Wyden Siren: Coats Is Answering A Different Question About Surveillance Of US Persons

from the tricky-coats dept

Remember, folks, when Senator Ron Wyden asks certain questions or suggests something nefarious is going on behind the scenes, you'd best listen. Time and time again over the past six years or so, whenever he's brought up such an issue, he's been right. Some on Twitter have now dubbed this the Wyden Siren. Pay attention when Wyden is hinting at something. So... it's time to pay attention. On Thursday, Wyden sent a letter to Dan Coats, the Director of National Intelligence, complaining that he is answering a different question than the one Wyden asked. This is, of course, a fairly typical move in political circles, but especially in the intelligence community. You word answers in very tricky ways, such that you know the public will be misled, but if pressed in the future, you can argue that your answer was not untruthful -- just semantically misleading in the extreme.

This case goes back to Wyden questioning Coats on June 7th about whether Section 702 can be used to collect purely domestic communications. There were already some people screaming "Wyden Siren" on Twitter about the question, even to the point of arguing that the question was setting up Coats the way that James Clapper was setup a few years back (in which he lied about NSA surveillance on Americans). Coats stated that such a thing would be against the law -- leading Marcy Wheeler to point out not only that the statement is incorrect, but that Coats signed a memo saying it's incorrect.

After the hearing, as Wyden's new letter to Coats points out, Coats gave Wyden an answer. But, as Wyden now points out, it was an answer to a different question:

Dear Director Coats:

At the Senate Select Committee on Intelligence's open hearing on June 7, 2017, I asked you the following question and requested a yes or no response: "Can the government use FISA Act Section 702 to collect communications it knows are entirely domestic." You responded: "Not to my knowledge. It would be against the law." After the hearing, in response to questions from reporters, the ODNI sent the following:

"Section 702(b)(4) plainly states we 'may not intentionally acquire any communication as to which the sender and all intended recipients are known at the time of acquisition to be located in the United States.' The DNI interpreted Senator Wyden's question to ask about this provision and answered accordingly.

That was not my question. Please provide a public response to my question, as asked at the June 7, 2017, hearing.

Thank you for your attention to this important matter.

Sincerely,
Ron Wyden

Pay attention, folks. The Wyden Siren is blaring... and that usually means more awful surveillance revelations will be coming soon...

Filed Under: 702, dan coats, domestic surveillance, mass surveillance, nsa, ron wyden, section 702, surveillance

NSA Statements On 'About' Collection Shutdown Contradict PCLOB's Findings

from the nothing-is-real-and-nothing-to-get-hung-about dept

The impact the dropping of the "about" collection will have on the NSA's upstream harvesting will either be massive or minimal, depending on who you ask.

The Privacy and Civil Liberties Oversight Board's report on the "about" collection noted a few things, one of them being the supposed impossibility of preventing inadvertent collection.

All of these types of “about” communications can provide intelligence value, helping the government learn more about terrorist networks and their plans or obtain other foreign intelligence. While “about” collection is valued by the government for its unique intelligence benefits, it is, to a large degree, an inevitable byproduct of the way the NSA conducts much of its upstream collection. As discussed earlier in this Report, because of the technical manner in which this collection is performed, the NSA cannot entirely stop acquiring “about” communications without also missing a significant portion of “to/from” communications. Nor does the agency have the capability to selectively acquire certain types of “about” communications but not others.

At least some forms of “about” collection present novel and difficult issues regarding the balance between privacy and national security. But current technological limits make any debate about the proper balance somewhat academic, because it is largely unfeasible to limit “about” collection without also eliminating a substantial portion of upstream’s “to/from” collection, which would more drastically hinder the government’s counterterrorism efforts.

According to the PCLOB's interpretation, the "about" collection -- despite its many civil liberties issues -- could not be dropped without causing a significant loss of intel. In fact, the report goes so far as to claim the "about" collection itself is an "inevitable byproduct" of upstream surveillance -- rather than the way it actually appears to be: the inadvertent collection of US persons' communications is an inevitable byproduct of the "about" collection.

The NSA's statements on the ending of this program don't seem to cohere with the PCLOB's assertions, something pointed out by Jake Laperruque on Twitter.

Two statements were released by the NSA. The first seems more aligned with the PCLOB report's assertions about tech impossibilities and intel loss.

Even though NSA does not have the ability at this time to stop collecting "about" information without losing some other important data, the Agency will stop the practice to reduce the chance that it would acquire communications of U.S. persons or others who are not in direct contact with a foreign intelligence target.

The second statement, however, hints that the intel loss will not be nearly as significant as it's being portrayed... and that the "about" part was never a necessary part of intercepting "to/from" communications.

After considerable evaluation of the program and available technology, NSA has decided that its Section 702 foreign intelligence surveillance activities will no longer include any upstream internet communications that are solely "about" a foreign intelligence target. Instead, this surveillance will now be limited to only those communications that are directly "to" or "from" a foreign intelligence target. These changes are designed to retain the upstream collection that provides the greatest value to national security while reducing the likelihood that NSA will acquire communications of U.S. persons or others who are not in direct contact with one of the Agency's foreign intelligence targets.

The PCLOB's assertion that the "about" collection was an "inevitable byproduct" of upstream surveillance is nowhere to be found. The NSA itself states it can still perform upstream interception without nearly as much inadvertent collection simply by eliminating the "about" variable. If this is true, the NSA always had the capability to reduce the amount of inadvertently-collected communications. It just chose not to.

In any event, the upstream collection lives on, albeit in a slightly more constitutional form. The technical problem the NSA claimed prevented it from inadvertently collecting US persons' communications turns out to be something else: a minimal-impact search variable the agency could have eliminated years ago, bringing back some semblance of targeting to its surveillance work.

Filed Under: 702, about, about searches, mass surveillance, nsa, pclob, section 702, surveillance

The NSA's 702 Shutdown Is Good News, But There Are A Whole Lot Of Caveats

from the ALL-THE-ASTERISKS dept

The surprising shutdown of the NSA's email harvesting program -- one that operated "upstream" and grabbed not just communications to and from surveillance targets, but also those "about" surveillance targets -- is good news. Considering the NSA had done nothing but abuse this specific privilege, the shutdown is a welcome surprise. But it's not great news, for a variety of reasons.

First, the shutdown arrives on the heels of a yearlong denial of surveillance requests by the FISA court. This indicates the NSA was either still abusing its collection or the court no longer felt the program was constitutional, at least not the way the NSA was running it. The shutdown seems to reflect the NSA's inability or unwillingness to shift towards more targeted surveillance methods -- ones that won't sweep up lots of US persons' communications inadvertently.

It also suggests the program -- at least the upstream part of it -- is no longer as useful as it used to be. The rise in default encryption by email providers may be preventing the NSA from gathering as much info as it used to, as Julian Sanchez explains at Just Security.

[I]t is entirely possible that the change is driven in significant part by the broader post-Snowden adoption of STARTTLS encryption of communications between e-mail servers. That is, it is quite plausible that a large and growing percentage of transiting e-mail traffic is simply no longer visible to NSA, and must be accessed “downstream” at the e-mail server itself, rendering this form of collection less worth picking fights with the FISC over.

The NSA's statements about the shutdown mention that it will still be performing upstream collections but removing the "about" search variable. The agency notes this will decrease the amount of captured communications. But it's quite possible it was seeing fewer and fewer communications before it made this decision. The NSA shouldn't be too concerned about this loss (and it likely isn't), considering it has other options it can use to capture the communications it says it won't be capturing anymore.

[T]o the extent the traffic remains visible to NSA, they may simply have decided that it is easier to do the same “about” scans outside the borders of the United States, beyond the purview of either FISA or the FISC.

This is an option the NSA has deployed before. In 2011, the NSA killed off its bulk domestic collection of US persons' email metadata. Or so it said. In reality, it simply stopped gathering this data from domestic providers.

The [Inspector General's] report explained that there were two other legal ways to get such data. One was the collection of bulk data that had been gathered in other countries, where the N.S.A.’s activities are largely not subject to regulation by the Foreign Intelligence Surveillance Act and oversight by the intelligence court. Because of the way the Internet operates, domestic data is often found on fiber optic cables abroad.

This option is still viable and possibly of much more use to the NSA. If so, the NSA may be giving up part of its upstream collection in hopes of preventing its offshore and downstream collections from being scrutinized as thoroughly in the runup to the renewal of the FISA Amendments Act.

This is just what isn't being done upstream or under Section 702. The NSA still can gather plenty of US persons' communications -- incidentally or not -- under Executive Order 12333.

[T]he NSA’s authorities under executive order 12333 are vast, undisclosed and unconstrained by any need to explain its collections to the Fisa court. A former state department official who has warned Congress about 12333, John Napier Tye, has alleged that the NSA uses 12333 as a backup plan to route around legal restrictions on US surveillance.

“To the extent US person information is either stored outside the United States, routed outside the United States, in transit outside the United States, it’s possible for it to be incidentally collected under 12333,” Tye told the Guardian in 2014.

Whatever the NSA might be losing, it can only be a small percentage of its total take. It also has the option of asking friendly foreign intelligence agencies to perform these searches for it -- again without having to notify the FISA court.

The final problem with the NSA's announcement is it's unmoored from legislation. Unlike the drastic modification of the Section 215 metadata program -- which was tied to statutory requirements laid down by the USA Freedom Act -- the voluntary shutdown of the "about" collection doesn't contain anything legally-binding. As the ACLU points out, without codification the NSA could start its collection up again without notice, provided it has found a way to comply with the FISA court's demands… or found a better way to look like it's in compliance.

Filed Under: 702, about collections, mass surveillance, nsa, surveillance

The Email Collection The NSA Shut Down Has Been Abused For Years

from the and-it's-only-part-of-a-larger-collection dept

As was noted here earlier, the NSA surprised many people by shutting down its email collection. This collection was authorized by the FISA Amendments Act, which is due for renewal at the end of this year. Since the point the collection began, it was clear the NSA was also harvesting (inadvertently, it said) US persons' communications.

Ron Wyden, along with a few other lawmakers, has been asking the NSA for years to turn over information on this program -- specifically, how many US persons had been swept up "incidentally" in the bulk collection. For years, the NSA has refused to do so, claiming it would be impossible to compile this information and, somewhat hilariously, claiming it would violate the privacy of those swept up in the collection to query the database for incidental collections.

This decision to shut down the program may result in that answer never being given to Wyden. The ODNI (Office of the Director of National Intelligence) may decide the shutdown renders this particular query moot. It shouldn't. Now that the email program has been shut down EXPLICITLY because it sweeps up too many US persons' in the dragnet, the answer is more important than ever. And the ODNI has recently (and very belatedly) promised to deliver this number and should keep that promise even though the program has been shut down. Not only that, but this shutdown only affects the collection of email. It doesn't prevent the NSA from collecting other internet-based communications. With fewer people using email as their primary communication method, the NSA will still have plenty of communications to harvest.

There's another good reason for turning over that number: the Section 702 collection has been plagued with problems pretty much since its inception. The FISA court determined in 2011 that the program -- as operated by the NSA -- was unconstitutional. Apparently some fixes were made as the program was allowed to continue. But as Marcy Wheeler pointed out a year ago, the program has never not been violating the Foreign Intelligence Surveillance Act.

In his November 6, 2015 opinion reauthorizing Section 702, presiding judge Thomas Hogan described two more definite violations of 50 U.S.C. §1809(a)(2), and one potential one, bringing the list of times the FISC caught NSA illegally surveilling Americans to four, and potentially five, times.

Fall 2009 confession/July 2010 opinion: Collection of categories of data under the bulk PRTT program not permitted by the FISC (Bates’ opinion describes a category violation reported to FISC in the very first PRTT docket, along with NSA’s assurances it would never happen again)

June 2010 confession/December 10 2010, May 13, 2011 opinions: Retention of overcollected data from a traditional FISA warrant in mission management systems ultimately not deemed necessary for collection avoidance

May 2011 confession/October 3, 2011 opinion: Collection of entirely domestic communications on upstream surveillance MCTs

July 13, 2015 confession/November 6, 2015 opinion: Retention of 702 communications that had been otherwise purged in mission management systems, even though FISC had ruled against such retention in 2011

[Potential] July 13, 2015 confession/November 6, 2015 opinion: Retention of data that should have been purged or aged off in compliance databases

This is the authority the NSA wants approved at the end of the year. This shutdown might be an attempt to finally make the program legal -- or at least legal enough to survive a closer examination as the issue heads towards a vote.

This shutdown -- along with the NSA's long history of abuse -- also explains why there were no Section 702 approvals from the FISA court. As Wheeler suggested when the information was first released, the lack of approvals in 2016 indicated the program had "serious issues." Her post from last year shows the program has always had "serious issues." The number of requests the government made in 2016 was redacted from the report, but the footnote attached to it suggests it was more than one.

Perhaps the court no longer found the program Constitutional, at least not the way the NSA routinely operated it. While incidental collection is always a problem with bulk surveillance, the internal controls, which NSA talking points claim prevent abuse, apparently aren't controlling much or preventing much. It appears the NSA can't find a way to operate this part of the Section 702 program without collecting (and querying) US persons' communications, so it has decided to shut it down, rather than spend any more time and effort trying to talk the FISA court into approving its ritualistic abuse.

Despite having years to improve its practices and improve its segregation of collected data, the agency apparently did very little to rein this program in. A 2014 DOJ/ODNI report quoted by Wheeler shows misuse of collected data continued to increase even as the NSA sought orders to collect even more.

The joint oversight team, however, is concerned about the increase in incidents involving improper queries using United States person identifiers, including incidents involving NSA’s querying of Section 702-acquired data in upstream data using United States Person identifiers. Specifically, although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of media using United States person identifiers, this same section prohibits using United States person identifiers to query Internet communications acquired through NSA’s upstream collection techniques. NSA [redacted] incidents of non-compliance with this subsection of its minimization procedures, many of which involved analysts inadvertently searching upstream collection. For example, [redacted], the NSA analyst conducted approved querying with United States persons identifiers ([long redaction]), but inadvertently forgot to exclude Section 702-acquired upstream data from his query.

This continued abuse and misuse is highly problematic, although the ODNI has been the last entity to officially recognize this. The "upstream" collection not only results in vast amounts of intercepted communications, but is one the FBI's favorite sources for intel. The ODNI denies to this day the FBI's searches of the NSA's collections are "backdoor searches," but it's information and communications the FBI certainly can't collect itself under its legal authorities. The supposedly foreign-facing collection is routinely used by a domestic law enforcement agency to obtain US persons' communications without a warrant. That's a "backdoor" search, no matter how the ODNI portrays it.

No matter what else comes of it, this shutdown is huge. Even though it's a smaller part of a larger internet communications collection program, it's still a significant closure. And once again, this is a result of Snowden's leaks. Wyden's persistent pestering about incidental collection likely played a small part as well. But without documents clearly showing how much the program collected and how it was being used, the NSA would most likely still be trying to find a way to push these requests past the FISA court. And without this additional scrutiny, the court itself might have found itself more easily persuaded.

Filed Under: 702, about, mass surveillance, nsa, searches, section 702, surveillance

Surprise: NSA Stops Collecting Americans' Emails 'About' Foreign Targets

from the this-is-big dept

There aren't many details yet, but Charlie Savage at the NY Times has a major scoop: apparently, the NSA has halted "about" email collections. This is important. As we've discussed in the past, under Section 702 of the FISA Amendments Act, the NSA can collect info on approved "foreign targets." But here's where it got sketchy: they could collect the communications "to" them or "from" them -- which most people would expect -- but also they could collect any communications "about" them. In other words, did you joke about Osama bin Laden in an email? It's possible that under Section 702, the NSA could collect that email without a warrant. That was massively concerning because the "about" emails from Americans could contain lots of other info, and once sucked up into the NSA's system and made available to the FBI for "backdoor" incidental collection searches, could expose people to lots and lots of trouble. There have been pushes over the past few years to limit the collection to no longer include "about" communications, but those had been (as far as we knew!) unsuccessful.

And, for an unclear reason, the NSA has stopped doing that. Trevor Timm speculates that perhaps the FISA court ruled that collection illegal, which is possible (also we just noted that there were no new 702 approvals by the FISA Court last year), so perhaps the FISC is finally taking its job a bit more seriously. We've also pointed out that there have been legal fights over the fact that the DOJ lied to the Supreme Court about the nature of these "about" collections, which may have created more pressure to stop them from happening.

I'm sure that we'll find out more about what happened in the near future, but this will certainly play a large role in the upcoming debate about renewing Section 702.

Filed Under: about searches, backdoor searches, doj, fisa court, fisc, mass surveillance, nsa, section 702, surveillance

NSA Makes Pitch For Section 702 Approval While Its 702 Requests Aren't Being Approved By The Court

from the all-perfectly-lawful,-all-running-into-issues-during-approval dept

Section 702 -- the statute that allows the NSA to collect internet communications and data in bulk -- is up for renewal at the end of this year. The NSA, thanks to Ed Snowden, faced more of an uphill battle than usual when renewing Section 215 (bulk metadata collections). For the first time in its existence, the NSA ended up with a compromise (the USA Freedom Act), rather than a straight renewal.

The Intelligence Community appears to be trying to get out ahead of straight renewal opponents. The Office of the Director of National Intelligence has released a Section 702 Q&A at millennial watering hole Tumblr. By returning its own soft serve questions with canned talking points, the ODNI is hoping to show just how lawful its upstream collection is.

It also hopes to obscure something that's been around since the 2008 FISA Amendments Act: backdoor searches. Other government agencies have had the ability to peruse the NSA's collections, which were ostensibly gathered solely for national security use. The FBI is the most frequent backdoor searcher, seeing as it has rebranded as a counterterrorism unit over the past several years, which has allowed it to expand its surveillance capabilities and increase exploitation of the NSA's data stores.

The ODNI's Q&A document sort of admits this, but tries to downplay the implications of allowing a domestic law enforcement agency free access to national security-focused surveillance intake.

The government’s minimization procedures restrict the ability of analysts to query the databases that hold “raw” Section 702 information (i.e., where information identifying a U.S. person has not yet been minimized for permanent retention) using an identifier, such as a name or telephone number, that is associated with a U.S. person. Generally, queries of raw content are only permitted if they are reasonably designed to identify foreign intelligence information, although the FBI also may conduct such queries to identify evidence of a crime. As part of Section 702’s extensive oversight, DOJ and ODNI review the agencies’ U.S. person queries of content to ensure the query satisfies the legal standard. Any compliance incidents are reported to Congress and the FISC.

It still sort of sounds like a backdoor search, even with supposed strict oversight, but the ODNI adds a footnote claiming it isn't:

Queries of Section 702 data using U.S. person identifiers are sometimes mischaracterized in the public discourse as “backdoor searches.”

Oh, that crazy "public discourse." Won't it get anything right? Here's Emptywheel's Marcy Wheeler to explain what the ODNI won't.

While it’s true that NSA and CIA minimization procedures impose limits on when an analyst can query raw data for content (but not for metadata at CIA), that’s simply not true at FBI, where the primary rule is that if someone is not cleared for FISA themselves, they ask a buddy to access the information. As a result — and because FBI queries FISA data for any national security assessment and “with some frequency” in the course of criminal investigations. In other words, partly because FBI is a domestic agency and partly because it has broader querying authorities, it conduct a “substantial” number of queries as opposed to the thousands done by CIA.

Wheeler goes on to point to the Privacy and Civil Liberty Oversight Board's (RIP) report on Section 702 as evidence of this common FBI practice. While the PCLOB mostly punted on Section 702, finding it to be less blatantly-unconstitutional than the Section 215 program, it still found the FBI perused raw NSA collections quite frequently, both for foreign intelligence information and evidence of criminal activity. The PCLOB was unable to assess how frequently these "none dare call it a backdoor" searches occurred because the FBI has no way of tracking how often it dips into the NSA's collections. With no data and no reporting, it's pretty disingenuous to claim there's effective oversight over the Section 702 program.

Marcy Wheeler also noticed something unusual in the brand new FISC Section 702 report -- newly-required by the USA Freedom Act. According to the numbers released by the FISA Court, zero 702 applications were approved in 2016.

Wheeler points out the process for Section 702 approval runs much like that of Section 215, with applications either being approved by the FISA court or sent back for fixes. Once approved, extensions can be requested, but only for up to 60 days at a time. As she notes, the last 702 submission wouldn't have been able to coast through 2016 without a renewal.

The prior approval before last year was November 6, 2015, so it would only have had to have been extended 2 months to get into this year. So that seems to suggest there was at least a three month (application time plus extension) delay in approving the certifications for this year.

Note, too, that the report shows the only amicus appointed last year was Marc Zwillinger for a known PRTT application, so this hold up wasn’t even related to an amicus complaint.

In any case, this may reflect significant issues with 702.

The Snowden documents -- along with some from other unidentified leakers -- generated far more scrutiny of Section 702 than the NSA has ever experienced. It's not tough to imagine at least a couple of FISA judges being surprised with the scope of what they were approving. The number of submissions is redacted, but the footnote attached makes it clear the government submitted more than one application. This span with zero approvals dates back to the middle of last year, so it's been a bit of a dry run for the NSA.

The NSA has run into issues before with Section 702, the last time being in 2011, when the FISA court found the "upstream collection" of internet data to be "deficient on constitutional and statutory grounds." The NSA obtained extensions and apparently modified the order until it reached the FISA court's standards. This long delay between approvals could suggest the NSA is back in constitutionally-deficient waters, which definitely isn't where it wants to be as the program heads for renewal.

Filed Under: fisa court, fisc, mass surveillance, nsa, section 702, surveillance

NSA Official Says It Might Have Been Nice If The Agency Had Handled The Public Disclosure Of The Section 215 Program

from the see-also:-snooze-v.-lose dept

Now that Edward Snowden has done all the leg work, the Intelligence Community is admitting that, yeah, maybe it should have been more upfront about the phone metadata collection. The soon-to-be-former NSA Deputy Director says it might have been better for the agency to be out ahead of the disclosures, rather than forced to play defense.

Richard Ledgett, who is retiring next month, said in an interview with Reuters that disclosing the secret program would have been difficult. But, he said, doing so might have mitigated the damage done by Snowden.

"That's one where I might have to say, yes," Ledgett said in his office at NSA headquarters in Fort Meade, Maryland. "That's one where maybe it would have been less shocking when Snowden did what he did."

Ledgett's not alone in feeling this way. Since the leaking began back in June 2013, several current and former officials have made similar statements. For one thing, controlling the disclosure means controlling the narrative. The IC could have pointed to several things in defense of the bulk domestic collection program, including:

a.) the lawfulness of the collection
b.) the rigorous oversight
c.) the strict compliance with FISA and the FISA court
d.) it's "just metadata"

Doing so might have headed off Snowden and other leakers. Possibly. At the very least, it would have bought the NSA some time and some narrative leeway before documents began being published showing:

a.) the collection's lawfulness was dubious at best
b.) the oversight was a joke
c.) the FISA court routinely discovered abuse by the NSA
d.) metadata exposes quite a bit of a person's life, actually.

Not quite as straightforward were Ledgett's comments on the Section 702 program, which provides backdoor domestic searches for a variety of government agencies, as well as harvests millions of communications from internet backbones. During the run-up to the Section 215 reauthorization two years ago, it sometimes appeared the NSA was willing to make deep compromises on the telephone metadata program in order to spare the internet collection the same sort of Congressional scrutiny.

Since 2011, oversight committee members (well, just a couple of them, actually) have been demanding an estimate of the amount of American communications incidentally-collected by the NSA with this program. Six years later, there have been promises made but none kept. At this point, Ledgett is just another IC official making promises no one seems to have any intent of keeping.

Privacy advocates have repeatedly demanded that the government share an estimate of how many Americans are ensnared by programs authorized under Section 702.

Intelligence officials have declined to do so. But Ledgett, in remarks earlier Tuesday at a forum sponsored by the Aspen Institute, said "yes" when asked if an estimate would be provided before year end.

We'll see. Deadlines have been ignored in the past and Ledgett's on his way out the door, so these are promises he can't be held responsible for not keeping.

Filed Under: disclosure, ed snowden, mass surveillance, nsa, richard ledgett, section 215

Trump Administration Wants A Clean Reauthorization For NSA Surveillance

from the because-of-course-it-does dept

Considering the new administration has stepped up its ousting of immigrants, expressed its disinterest in pursuing civil rights investigations of the nation's law enforcement agencies, applauded asset forfeiture, and declared war on leakers, it comes as no surprise the White House supports a clean reauthorization of Section 702 surveillance.

The Trump administration does not want to reform an internet surveillance law to address privacy concerns, a White House official told Reuters on Wednesday, saying it is needed to protect national security.

The announcement could put President Donald Trump on a collision course with Congress, where some Republicans and Democrats have advocated curtailing the Foreign Intelligence Surveillance Act, or FISA, parts of which are due to expire at the end of the year.

Section 702 has dodged reform efforts, thanks in part to the intelligence community's unwillingness to discuss anything about it. Repeated requests by representatives for the NSA to come up with an estimate of how many US persons' communications are swept up "inadvertently" have been met with shrugs and stalling. Five years after he was first asked, James Clapper promised to have something put together "soon." We're still waiting.

Not helping the matter is the Privacy and Civil Liberties Oversight Board's evaluation of the program. After finding the Section 215 phone metadata program both useless and illegal, it had very little to say about the NSA's internet backbone dragnet. The best it could offer was that it was likely legal and any collection of US persons' communications was probably "inadvertent." It agreed the massive collection program ran right up against the edges of the Fourth Amendment, but didn't cross it -- at least as far as it was willing to examine.

Unfortunately, there will be no follow-up arriving before the reauthorization period closes. The PCLOB is mostly dead and unlikely to be revived by an administration looking for a no-questions-asked rubber stamping of Section 702's five-year renewal. Given that the unanswered questions about domestic surveillance weren't answered in time for the 2012 renewal debate, it's highly probable the Director of National Intelligence's office won't be providing these numbers to Congressional representatives ahead of the December deadline.

Hopefully, there will be a more organized push back against a clean reauthorization. Thanks to multiple leaks, Congressional representatives should actually have some idea how much domestic surveillance occurs under this statute. It's more critical than ever that the program receive a detailed examination before the vote, considering the outgoing president gave more than a dozen federal agencies access to unminimized data/communications collected by the NSA.

And Trump himself has seen no reason to roll that sharing back, despite his antipathy towards much of Obama's orders and legislation. Ironically, his Saturday morning tweetstorm griping about the Trump Tower being "wire tapped" by Obama ahead of the November election. Once again, Trump has offered no proof of this claim, but even if taken at face value, it would be the byproduct of the Section 702 program he has stated he wants renewed with no changes. Communications with foreign persons is fair game under Section 702, even if the communications originate in the US. The FBI's acquisition of these communications (if that's what has happened) is specifically approved by the recent data-sharing program. Perhaps Trump might want to take a closer look at the program before attempting to shove it past inquistive legislators.

Filed Under: donald trump, fisa court, fisc, mass surveillance, seciton 702, surveillance

Germany's Spy Agency Walks Away From Three-Year Investigation With Expanded Spy Powers

from the when-getting-to-the-bottom-of-something-means-lightly-scratching-the-surface dept

Netzpolitik -- once on the receiving end of treason charges for reporting on leaked documents -- is marking the end of the so-called "inquiry" into the BND-NSA partnership with a post discussing the inquiry's multiple failures. The German government's investigation into Five Eyes spy efforts was a direct result of leaked Snowden documents, which showed the NSA had spied on the German chancellor.

It failed to uncover much about that particular allegation. By the time this part of the investigation had been dropped, President Obama had already apologized for the NSA doing perfectly normal NSA-type stuff: spying on foreign officials. The committee turned to a broader discussion of surveillance best practices, including the propriety of spying on friends and neighbors. In doing so, it uncovered plenty of illicit and ill-advised spying by its NSA equivalent, BND.

Netzpolitik has a full list of BND's questionable surveillance targets, including friendly foreign officials, journalists, EU officials, the UN, human aid organizations, banks, rating agencies, and a number of American companies. (Do unto others, etc.)

But when it came to actually examining BND's tactics and programs, the committee opted to dwell on legal minutia.

Quite some time was spent on the question of when which sub-division manager in BND knew of which selector and to whom he reported it or why he didn’t and whether someone was present at a meeting in the chancellery on 24th of October 2013 or not or was it the 28th… No wonder sometimes only a dozen people witnessed the public hearings until late at night.

It's a great way to talk around the issues, rather than addressing them. Netzpolitik felt the pain personally, as its reporters attended the public hearings and transcribed all 5.6 million characters of undisturbed bushes idly observing nearby beatings.

This was not entirely the tribunal's fault, however. As soon as it became apparent surveillance partnerships were going to be discussed, BND's Five Eyes partners began issuing ultimatums.

The committee was only allowed to investigate a few discontinued and outdated joint operations between the German spy agency BND and the Five Eyes: Eikonal in Frankfurt and Glotaic. But the name "Glotaic" could not even be spoken, because it includes the partner's name "CIA". Just like operation "Monkeyshoulder", which was planned with British GCHQ. This could not be mentioned at all, as the UK threatened to end any spy cooperation. The committee would be responsible for terrorist attacks, they said.

The committee is now in the process of writing a report that few will see, much less read. A public version will likely be presented, short on specifics and long on assertions of lawful authority and rigorous oversight. It's basically up to leakers to provide the public with the reality of the situation. And much of what the committee managed to uncover has been glossed over... or codified.

The consequences to those revelations amount to the next scandal. Instead of adjusting the spying to the law, the laws are adjusted to the spying. One year before the end of the committee, the grand coalition passed a reform of the BND law. With this change, everything that the BND is doing, is legalized – and even expanded.

The committee found that the NSA spies on its "friends" just as often as BND does. The examination of 14 million shared intercepts turned up 40,000 "friendlies." Notably, the committee was not allowed to review these intercepts. It was just supposed to take the single reviewer's word on the percentage of "friendly" NSA targets.

Taking a look at its own intercepts, BND found 3,300 "participants" linked to 15,000 "selectors" in its "friendlies" file. This means German officials like Merkel will find it difficult to feign anger at the NSA's friendly spy targets.

Not that any of this matters, at least not in the short run. As Netzpolitik points out, while the committee was busy discussing the few things it could discuss, the German parliament was expanding BND's legal authorities.

German citizens -- along with everyone the government spies on -- can rest assured nothing has changed. It's only gotten worse. The final report may provide more examples of BND's misconduct, but the agency has already been rewarded for its misbehavior by the same officials charged with holding the agency accountable for its abuses.

Filed Under: bnd, germany, mass surveillance, nsa, surveillance

Netherlands Looks To Join The Super-Snooper Club With New Mass Surveillance Law

from the but-it-ain't-over-until-the-CJEU-rules dept

As Techdirt has noted, the UK's Investigatory Powers Act, better known as the Snooper's Charter, has been dubbed "the most extreme surveillance law ever passed in a democracy." It may be the worst, but it's not an isolated case. Governments around the world are bringing in laws that grant them powers to spy on innocent citizens using "bulk collection" of information -- mass surveillance, in other words. As the Dutch site Bits of Freedom reports, the latest country to join the super-snooper club is the Netherlands, where the lower house has just passed the bill for the new Intelligence and Security Services Act:

The controversial new law will allow intelligence services to systematically conduct mass surveillance of the internet. The current legal framework allows security agencies to collect data in a targeted fashion. The new law will significantly broaden the agencies' powers to include bulk data collection. This development clears the way for the interception of the communication of innocent citizens.

Another worrying trend is for spies around the world to pass on information they have gathered to intelligence services in other countries. The Dutch law is particularly bad in this respect, for the following reason:

Under the passed bill, Dutch security agencies may also share collected data without having analyzed it first. But when we hand over data to foreign governments without performing some form of data analysis prior to the exchange, we run the risk of not knowing what potentially sensitive information falls into foreign hands, and the consequences that might have for citizens.

The Bits of Freedom post also notes that much in the proposed law has yet to be defined, which is hardly a happy state of affairs. That includes limitations on the powers and how oversight will be carried out. However, more positively, among the revisions made to the bill when it was put out for public consultation in 2015 are some important improvements. Here's what happens next:

It's now the Senate's turn to review the bill. A bill that, in all likelihood, will not meet the minimum safeguards dictated by European law. If the parliamentary groups in the upper house abide by those in the lower house, the bill will be cleared with a comfortable majority.

The mention of the safeguards of European law is significant. As we reported in December, the Court of Justice of the European Union (CJEU) confirmed that general and indiscriminate data retention is illegal in the EU. Assuming the Dutch law is passed as expected, a legal challenge at the CJEU could follow, and would seem to stand a good chance of getting the law struck down in its present form.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: intelligence and security services act, mass surveillance, netherlands, privacy