she's uncovered is more evidence the agency considers itself accountable to no one. Not only was Yahoo expected to be litigating blindly -- what with the government's multiple ex parte submissions and its general refusal to discuss any specifics of its PRISM program -- but apparently the FISA court was expected to adjudicate blindly. The NSA's refusal to provide Reggie Walton with the information he needed to render decisions resulted in this irritated order.

The Court is issuing this ex parte order to the Government requiring it to provide clarification concerning the impact on this case of various government filings that have been made to the FISC under separate docket.

[snip]

lt is HEREBY ORDERED that the government shall file a brief no later than February 20. 2008, addressing the following questions:


1. Whether the classified appendix that was provided to the Court in December 2007 constitutes the complete and up-to-date set of certifications and supporting documents (to include affidavits, procedures concerning the location of targets, and minimization procedures) that are applicable to the directives at issue in this proceeding. If the answer to this question is .. yes,'” the government's brief may be filed ex parte. If the government chooses to serve Yahoo with a copy of the brief, it shall serve a copy of this Order upon Yahoo as well.

2. If the answer to question number one is “no,” the Government shall state what additional documents it believes are currently in effect and applicable to the directives to Yahoo that are at issue in this proceeding. The government shall file copies of any such documents with the Court concurrent with filing its brief. The government shall serve copies of this Order, its brief, and any additional documents upon Yahoo, unless the government moves this Court for leave to file its submission ex parte, either in whole or in part. If the government files such a motion with the Court, it shall serve a copy of its motion upon Yahoo. The government shall also serve a copy of this Order upon Yahoo, unless the government establishes good cause for not doing so within the submission it seeks to file ex parte.

The government's testy response was to point out it has never been obligated to provide anyone but the court with documents pertaining to its surveillance efforts..

Under the Protect America Act, then, the government has an unqualified right to have the Court review a classified submission ex parte and in camera which, of course, includes the unqualified right to keep that submission from being disclosed to any party in an adversarial proceeding before this Court.

As Wheeler points out, the documents Judge Walton ordered the government to turn over to the court did not arrive in full until after Walton had made it clear he wouldn't force the government to hand these over to Yahoo as well.

The holdout document -- the one that didn't appear until the government was sure it wouldn't have to provide Yahoo with this info -- is key. It shows the government's procedures for handling metadata had been misleadingly portrayed, not just to Yahoo, but possibly to the court as well.

Now, to be fair, in the original release, it was not clear that the government offered this much explanation for SPCMA [Special Procedures Concerning Metadata Analysis], making it clear that the procedural change involved making American metadata visible. But the government very clearly suggested — falsely — that SPCMA had no Fourth Amendment implications because they didn’t make Americans overseas more likely to be targeted (which the government already knew was the key thrust of Yahoo’s challenge).

The opposite is true: by making US person metadata visible, it ensured the government would be more likely to focus on communications of those with whom Americans were communicating. These procedures — which were approved more than two months, one document dump, and one court order agreeing to keep everything secret from Yahoo earlier — were and remain the key to the Fourth Amendment exposure for Americans, as was argued just last year. And they weren’t given to even the judge in this case until he asked nicely a few times.

The NSA has very little in the way of effective oversight. It has even less opposition in terms of checks and balances even when facing a judge clearly exhausted by the agency's obfuscation and abuse. An effective challenge of NSA surveillance in court -- even a regular one -- is an uphill battle. In the FISA court, where it's allowed an "unqualified right" to present all its assertions and evidence without facing anything more adversarial than a FISC judge, it's completely impossible. Yahoo fought with pretty much every appendage tied behind its back. An unsuccessful challenge was a foregone conclusion. But, if nothing else, its long tangle with the NSA dragged some of its so-called secrets out of the shadows. That's not a win but it's far better than the alternative -- where the government's foremost intelligence agency is allowed to rewrite the rules as it goes along with the administration's implicit support -- and keep the public from ever finding out just how much domestic surveillance slack it's managed to cut for itself.

Filed Under: 4th amendment, doj, fisa court, fisc, mass surveillance, nsa, odni, oversight, reggie walton, surveillance
Companies: yahoo

Judge Tells Twitter Revealing Classified Stats Isn't Protected By 1st Amendment... But Says Twitter Can Challenge Classification

from the inching-forward dept

Back in late 2014, we wrote about Twitter suing the US government over whether or not it was allowed to publish just how many National Security Letters and FISA Court orders it receives in its transparency report. This came after a bunch of other tech companies had settled a similar lawsuit with an agreement that they could reveal certain "bands" of numbers, rather than the specific number. It still boggles the mind that merely revealing the number of NSLs and/or FISC orders received would create any problem for national security, but the government seems hellbent on keeping that information secret. Probably because they don't want the public to understand how widely this system is used to obtain info.

We had mentioned this case just a few weeks ago, noting that a bunch of companies had filed an amicus brief pointing out that it's unclear if they can even admit that they've never received such a request (i.e., it's possible that warrant canaries are illegal).

Meanwhile, the DOJ has been trying to get the entire case thrown out because that's what the DOJ does. Judge Yvonne Gonzalez Rogers has now given a mixed ruling denying some of the DOJ's motion, but granting a key part concerning Twitter's First Amendment claim. The good news, though, is that the issue there is at least partially procedural, allowing Twitter to try again.

Twitter had argued, of course, that it has a First Amendment right to publish this information. But the government -- and the judge -- noted in response that you don't have a First Amendment right to publish classified information if you are a party that is "subject to secrecy obligations."

Under Executive Order 13526, information may be classified by the “original classification authority determines that the unauthorized disclosure of the information reasonably could be expected to result in damage to the national security, which includes defense against transnational terrorism, and the original classification authority is able to identify or describe the damage.”...

The First Amendment does not permit a person subject to secrecy obligations to disclose classified national security information.

That said, the court notes that this is partially a procedural issue, because Twitter can (and perhaps should) first challenge whether or not the classification on those aggregate statistics is appropriate:

The Court agrees with the Government that Twitter has not alleged that the information is not properly classified by the Government. Count I challenges the FISA non-disclosure provisions as being prior restraints of indefinite duration, but the claim does not take into account the fact that a classification decision is necessarily limited in duration by its nature, as the Government asserts. Along those same lines, Count II’s as-applied challenge contends that the FISA nondisclosure provisions are unconstitutional, but does not account for the fact that the Government has refused to permit disclosure of the aggregate numbers on the grounds that the information is classified pursuant to the Executive Order (not because of any FISA order or provision).

Again, Twitter has conceded that the aggregate data is classified. In the absence of a challenge to the decisions classifying that information, Twitter’s Constitutional challenges simply do not allege viable claims.

In short: try again, but this time challenge whether or not the aggregate data is properly classified.

On the two other issues in the case, the DOJ lost both. First, it argued that since it was the FISA Court, and not the DOJ, that classified the statistics, the challenge should be under FISA's jurisdiction and not the court that it's in. The court here, disagrees, and points out that Twitter is not challenging a specific FISA ruling, but rather the aggregate data.

The Government does not identify any order of the FISC addressing, as a general matter, publication of aggregate data about receipt of legal process, the crux of the matter before the Court here. Likewise, Twitter’s Amended Complaint does not challenge any prohibition on disclosure in any individual FISC order, FISA directive, or NSL. Rather, Twitter contends that the Government’s reliance on the FISA non-disclosure provisions as a basis for prohibiting disclosure of aggregate data about legal process directed to Twitter violates the First Amendment. Nothing in the Amended Complaint would require the Court to interpret, review, or grant relief from any particular FISC order or directive.

The other DOJ argument was that Twitter did not have standing regarding the Espionage Act. Twitter, in its lawsuit, was seeking declaratory judgment that it is not running afoul of the Espionage Act in publishing such data. It did this because the DOJ had warned Twitter that publishing such data might violate the Espionage Act. Seems fairly straightforward, right? But the DOJ told the court that Twitter's concerns are "merely speculative" and thus it had no standing on this issue. The court isn't buying it:

The Court finds that the allegations here—that Twitter presented the draft Transparency Report it planned to publish to the Government and that the Government informed Twitter that it could not publish the information because it is classified—are sufficient to show an “imminent” injury to establish Twitter’s standing here. The Government’s contention that the threat of prosecution is low because there are other avenues of recourse for Twitter to challenge individual nondisclosure orders simply does not address the issue here, reporting of aggregate data. The motion to dismiss the Espionage Act claim on these grounds is DENIED.

Of course, it's the First Amendment claims that are the main show here -- and without them, the rest of the case is pretty limited. It seems likely that Twitter will file an amended complaint now, arguing that the classification was improper, but then it just becomes a fight over classification, and the government is pretty good about screaming "national security!!!!" at the top of its lungs whenever people challenge classification decisions. The alternative, of course, is that Twitter could appeal the First Amendment decision and see if the appeals court thinks the judge here got that part wrong. Either way, I imagine we'll find out soon.

Filed Under: doj, espionage act, first amendment, fisa court, fisc, national security letters, nsls, transparency, transparency report, warrant canary
Companies: twitter

Expanding Unconstitutional Backdoor Searches Of Surveillance Data Is Easy: Just Change What Words Mean

from the some-language-tricks-and-funny-games dept

I already wrote a post about how the FISA Court rejected the arguments of the public advocate that it appointed to review the legality and constitutionality of the infamous backdoor searches. However, I wanted to put up a second post as well, digging a little deeper into what the ruling itself means, rather than just focusing on the public advocate part of it. Because it's pretty scary. We already knew that, once that data was collected under the Section 702 PRISM program, the NSA opened it up to both the CIA and FBI to search on for other purposes.

However, as Elizabeth Goitein explains over at Just Security, even then there were some limitations:

 The Justice Department, having worked Section 702 into the foreign intelligence exception by certifying that the government’s targets were not Americans and that the surveillance had a foreign intelligence purpose, and having met the constitutional reasonableness requirement by noting that incidentally collected information about Americans would be “minimized,” was allowing the FBI to run queries of Section 702 data to obtain information about Americans in ordinary criminal cases. Edward Snowden’s disclosures confirmed this practice, and the Privacy and Civil Liberties Oversight Board’s (PCLOB) report on Section 702 revealed that it was routine.

Many commentators (myself included) have noted that this loophole creates an end run around the warrant requirement in ordinary criminal cases. Until recently, however, there was at least one substantive limitation on the FBI’s ability to query Section 702 data. As reported by the PCLOB, the FBI’s minimization procedures provided that queries must be “reasonably designed” to “find and extract” either “foreign intelligence” or “evidence of a crime.” This was a far cry from the probable cause that would be needed to obtain a warrant, but it was something. The FBI, at least on paper, could not simply go on a fishing expedition through the warrantlessly obtained data.

But the details of this newly revealed ruling show that that limitation has gone away -- basically because the FBI changed its own minimization procedures in part to pretend English words don't mean what they really mean. In the past, the NSA has reinterpreted many English words to mean things different than their plain English meaning. In this case, the FBI has decided to redefine the word "query":

Displaying the intelligence community’s penchant for defining well-understood terms to mean something entirely different, the FBI’s most recent minimization procedures, in the FISC’s words, “clarify that a search of an FBI storage system containing raw-FISA acquired information does not constitute a ‘query’ within the meaning of the procedures if the user conducting the search does not receive access to unminimized Section 702-acquired information in response to the search.” This includes instances in which the search does return unminimized Section 702-acquired information, and the agent is notified of that fact but is not authorized to access the data. Because such searches are deemed not to constitute “queries,” they presumably are not subject to the requirement that “queries” must be reasonably designed to return foreign intelligence or evidence of a crime.

The new procedures also “clarify” what happens if an agent performs a search that returns Section 702 information the agent is not authorized to access. In such cases, an agent who is authorized to access the information may re-run the search and determine whether the information “reasonably appears . . . to be foreign intelligence information, to be necessary to understand foreign intelligence information, or to be evidence of a crime.” If so, the information is passed along to the original agent.

This “clean team” approach is no substitute for a limitation on the initial search. It is analogous to claiming that searches of homes are not “searches,” and thus do not require warrants, if the agents performing the search find nothing – or if an elite team steps in to perform the search and can turn over what it finds to prosecutors only if it is evidence of a crime. Previously, the procedures did not allow fishing expeditions; now they do, and it seems somewhat beside the point that the fisherman only gets to keep the fish if he catches one.

Got that? A query is no longer a query and the FBI has much broader authority to do backdoor searches than was previously known. As the EFF notes in response to this, this seems to fly in the face of legal precedent and the Constitution:

This is a constitutional problem. Quite apart from the bait and switch opportunities it creates for the FBI, it's like saying it's OK for school officials to set up a drug testing program for non-law enforcement purposes, and then once it’s set up, they can completely abandon that purpose and start testing students to simply to put them in jail. Or that the government can set up a program to test pregnant women for drugs with a goal to get them into treatment, but also hand the information over to the police and use the threat of prosecution as additional leverage.

The Supreme Court rejected the latter scenario as unconstitutional in Ferguson v. City of Charleston in 2001. Other Supreme Court cases make clear that even holistic, programmatic assessments of Fourth Amendment "reasonableness"—like the one the FISC engages in here—must take into account the invasiveness of these programs. Searching vast databases containing the full content of emails and every website visited by nonsuspect Americans without a warrant is about as invasive as it gets.

And it's not just the FBI that gets much broader access to these backdoor searches. Marcy Wheeler points out that the decision reveals that the NSA and CIA basically wrote themselves a note last summer saying that they no longer needed to follow minimization procedures... and the judge is cool with that. Here's the paragraph in the ruling:

The NSA and CIA Minimization Procedures included as part of the July 15, 2015 Submission each contain new language stating that “[n]othing in these procedures shall prohibit the retention, processing, or dissemination of information reasonably necessary to comply with specific constitutional, judicial, or legislative mandates.” See NSA Minimization Procedures at 1; CIA Minimization Procedures at 4-5. These provisions were not included in the draft procedures that were submitted to the Court in June 2015, but appear to have been added by the government thereafter. They are not discussed in the July 15, 2015 Memorandum.

As Wheeler notes, this is just the NSA and CIA deciding unilaterally that they can ignore minimization. The judge even pointed out that this move "could undermine the Court's ability to find the procedures satisfy the above-described statutory requirement." However, the judge, Thomas Hogan, then decides that this is kind of okay because government lawyers told him informally (yes, really!) that they don't intend to abuse this very much:

The Court understands based on informal communications between Court staff and attorneys for the government that NSA and CIA intend to apply the similar provisions at issue here in the same narrow manner.

Wheeler has a lot more on this particular part of the ruling and how troubling it is. But, in short, it has also broadened the ability of the government to snoop through these massive troves of data. The reliance on informal promises not to take it too far mean very little. As former NSA and CIA director Michael Hayden has said, his job was to push up as close to the boundaries of what was legal as possible. Once Congress or the courts told him what was legal (or, in some cases, the President unilaterally), he would make use of that. Why would that not be the case here? Or, as Wheeler explains more vividly:

I’m not sure how that’ll be effective when President Trump decides he can pass an Executive Order requiring NSA to keep all the US person data it collects but not tell FISC about it, because the order they report on this to him is part of the minimization procedures they say they can blow off.

And, of course, none of this can be appealed, because even though there are the arguments from the public advocate (which didn't include this last part about ignoring minimization), only the government itself can appeal a ruling, and they got everything they wanted here (and possibly more).

The only actual way to fix it at this point is for Congress to step in and rewrite the law, but the chances of that happening appear to be slim to none.

Filed Under: 4th amendment, backdoor search, backdoor searches, cia, definitions, fbi, fisa court, fisc, law enforcement, mass surveillance, nsa, prism, query, section 702

FISA Court Rejects Arguments By First Public Advocate To Argue NSA PRISM Backdoor Searches Are Unconstitutional

from the so-that's-a-shame dept

On Tuesday, the Office of the Director of National Intelligence released some redacted versions of three previously secret FISA Court rulings. There are a few interesting things in them, but one notable point, found in a ruling from last November regarding the NSA's 702 PRISM program, is that the FISC took advantage of the provision in the USA Freedom Act to appoint a public advocate to argue on behalf of the public. One of the big complaints in the past, is that the FISA Court is no court at all. Only one side -- the government -- gets to present its case, and then the judges decide.

The USA Freedom Act, however, added the ability of the FISC to appoint a public advocate. Many have been quite reasonably skeptical about this -- in terms of how often it would be used, who would be appointed and how seriously the FISC would take the public advocate. In this case, we see that the public advocate did, in fact, argue that parts of the PRISM program were unconstitutional... and the FISC then rejected that. In this case, the court appointed Amy Jeffress, a former federal prosecutor and DOJ official -- which might make some skeptical of her willingness to actually advocate for the public -- however, this ruling shows that she did, in fact argue that the program was unconstitutional (her actual arguments have not been released).

It appears that the FISC specifically asked Jeffress for her thoughts on the so-called "backdoor searches" that we've discussed before. Specifically, while the NSA is only supposed to collect info on non-US persons, it can collect and then hang onto a huge swath of information under the 702/PRISM program, including what's referred to as "about" information (i.e., any information "about" a suspected terrorist -- meaning your emails mentioning a terrorist could get sucked up). Historically, if the NSA came across any US person's information this way they're supposed to dump it. But through some twists and turns, these days the information gets kept... and is considered "incidentally" collected. Oh and the FBI and CIA then get access to all of that data as well for searching.

In this analysis, the FISC was examining how constitutional that whole thing is (and we'll have another more detailed post on that as well). The FISC specifically asked Jeffress for an analysis of two specific issues here. Did either of the following two things violate the 4th Amendment: (1) the searches of the information collected in this manner that might return information concerning US persons, and (2) information that is preserved under this system for "litigation purposes" that might otherwise be required to be destroyed under so-called minimization rules. The second one is basically the issue that came up in some EFF cases, where the EFF is challenging the legality of the NSA collecting this data at all, but the NSA started deleting the data in question, because it's required to delete data after five years. So there's a question of whether or not that data can legally be kept, even if it needs to be kept for the lawsuit. On this, it appears the court is fine with holding onto data for such litigation preservation.

However, on question number (1), Jeffress apparently noted that the FBI being able to do these backdoor searches appears to go way beyond what's allowed. Remember, this information was collected specifically for the purposes of national security. The whole 702 program was designed and approved on the basis that it was about national security. Yet, it appears that once the FBI gets its hands on it, it's used for all sorts of other stuff. This is just what everyone had assumed before when first learning about these backdoor searches. Jeffress starts off by arguing that these kinds of searches simply go beyond what the law itself allows:

Amicus curiae Amy Jeffress has raised concerns regarding the querying provisions of the FBI Minimization Procedures.... Ms. Jeffress does not specifically assert that the querying provisions render the procedures inconsistent with the applicable statutory definition of minimization procedures. Nevertheless, she contends that the FBI Minimization Procedures "go far beyond the purpose for which the Section 702-acquired information is collected in permitting queries that are unrelated to national security." ...

However, the court doesn't buy it:

The Court respectfully disagrees.

There is no statutory requirement that all activities involving Section 702 data serve solely a foreign intelligence national security purpose. To be sure, Section 702 was enacted to permit "the targeting of persons reasonably believed to be located outside the United States to acquire foreign intelligence information."... But even at the time of acquisition, the statute does not require the government to have as its sole purpose obtaining foreign intelligence information. Rather, the AG and DNI need certify only that obtaining foreign intelligence information is "a significant purpose" of the acquisition. Under the "significant purpose" standard, an acquisition under Section 702 is permissible "even if 'foreign intelligence' is only a significant -- not a primary -- purpose" of the targeting decision....

Nor does FISA foreclose any examination or use of information acquired pursuant to Section 702 that lacks a purpose relating to foreign intelligence. It is true that the govemment's minimization procedures must be "reasonably designed in light of the purpose and technique of the [collection], to minimize the . . . retention, and prohibit the dissemination, of nonpublicly available information concerning unconsenting United States persons consistent with the need of the United States to obtain, produce, and disseminate foreign intelligence information," and must limit the dissemination of nonpublicly available information identifying unconsenting United States persons to certain circumstances.... Notwithstanding these requirements, however, FISA states that the minimization procedures must also "allow for the retention and dissemination of information that is evidence of a crime which has been, is being, or is about to be committed and that is to be retained or disseminated for law enforcement purposes." ... Hence, FISA does not merely contemplate, but expressly requires, that the government's procedures provide for the retention and dissemination of Section 702-acquired information that is evidence of crime for law enforcement purposes. This requirement applies whether or not the crime in question relates to foreign intelligence or national security.

The counter argument to this, from Jeffress, appears to be that this is a misreading of the law in question. While it does say such information may be retained and disseminated for the purpose of law enforcement, that doesn't mean that bulk collection data can be queried for the purpose of law enforcement. This is an important distinction. Jeffress' reading of the law is basically "okay, if in the process of going through this for legitimate foreign intelligence purposes you ALSO come across evidence of domestic criminal activity, you don't need to ignore it and can pass it on to law enforcement." But that's worlds away from what we actually have today, which is that the NSA basically says "boo, terrorism!" and collects a ton of useless information, but then lets the FBI trawl through for any evidence of criminal behavior.

Unfortunately, the FISC just doesn't see that argument.

It would be a strained reading of the definition of minimization procedures to permit FBI personnel to retain and disseminate Section 702 information constituting evidence of a crime implicating a United States person for law enforcement purposes, but to prohibit them from querying Section 702 data in a manner designed to identify such evidence. And such an interpretation would lead to anomalous results: FBI personnel who came across one communication acquired under Section 702 that incriminates a United States person perhaps because it was responsive to a query for foreign intelligence information would be prohibited from running queries tailored to identify additional communications obtained under Section 702 pertaining to the same criminal activity, even though Section 1801(h)(3) explicitly authorizes the retention and dissemination of such information for law enforcement purposes.

This seems like a stretch to me. There are lots of situations where law enforcement may be able to lawfully access some information, but not lawfully access other information. Hell, under the scenario described, it seems like the FBI could use the information obtained from a legitimate national security query to then issue a subpoena or warrant for the other information, since we're mostly talking about information held by 3rd parties anyway.

Jeffress also made the constitutional arguments... which also fell flat.

Amicus curiae Amy Jeffress urges the Court to reconsider its prior Fourth Amendment assessments and to reach "a different conclusion" in light of the provisions of the FBI Minimization Procedures, discussed above, permitting agents and to query the Section 702-acquired information in the possession using United States-person information for the purpose of finding evidence of crimes unrelated to foreign intelligence.... Ms. Jeffress asserts that without additional safeguards, such querying is inconsistent with the requirements of the Fourth Amendment:

The querying procedures effectively treat Section 702-acquired data like any other database that can be queried for any legitimate law enforcement purpose. The minimization procedures do not place any restrictions on querying the data using U.S. person identifiers. . . . As a result, the FBI may query the data using U.S. person identifiers for purposes of any criminal investigation or even an assessment. There is no requirement that the matter be a serious one, nor that it have any relation to national security. . . . [T]hese practices do not comply with . . . . the Fourth Amendment.

According to Ms. Jeffress, the querying provisions of the FBl Minimization Procedures should be revised to "require a written justification for each U.S. person query of the database that explains Why the query is relevant to foreign intelligence information or is otherwise justified," or in some other manner that provides additional protection for the United States- person information in the FBI's possession.

The court rejects this -- and also rejects Jeffress' claim that each search by the FBI should get its own 4th Amendment scrutiny -- saying the whole program can be judged as one. The reason for rejecting the constitutional claim, however, is pretty weak. It basically says, well, the government has to balance national security with privacy and in this case, it's okay. It also notes that there are some limitations on what the FBI can look at and also the fact that the FBI has rarely actually found evidence of criminal activity while trawling through the database (though I fail to see how that impacts the constitutional question at all...).

So, it does look like Jeffress put forth a decent argument... but the court simply didn't buy it. That's obviously going to happen, but the real question is whether or not the FISC will ever take the arguments of a public advocate seriously.

Filed Under: 4th amendment, amy jeffress, cia, fbi, fisa court, fisc, mass surveillance, minimization, nsa, prism, public advocate, section 702

EFF Sues DOJ Over Its Refusal To Release FISA Court Documents Pertaining To Compelled Technical Assistance

from the EFF:DOJ::Coroner:Dr.-Nick dept

Given the heightened interest in the government's efforts to compel companies like Apple to break into their own products for them, the EFF figured it would be a good time to ask the government whether it had used FISA court orders to achieve these ends.

Naturally, the government would rather not discuss its efforts to force Apple, et al. to cough up user data and communications. Hence the secrecy surrounding its use of NSLs, subpoenas and gag orders. Hence, also, its desire to keep cases involving All Writs Acts orders under seal if possible. Hence also (also) its refusal to discuss the secret happenings in its most secret court.

The EFF filed FOIA requests with the DOJ in October of last year and followed up with more in March. The October request sought documents about FISA court decisions related to requests for technical assistance from US companies. After a few months of back-and-forth, the DOJ claimed only two responsive documents were found -- neither of which was a court decision… and neither of which would be released.

The EFF's most recent request broadened the search parameters in hopes of landing more responsive documents.

Any “decision, order, or opinion issued by the Foreign Intelligence Surveillance Court or the Foreign Intelligence Surveillance Court of Review (as defined in section 601(e)),” issued from 1978 to June 1, 2015, “that includes a significant construction or interpretation of any provision of law, including any novel or significant construction or interpretation of the term ‘specific selection term.’”

It also requested the same documents for the period of June 2015 to the present. As of this point, it has yet to receive a response.

The EFF is now suing the DOJ for wrongfully withholding responsive documents and other violations of FOIA regulations, including "performing inadequate searches."

The documents it's seeking are of significant public interest, especially now that the FBI's All Writs-enabled technical assistance demands are at the center of a second war over encryption. As staff attorney Nate Cardozo points out, the devices and services used by millions of Americans shouldn't be subject to the whims of secret courts relying wholly on government ex parte presentations and submissions.

“If the government is obtaining FISC orders to force a company to build backdoors or decrypt their users’ communications, the public has a right to know about those secret demands to compromise people’s phones and computers,” said Cardozo. “The government should not be able to conscript private companies into weakening the security of these devices, particularly via secret court orders.”

Filed Under: all writs act, doj, fisa, fisa court, foia, technical assistance, usa freedom act
Companies: eff

FISA Court Still Uncovering Surveillance Abuses By NSA, FBI

from the pretty-much-why-the-transparency-should-have-been-in-place-the-whole-time dept

With multiple redactions and having survived a declassification review, another FISA court opinion has been released to the public. The opinion dates back to November of last year, but was only recently dumped into the public domain by the Office of the Director of National Intelligence. While the five-month delay seems a bit long, the alternative is no public release at all. The small miracle that is the public release of FISA court opinions can be traced directly to Ed Snowden and a handful of FOIA lawsuits -- not that you'll see either credited by the ODNI when handing over documents.

The bad news is that the FISA court has uncovered still more abuse by the NSA and FBI. While there appears to be no imminent danger of the court yanking the agencies' surveillance privileges (as nearly happened in 2008), the presiding judge (Thomas Hogan) isn't impressed with the agencies and their cavalier attitude towards mass surveillance. The stipulations put in place to offset the potential damages of untargeted mass surveillance -- strict retention periods and minimization procedures -- are the very things being ignored by the NSA and FBI.

Josh Gerstein of Politico has dug into the 80-page decision and discovered that the NSA is still holding onto collected data indefinitely.

"The court was extremely concerned about NSA's failure to comply with its minimization procedures—and potentially" a provision in federal law, Hogan wrote. The NSA violations appeared to involve preserving surveillance data in its systems beyond the two or five years after which it was supposed to be deleted.

"Perhaps more disappointing than the NSA's failure to purge this information for more than four years, was the Government's failure to convey to the Court explicitly during that time that the NSA was continuing to retain this information," the judge wrote in the Nov. 6, 2015, opinion made public Tuesday.

The NSA apparently can't even tell the truth to a court in which it has the luxury of making its submissions ex parte and whose decisions aren't released until months after the fact in heavily-redacted form.

The ODNI has defended its actions using the "sins of omission" clause (not actually a thing).

"The Government has informed the Court that there was no intent to leave the FISC with a misimpression or misunderstanding, and it has acknowledged that its prior representations could have been clearer..."

Not mentioned in the pseudo-mea culpa is the fact that the "misimpressions" were based on "prior representations" made by the government over a period of several years. Judge Hogan refers to the NSA and FBI's abuses as "compliance issues," which sort of undercuts the irritation shown in the opinion -- as if illegal surveillance were nothing more than misplaced MSDS sheets.

Fortunately, Judge Hogan doesn't let the NSA's co-signer -- the FBI -- off the hook for its abuses. While the FBI is allowed to partake in the NSA's data haul to collect info on criminal investigation targets located overseas, the communications collected must be reviewed by a "taint team" to ensure that any privileged communications (suspects' correspondence with legal representation, etc.) are removed from the collection. Privilege, schmilege.

Hogan said the FBI revealed some such incidents in 2014, but the number was redacted from the opinion made public Tuesday. "The government generally attributed those instances to individual failures or confusion, rather than a 'systematic issue,' " Hogan wrote. However, more incidents occurred from mid-2014 and through 2015, although again the precise number was not released. In some instances, FBI agents believed, incorrectly, that they didn't need to set up a review team if the indictment was under seal or outside the U.S.

The FBI's excuses for these failures range from merely sad to WTF. It's almost impossible to see how it could reach the conclusion that it should have access to privileged communications simply because of a sealed indictment. Sealed indictments are the bread-and-butter of FBI-related prosecutions, especially now that it's a full-time participant in the War on Terror. According to this assertion, the FBI apparently believes it should have access to scooped up attorney-client communications in a vast majority of its investigations.

The decision notes the FBI has put new minimization procedures in place. Much like the FBI, the judge won't discuss the new procedures in detail. The opinion only notes that he is "satisfied" the FBI is "addressing the issue." Hopefully, the new controls are much tighter than the previous set, as the administration has announced it's granting the FBI even more access to NSA data hauls. Of course, the FBI has shown repeatedly -- over the entire history of the agency -- that it will craft policies stipulating inches and help itself to several yards.

Filed Under: abuse, fbi, fisa, fisa court, nsa, surveillance

US Government Has Apparently Demanded, And Obtained, Tech Companies' Source Code In The Past

from the ask-(FISC_)-and-ye-shall-receive dept

From Zack Whittaker at ZDNet comes the alarming revelation that it's not just Apple looking at possibly having to turn over its source code and/or encryption keys to the government, much like what happened to Lavabit. Many other companies have done this previously as the result of orders granted by the nation's most opaque, non-adversarial court.

The US government has made numerous attempts to obtain source code from tech companies in an effort to find security flaws that could be used for surveillance or investigations.

The government has demanded source code in civil cases filed under seal but also by seeking clandestine rulings authorized under the secretive Foreign Intelligence Surveillance Act (FISA), a person with direct knowledge of these demands told ZDNet. We're not naming the person as they relayed information that is likely classified.

With these hearings held in secret and away from the public gaze, the person said that the tech companies hit by these demands are losing "most of the time."

That's hardly heartening. The DOJ would only go so far as to confirm this has happened before, likely because there's no way to deny it. The documents from the Lavabit case have been made public -- with the DOJ using a formerly-sealed document to hint at what could be in store for Apple if it refuses to write FBiOS for it.

Unfortunately, because of the secrecy surrounding the government's requests for source code -- and the court where those requests have been made -- it's extremely difficult to obtain outside confirmation. Whittaker contacted more than a dozen Fortune 500 companies about the unnamed official's claims and received zero comments.

A few, however, flatly denied ever having handed over source code to the US government.

Cisco said in an emailed statement: "We have not and we will not hand over source code to any customers, especially governments."

IBM referred to a 2014 statement saying that the company does not provide "software source code or encryption keys to the NSA or any other government agency for the purpose of accessing client data." A spokesperson confirmed that the statement is still valid, but did not comment further on whether source code had been handed over to a government agency for any other reason.

Cisco is likely still stinging from leaked documents showing its unwitting participation in an NSA unboxing photo shoot and has undoubtedly decided to take a stronger stance against government meddling since that point. As for IBM, its statement is a couple of years old and contains a major qualifying statement.

Previously-leaked documents somewhat confirm the existence of court orders allowing the NSA to perform its own hardware/software surgery. Presumably, the introduction of backdoors and exploits is made much easier with access to source code. Whittaker points to a Kaspersky Lab's apparent discovery of evidence pointing to the NSA being in possession of "several hard drive manufacturers'" source code -- another indication that the government's history of demanding source code from manufacturers and software creators didn't begin (or end) with Lavabit.

The government may be able to talk the FISA court into granting these requests, given that its purview generally only covers foreign surveillance (except for all the domestic dragnets and "inadvertent" collections) and national security issues. The FBI's open air battle with Apple has already proceeded far past the point that any quasi-hearing in front of the FISC would have. That's the sort of thing an actually adversarial system -- unlike the mostly-closed loop of the FISA court -- tends to result in: a give-and-take played out (mostly) in public, rather than one party saying "we need this" and the other applying ink to the stamp.

Filed Under: doj, fbi, fisa, fisa court, fisc, privacy, security, signing keys, software, source code, tech companies