The NSA's Bulk Collection Of Phone Records Ended Saturday. Long Live The Bulk Collection Of Phone Records!

from the a-dragnet-among-dragnets dept

The NSA's frontmouth, the Office of the Director of National Intelligence, is burying news again. Not that it could help it. Normally, the ODNI likes to do its document dumps (most often consisting of documents ordered out of its hands by federal judges presiding over FOIA lawsuits) on Friday afternoons or shortly before a holiday to buy itself some response time before dealing with journalists and Congressional committees.

In this case, it delivered its latest news on Black Friday, while most of America was either out shopping or covering the story of Americans shopping for the local newsjobber. The timing would be suspect if it weren't for the fact that the NSA's bulk phone metadata program ended (at least in this form) at 11:59 PM Saturday night.

On June 2, 2015, Congress passed and the President signed the USA FREEDOM Act of 2015. The Act reauthorized several important national security authorities; banned bulk collection under Section 215 of the USA PATRIOT Act, under the pen register and trap and trace provisions found in Title IV of Foreign Intelligence Surveillance Act (FISA), or pursuant to National Security Letters; adopted the new legal mechanism proposed by the President regarding the targeted production of telephony metadata; made significant modifications to proceedings before the FISC; and built on the U.S. Government’s unprecedented transparency about intelligence activities. With respect to the new mechanism for the targeted production of telephony metadata, to allow sufficient time to implement a new system while at the same time avoiding any lapse in a national security program, the USA FREEDOM Act provided for a 180-day transition period during which the existing NSA bulk telephony metadata program may continue.

The six months are up and so is the NSA's Section 215 collection. While this means phone records will be held where they've always been held (phone companies) and the NSA must now approach providers with FISA court orders, this does not mean the NSA will no longer be collecting phone records in bulk. It just means it won't be doing this under those particular authorities (Section 215, PR/TT provisions, NSLs). It still has plenty of options.

For one, it appears to have access to more records than it used to under Section 215. From the fact sheet:

[T]he overall volume of call detail records subject to query pursuant to court order is greater under USA FREEDOM Act.

This could mean the new method (approaching phone companies directly) may give the NSA access to records it couldn't obtain under Section 215, like additional cell phone records or other communications methods like VOIP. In other words, the requests will be more targeted but capable of obtaining a greater variety of records responsive to the court-approved identifiers.

As I've said before, I suspect the NSA was willing to let Section 215 provide bus traction for the administration's minimal surveillance reform efforts. As long as everyone kept worrying about the bulk phone metadata (subject of multiple lawsuits that are now basically moot as far as the courts are concerned), the NSA would be able to keep its multiple other, more intrusive programs intact. As Marcy Wheeler notes, this program may be dead, but it doesn't mark the end of the NSA's bulk phone records collection.

Just a tiny corner of the phone dragnet will shut down, and the government will continue to collect “telephony metadata records in bulk … including records of both U.S. and non-U.S. persons” under EO 12333. Hypothetically, for every single international call that had been picked up under the Section 215 dragnet and more (at a minimum, because NSA collects phone records overseas with location information), a matching record has been and will continue to be collected overseas, under EO 12333.

They’re still collecting your phone records in bulk, not to mention collecting a great deal of your Internet records in bulk as well.

The DNI himself, James Clapper, threw his weight behind reforming this high-profile but ultimately minimal part of the NSA's dragnet. That should have been indication enough that killing off the Section 215 program wouldn't severely limit the NSA's surveillance options, despite the occasional bit of FUD directed at legislators (or parroted by them).

Filed Under: bulk collection, eo 12333, mass surveillance, metadata, nsa, phone records, section 215

Documents: The Domestic Email Collection Program The NSA 'Killed' In 2011 Was Actually Just Offshored

from the the-underwater-dragnet dept

New documents obtained by Charlie Savage of the New York Times (as the result of a FOIA lawsuit) show that the NSA may have killed off its bulk collection of US persons' emails back in 2011, but it quickly found another way to obtain these -- a way that circumvented restrictions on domestic collections.

While that particular secret program stopped, newly disclosed documents show that the N.S.A. had found a way to create a functional equivalent. The shift has permitted the agency to continue analyzing social links revealed by Americans’ email patterns, but without collecting the data in bulk from American telecommunications companies — and with less oversight by the Foreign Intelligence Surveillance Court.

The new document is an Inspector General's report detailing the NSA's failure to follow the restrictions laid down by FISC Judge John Bates in his October 3, 2011 opinion. Bates felt the collection of US persons' email content in this fashion amounted to an illegal wiretap. This would be the same collection the NSA defended (before it was given more power to collect domestic data without a warrant by the 2008 FISA Amendments Act) in the FISA court by claiming an email address was the same thing as a "facility," because email addresses "facilitate" communications.

So, the reassurances -- offered in response to the Snowden leaks -- that the program had been shut down are essentially meaningless. The NSA halted a particular collection method, but did not halt the collection of domestic emails.

The report explained that there were two other legal ways to get such data. One was the collection of bulk data that had been gathered in other countries, where the N.S.A.’s activities are largely not subject to regulation by the Foreign Intelligence Surveillance Act and oversight by the intelligence court. Because of the way the Internet operates, domestic data is often found on fiber optic cables abroad.

As Marcy Wheeler points out, the killing of one domestic email collection and initiation of another meant some NSA personnel were very busy during the 2011 holiday season.

Given the length of the redacted date (it is one character longer than “9 December 2011”), we can say with some confidence that Keith Alexander approved the end and destruction of the dragnet between November 10 and 30 — during the same period the government was considering appealing Bates’ ruling, close to the day — November 22 — NSA submitted a motion arguing that Section 1809(a)(2)’s wiretapping rules don’t apply to it, and the day, a week later, it told John Bates it could not segregate the pre-October 31 dragnet data from post October 31 dragnet data.

Think how busy a time this already was for the legal and tech people, given the scramble to keep upstream 702 approved! And yet, at precisely the same time, they decided they should nuke the dragnet, and nuke it immediately, before the existing dragnet order expired, creating another headache for the legal and tech people. My apologies to the people who missed Thanksgiving dinner in 2011 dealing with both these headaches at once.

Not only did NSA nuke the dragnet, but they did it quickly. As I said, it appears Alexander approved nuking it November 10 or later. By December 9, it was gone.

As she goes on to detail, the program the Inspector General was looking for was indeed gone. But the collection itself wasn't. As far as the IG could tell, the NSA was mostly in compliance. The IG's report, however, notes its powers to assess the collection, storage and access to email data and content are very limited. As Wheeler puts it, the NSA "ate" its homework before the IG had a chance to assess its compliance.

As to the the intake side,those folks started destroying the dragnet before the IG could come by and check their before status:

"However, S3 had completed its purge before we had the opportunity to observe. As a result we were able to review the [data acquisition database] purge procedures only for reasonableness; we were not able to do the before and after comparisons that we did for the TD systems and databases disclosed to us."

Poof! All gone, before the IG can even come over and take a look at what they actually had.

Importantly, the IG stresses that his team doesn’t have a way of proving the dragnet isn’t hidden somewhere in NSA’s servers.

"It is important to note that we lack the necessary system accesses and technical resources to search NSA’s networks to independently verify that only the disclosed repositories stored PR/TT metadata."

The Inspector General's office appears to have been steered to its conclusion by the NSA, which dumped the data from the places it expected the IG to look ("disclosed repositories") and utilized a new collection method that wasn't subject to FISA court restrictions or nearly as much IG oversight.

So, the NSA's statements about shutting down the email program in 2011 are technically correct. It was shut down. The NSA, however, simply chose to siphon as much domestic data from its overseas collections as possible to ensure it never really had to end its warrantless collection of US persons' emails.

Filed Under: bulk collection, email, internet, mass surveillance, metadata, nsa, surveillance

Judge Again Says NSA Phone Records Program Is Unconstitutional; Orders NSA To Stop Collecting Phone Records Of Plaintiffs

from the here-we-go-again dept

Back in December of 2013, DC district court judge Richard Leon shocked many by declaring the NSA's bulk collection of phone records under Section 215 of the PATRIOT Act to be unconstitutional. Just a few months ago, the DC circuit appeals court overturned that ruling and sent it back to the lower court, saying that the plaintiff, Larry Klayman, failed to prove he had standing to bring the lawsuit -- mainly because Snowden only had revealed that the NSA was scooping up all Verizon Business Network phone records, and Klayman was a Verizon Wireless customer. That it had since been revealed that the NSA also got Verizon Wireless records was basically ignored.

As we noted in September, Judge Leon made it pretty clear that he still believed the program was unconstitutional, and pushed Klayman to get the process moving so he could rule. Klayman was able to bring new plaintiffs (J.J. Little and J.J. Little & Associates)) into the case who were Verizon Business Network Services subscribers to take that issue out of play. And now that's happened, and Leon has, once again declared the program unconstitutional and ordered an injunction to have it stopped.

With the Government's authority to operate the Bulk Telephony Metadata Program quickly coming to an end, this case is perhaps the last chapter in the Judiciary's evaluation of this particular Program's compatibility with the Constitution. It will not, however, be the last chapter in the ongoing struggle to balance privacy rights and national security interests under our Constitution in an age of evolving technological wizardry. Although this Court appreciates the zealousness with which the Government seeks to protect the citizens of our Nation, that same Government bears just as great a responsibility to protect the individual liberties of those very citizens.

Thus, for all the reasons stated herein, I will grant plaintiffs J.J. Little and J.J. Little & Associates' requests for an injunction and enter an order consistent with this Opinion that (1) bars the Government from collecting, as part of the NSA's Bulk Telephony Metadata Program, any telephone metadata associated with these plaintiffs' Verizon Business Network Services accounts and (2) requires the Government to segregate any such metadata in its possession that has already been collected.

He did not grant the same order for Klayman or other plaintiffs who were not customers of Verizon Business Services, in order to avoid the standing question. Perhaps more interesting is that, unlike last time, he did not give the government an immediate stay on this ruling, and you can tell he's a bit annoyed about what happened last time:

In my December 2013 Opinion, I stayed my order pending appeal in light of the national security interests at stake and the novelty of the constitutional issues raised. I did so with the optimistic hope that the appeals process would move expeditiously. However, because it has been almost two years since I first found that the NSA's Bulk Telephony Metadata Program likely violates the Constitution and because the loss of constitutional freedoms for even one day is a significant harm... I will not do so today.

Good for him.

As noted above, Judge Leon finds standing just for the two new plaintiffs, basically accepting the appeals court's ruling earlier that Klayman and other plaintiffs failed to "adequately" sustain their claims of harm. He rejects some silly defenses from the DOJ, including the claim that we no longer know if Verizon Business Network Services is a part of the program. As Leon says "it defies common sense for defendants to argue, as they apparently do that the Government has chosen to omit from this breathtakingly broad metadata collection Program a provider that the Government surveilled in the past and that, presumably, has the infrastructure to continue assisting in that surveillance. In fact it would make no sense whatsoever for the Government to use all available tools except VBNS call data to accomplish its putative goals."

Then onto the important stuff: the Fourth Amendment. Leon tackled much of that back in his 2013 opinion, but there's more here, noting that the problem is still in place, even after the USA Freedom Act passed:

In my December 2013 Opinion, I explained at length why both the indiscriminate bulk collection of telephony metadata and the analysis of that data each separately constitute a search within the meaning of the Fourth Amendment.... Neither the recent changes in the operation of the Program, nor the passage of the USA FREEDOM Act, has done anything to alter this analysis. The fact remains that the indiscriminate, daily bulk collection, long-term retention, and analysis of telephony metadata almost certainly violates a person's reasonable expectation of privacy.

Then there's the question of whether these collections count as "unreasonable searches" and Judge Leon finds that they do. In part, he tosses out the usual reliance on Smith v. Maryland by the government, which says that if you give data over to a third party, you no longer have any privacy rights over it (the so-called "third party doctrine"). The ruling compares it to the diminished privacy rights you have in going through airport security:

Notably, Americans know that airports are discrete areas in which certain rights otherwise enjoyed are forfeited.... It is their choice to enter that space and, in so doing, to check certain rights at the door. Not so with cellphones. As already described, cellphones have become a constant presence in people's lives. While plaintiffs' privacy interests in their aggregated metadata may be somewhat diminished by the fact that it is held by third-party service providers, this is a necessary reality if one is to use a cellphone at all, and it is, therefore, simply not analogous to the context of voluntarily entering an airport. In this case, plaintiffs have asserted that the searches were a substantial intrusion on their privacy, and I have no reason to doubt that, nor to find that their privacy expectations should have been diminished given the context. Rather, I conclude that plaintiffs' privacy interests are robust.

Judge Leon also notes that the public really had no idea this was happening, until recently:

Finally, far from Americans being put on notice of the Bulk Telephony Metadata Program such that they could choose to avoid it, the Program was, and continues to be, shrouded in secrecy. This may, of course, be practically necessary for the Program to be effective, but it nevertheless increases the level of the privacy intrusion.

Judge Leon then looks to see if, maybe, just maybe the government can justify this intrusion by showing that these searches were necessary to stop terrorist attacks, but again, finds no evidence to support that.

To date, the Government has still not cited a single instance in which telephone metadata analysis actually stopped an imminent attack, or otherwise aided the Government in achieving any time-sensitive objective. Although the Government is not required to adduce a specific threat in order to demonstrate that a "special need" exists, providing this Court with examples of the Program's success would certainly strengthen the Government's argument regarding the Program's efficacy. This is especially true given that the Program is not designed for detection and deterrence like most other programs upheld under the "special needs" doctrine. Indeed, most warrantless searches upheld under the "special needs" doctrine boast deterrence as a substantial Governmental interest.

He also rejects the idea that the USA Freedom Act shows that Congress is okay with the program and that proves that the NSA had the "special needs" necessary to keep the program running. And he clearly thinks this is a dumb argument, even saying a sarcastic "Please!" in his response:

....the Government makes the bootstrap argument that the enactment of the USA FREEDOM Act confirms the importance of this Program to meeting the Government's special needs, and suggests that this Court should defer to that judgment. Please! I recognize that my duty to evaluate the efficacy of this Program is "not meant to transfer from politically accountable officials to the courts the decision as to which among reasonable alternative law enforcement techniques should be employed to deal with a serious public danger."... Nonetheless, while "the choice among such reasonable alternatives remains with the governmental officials," I must still determine whether the Program is reasonably effective in accomplishing its goals, even if not optimally so.... This is a conclusion I simply cannot reach given the continuing lack of evidence that the Program has ever actually been successful as a means of conducting time-sensitive investigations in cases involving imminent threats of terrorism.

From there he goes on to detail why letting the program continue to spy on the plaintiffs would create significant harm and rejects the idea that the government can't respond quickly enough, noting that it's had 22 months since his original ruling to figure out how to handle this.

Of course, again, the ruling only applies to the bulk phone records of two plaintiffs -- and the entire program is set to end at the end of this month anyway, but it is still an important victory for the 4th Amendment and against NSA bulk surveillance.

Filed Under: 4th amendment, bulk records, doj, j.j. little, larry klayman, mass surveillance, metadata, nsa, richard leon, standing

UK Home Secretary Says Don't Worry About Collection Of Metadata; FOIA Request Made For Her Metadata

from the well,-this-should-be-interesting dept

With the release of the new UK Snooper's Charter, UK Home Secretary Theresa May tried to justify the collection of phone and internet records as nothing more than being like an "itemised phone bill" and therefore nothing to worry about. Keith Vaz replied that there is plenty to be concerned about when the government can look at such records:

I know you said the information is equivalent to an itemised bill but there's a lot of information in an itemised bill.

If I were to look at your itemised telephone bill and you were to look at mine we might be surprised at who we were telephoning.

But, in response to Vaz, May apparently insisted that there was nothing at all in her records that anyone might find surprising -- leading some to question whether this was May agreeing to release her phone and internet records. Apparently Chris Gilmour decided to find out for sure, and has filed a Freedom of Information request in the UK for a bunch of May's records (found via Ryan Gallagher).

Dear Home Office,

Under the Freedom of Information Act 2000 I hereby request the following information from and regarding the Rt Hon Theresa May MP (Con), Secretary of State for the Home Department (the "Home Secretary"):

1) The date, time, and recipient of every email sent by the Home Secretary during October 2015.

2) The date, time, and sender of every email received by the Home Secretary during October 2015.

3) The date, time, and recipient of every internet telephony call (e.g. "Skype" call) made by the Home Secretary during October 2015.

4) The date, time, and sender of every internet telephony call (e.g. "Skype" call) received by the Home Secretary during October 2015.

5) The date, time, and domain address of every website visited by the Home Secretary during October 2015.

Yours faithfully,

Chris Gilmour

Should be interesting to see the responses to that request, huh?

Filed Under: chris gilmour, internet records, metadata, phone records, surveillance, theresa may, uk

GCHQ's Karma Police: Tracking And Profiling Every Web User, Every Website

from the this-is-what-you'll-get,-when-you-mess-with-us dept

One of the very first revelations from the Snowden leaks was a GCHQ program modestly entitled "Mastering the Internet." It was actually quite a good name, since it involved spying on vast swathes of the world's online activity by tapping into the many fiber optic cables carrying Internet traffic that entered and left the UK. The scale of the operation was colossal: the original Guardian article spoke of a theoretical intake of 21 petabytes every day. As the Guardian put it:

For the 2 billion users of the world wide web, Tempora represents a window on to their everyday lives, sucking up every form of communication from the fibre-optic cables that ring the world.

But the big question was: what exactly did GCHQ do with that huge amount of information? Two years later, we finally know, thanks to a new article in The Intercept, which provides details of another major GCHQ program called "Karma Police" -- the name of a song by Radiohead, with the repeated line "This is what you'll get, when you mess with us". A GCHQ document obtained by Snowden indicates that Karma Police goes back some years -- at least to 2008. It provides the following summary of the project's aims:

KARMA POLICE aims to correlate every user visible to passive SIGINT [signals intelligence] with every website they visit, hence providing either (a) a web browsing profile for every visible user on the internet, or (b) a user profile for every visible website on the internet.

Profiling every (visible) user, and every (visible) website seems insanely ambitious, especially back in 2008 when computer speeds and storage capacities were far lower than today. But the information that emerges from the new documents published by The Intercept suggests GCHQ really meant it -- and probably achieved it.

As of 2012, GCHQ was storing about 50 billion metadata records about online communications and Web browsing activity every day, with plans in place to boost capacity to 100 billion daily by the end of that year. The agency, under cover of secrecy, was working to create what it said would soon be the biggest government surveillance system anywhere in the world.

That's around 36 trillion metadata records gathered in 2012 alone -- and it's probably even higher now. As Techdirt has covered previously, intelligence agencies like to say this is "just" metadata -- skating over the fact that metadata is actually much more revealing than traditional content because it is much easier to combine and analyze. An important document released by The Intercept with this story tells us exactly what GCHQ considers to be metadata, and what it says is content. It's called the "Content-Metadata Matrix," and reveals that as far as GCHQ is concerned, "authentication data to a communcations service: login ID, userid, password" are all considered to be metadata, which means GCHQ believes it can legally swipe and store them. Of course, intercepting your login credentials is a good example of why GCHQ's line that it's "only metadata" is ridiculous: doing so gives them access to everything you have and do on that service.

Login ID, userid and password all considered to be "metadata"

The trillions of metadata records are stored in a huge repository called "Black Hole." In August 2009, 41 percent of Black Hole's holdings concerned web browsing histories. The rest included a wide range of other online services: email, instant messenger records, search engine queries, social media, and data about the use of tools providing anonymity online. GCHQ has developed software to analyze these other kinds of metadata in various ways:

SOCIAL ANTHROPOID, which is used to analyze metadata on emails, instant messenger chats, social media connections and conversations, plus “telephony” metadata about phone calls, cell phone locations, text and multimedia messages; MEMORY HOLE, which logs queries entered into search engines and associates each search with an IP address; MARBLED GECKO, which sifts through details about searches people have entered into Google Maps and Google Earth; and INFINITE MONKEYS, which analyzes data about the usage of online bulletin boards and forums.

In order to connect these different kinds of Internet activity with individuals, GCHQ makes great use of information stored in cookies:

A top-secret GCHQ document from March 2009 reveals the agency has targeted a range of popular websites as part of an effort to covertly collect cookies on a massive scale. It shows a sample search in which the agency was extracting data from cookies containing information about people's visits to the adult website YouPorn, search engines Yahoo and Google, and the Reuters news website.

Other websites listed as "sources" of cookies in the 2009 document are Hotmail, YouTube, Facebook, Reddit, WordPress, Amazon, and sites operated by the broadcasters CNN, BBC, and the U.K.'s Channel 4.

Clearly the above activities allow incredibly-detailed pictures of an individual's online activities to be built up, not least their porn-viewing habits. One tool designed to "provide a near real-time diarisation of any IP address" is called, rather appropriately, Samuel Pepys, after the famous 17th-century English diarist.

The extraordinary scale of GCHQ's spying on "every visible user" raises key questions about its legality. According to The Intercept story:

In 2010, GCHQ noted that what amounted to "25 percent of all Internet traffic" was transiting the U.K. through some 1,600 different cables. The agency said that it could "survey the majority of the 1,600" and "select the most valuable to switch into our processing systems."

Much of that traffic will be from UK citizens when they access global services like Google or Facebook, which GCHQ has admitted it defines as "external platforms," and which is thus completely stripped of what few safeguards UK law offers against this kind of intrusive surveillance by GCHQ.

This means that it is certain that many -- perhaps millions -- of UK citizens have been profiled by GCHQ using these newly-revealed programs, without any kind of warrant or authorization being given or even sought. The information stored in the Black Hole respository, and analyzed with tools like Samuel Pepys, provides unprecedented insights into the minutiae of their daily lives -- which websites they visit, which search terms they enter, who they contact by email or message on social networks. Within that material, there is likely to be a host of intimate facts that could prove highly damaging to the individual's career or relationships if revealed -- perfect blackmail material, in other words. Thanks to other Snowden documents, we know that the NSA had plans to use this kind of information in precisely this way. It would be naive to think it would never be used domestically, too.

It's frustrating that it has taken over two years for these latest GCHQ documents to be published, since they reveal that the scale of British online surveillance and analysis is even worse than the first Snowden documents indicated, bad as they were. They prove that the current calls for additional spying powers in the Snooper's Charter are even more outrageous than we thought, since the UK authorities already track and store British citizens' online moves in great detail.

When Edward Snowden handed over his amazing trove of documents to journalists to release as they thought best, he also placed a huge responsibility on their shoulders to do so as expeditiously as possible. If, as seems likely, there are yet more important revelations about the scale of US and UK spying to come, it is imperative that they are published as soon as possible to help the fight against those countries' continuing attempts to bolster mass surveillance and weaken our freedoms.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: collect it all, gchq, karma police, logins, mass surveillance, metadata, passwords, social media, surveillance, uk

George W. Bush Tried To Retroactively Declare Illegal, Unconstitutional NSA Surveillance Legal, Because He Said So

from the secret-laws,-secret-interpretations dept

When it comes to the NSA, we've been discussing just how dangerous it is when the government gets to put in place its own secret interpretation of laws that, when read by the public, appear to say something quite different than the secret interpretation. Otherwise you have secret laws, and that's no way to run an open Constitutional democracy. For many years, it's been known that in March of 2004 there was a hospital room showdown between then White House Counsel Alberto Gonzales (with White House Chief of Staff Andy Card) and (at the time, quite ill) Attorney General John Ashcroft and acting Attorney General James Comey, over whether or not to reauthorize some sort of surveillance program. Comey, Ashcroft, and then FBI Director Robert Mueller all threatened to resign over the issue, and eventually, we were told, President Bush overruled Gonzales and Card. We knew at the time that the dispute was over domestic surveillance and whether or not it was legal. More recently, it came out that it was over domestic collection of internet/email metadata. This was a program similar to the phone metadata program that was revealed by Ed Snowden, but for email/internet information.

However, in response to a FOIA lawsuit filed by the NY Times, late on Friday, the government declassified some more information about what happened, and it appears that George W. Bush tried to first retroactively "legalize" this pretty clearly unconstitutional domestic surveillance, by saying that he'd always meant that while the NSA could sweep up all metadata, it didn't technically "acquire" it until it did a search on it. Again, this is in direct contrast to what most people thought the law (and the 4th Amendment) says the government could do.

This happened on March 11th, the day after the hospital showdown. President Bush signed a new authorization for the mass surveillance of internet records, but first decided that the White House Counsel, Gonzales, could certify it by himself, rather than having the Attorney General sign it, as in the past. This new authorization, though, directly claims that the President can simply override the law, including the Foreign Intelligence Surveillance Act, which was put in place to limit the Executive Branch's ability to spy on Americans in the first place. Then there's the added language saying that the information is only actually "acquired" when its searched for even though it has already "retained" all the data. In other words, to get around the whole Constitution, Bush apparently just redefined the word acquire. And, to make this all the more obnoxious, while this language was only included for the first time on March 11th, the authorization claimed that Bush had really meant this to be the case all along. In short, the day after being told that the surveillance on Americans' internet metadata was likely unconstitutional, President Bush (though put together by Dick Cheney's top legal beaver David Addington) decided to fix all that by signing a new authorization that redefined a basic English word ("acquire") and then retroactively say that this new definition applied backwards on all previous authorizations to spy on Americans, pretending that this magic incantation suddenly made it all Constitutional.

Apparently these legal shenanigans were enough to make then NSA Director Michael Hayden perfectly happy to keep spying on Americans in violation of both the FISA law and the Constitution. This whole thing seems pretty horrific all around. The whole point of FISA was to restrict the government from spying on Americans. And, yes, we know that the past two administrations have basically tapdanced their way around that, but now we're getting more details on exactly how. It starts with John Yoo insisting that the President can basically do whatever the fuck he wants because it's "wartime" (never mind that Congress never officially declared war...), and then that the President can just override FISA because he says so. Then, let's add into that the fact that the President (with help from David Addington) can apparently just redefine plain English words, in order to make illegal and unconstitutional surveillance of Americans appear legal, but, even more crazy, is that he can claim this new definition applies retroactively, after people realize that they may be on the hook for a few years worth of unconstitutional surveillance.

And, again, the folks who did all this keep telling us that we should just "trust them" because they're doing everything to keep us safe.

There are some things that it's entirely reasonable to keep secret if you're a government. But your secret definition of a law that anyone can read -- as well as your actions retroactively pushing that unique definition back historically, do not seem like the kinds of things that should be kept secret.

Filed Under: 4th amendment, alberto gonzales, andy card, david addington, george w. bush, internet metadata, james comey, john yoo, metadata, nsa, privacy, retroactive, richard ashcroft, secret interpretation, secret law, surveillance

Canadian Police Chiefs: 'RESOLVED: The Warrant Requirement For ISP Subscriber Data Makes Our Job Harder. Please Fix.'

from the WHEREAS-whine-complain-bitch-moan dept

Canada's law enforcement agencies are still enduring the growing pains of having to respect the privacy and civil rights of Canadian citizens. It's apparently killing them.

At the peak of their power, Canadian law enforcement agencies were asking for ISP subscriber data every 27 seconds. Nearly 1.2 million requests were made in in 2011 alone. That number likely increased over the next couple of years before a Supreme Court decision brought this harvesting to a halt with the introduction of a warrant requirement in 2014 . Prior to that, the only thing keeping Canadian cops from requesting data at an even faster rate was the "five minutes of paperwork" occasionally demanded of them.

Since the warrant requirement went into effect, the Royal Canadian Mounted Police have adopted two tactics to deal with the additional stipulations:

1. Complaining about it (using graphic child abuse imagery, of course).

2. Tossing cases.

Can't win. Won't try. That's the indomitable law enforcement spirit officials are always praising when asking for donations and votes.

The Canadian law enforcement community is now deploying the third prong of its attack on the inconvenience of securing warrants: a strongly-worded resolution backed by the collective power of the Canadian Association of Chiefs of Police. (h/t Jordan Pearson at Vice)

According to the CACP, the government owes Canadian law enforcement immediate access to subscriber information at all times. The resolution begins with this assertion, which everyone is apparently supposed to treat as an long-acknowledged fact.

WHEREAS law enforcement requires real-time, or near real-time access to basic subscriber (customer name and address) information (BSI) as it relates to telecommunications’ customers for investigative reasons…

It then points out what the Supreme Court decision changed (officially recognized Canadian citizens' privacy interest in their own subscriber data) before complaining that ISPs are getting all uppity with them when they show up without a warrant.

WHEREAS since the Spencer decision, the telecommunications companies refuse to provide any basic subscriber information (BSI) in the absence of an exigent circumstance, or a judicial warrant or order, even where there exists no reasonable expectation of privacy…

Well, gee, if we leave the decision of where the "expectation of privacy" lies in the hands of law enforcement, we get what we already got: subscriber data requests every 27 seconds. So, we know law enforcement can't be trusted to make that decision.

And it's not the ISPs place to make "expectation of privacy" determinations. These companies should do what they're doing: demand warrants and court orders. But law enforcement views this as a form of obstruction, albeit a form supported by a court decision.

The resolution's next "WHEREAS" tosses out another assertion everyone's just supposed to agree with, because who's more trustworthy than a group of cops?

WHEREAS there exists no lawful authority designed specifically to require the provision of basic subscriber information, and the problems posed by this gap in the law are particularly acute where there exists no reasonable expectation of privacy in that information.

This complaint/assertion is basically: "We can't make ISPs do anything the law no longer compels them to do." That's kind of how laws are supposed to work. So, the problem is the ruling... and the solution is a legislative undoing of the court's ruling.

THEREFORE BE IT RESOLVED that the Canadian Association of Chiefs of Police supports the creation of a reasonable law designed to specifically provide law enforcement the ability to obtain, in real-time or near real-time, basic subscriber information (BSI) from telecommunications providers.

BE IT RESOLVED: legislative time machine. Law enforcement wants to go back to its pre-Supreme Court decision form, where demands were made (and met) quickly and with a minimum of paperwork or privacy considerations. Nowhere in the in-depth explanation of its "problem" and proposed resolution does it discuss a more limited framework for warrantless requests. The CACP wants the legislature to undo the terrible wrong it has suffered at the hands of the Supreme Court. There are no compromises offered. Canadian cops simply want to be able to freely demand subscriber info without having to jump through any privacy-protecting hoops.

Filed Under: canada, isp, law enforcement, metadata, privacy, subscriber info, warrants

Appeals Court Strikes Down Ruling Finding NSA Phone Records Collection Unconstitutional

from the well-that's-too-bad dept

Back in December of 2013, judge Richard Leon of the DC district court, ruled that the NSA's bulk metadata collection under Section 215 of the PATRIOT Act was unconstitutional and issued an injunction against it (though, recognizing the inevitable appeal, Judge Leon stayed the injunction). This was in the case brought by Larry Klayman and FreedomWorks.

Leon's ruling was detailed and thorough... but the DC circuit appeals court has overturned it and sent it back to the lower court, focusing mainly on the "standing" question that has been raised in basically every case against NSA surveillance. In short, the government says "if you can't prove that we spied on you directly, then you can't sue us over our spying on everyone generally." That seems sketchy for all sorts of reasons, and Judge Leon, in his original ruling pointed out how ridiculous it was, mocking the government's reliance on the Supreme Court ruling in "Clapper" (a case against James Clapper) where the Supreme Court basically agreed that you needed more evidence to show you had standing. Of course, that ruling only happened after the US Solicitor General lied to the Supreme Court about how defendants arrested using such data would be told how it was collected. Besides, here, Judge Leon noted, there was plenty of evidence that everyone's information was being collected.

Straining mightily to find a reason that plaintiffs nonetheless lack standing to challenge the metadata collection, the Government argues that Judge Vinson's order names only Verizon Business Network Services ("VBNS") as the recipient of the order, whereas plaintiffs claim to be Verizon Wireless subscribers. The Government obviously wants me to infer that the NSA may not have collected records from Verizon Wireless (or perhaps any other non-VBNS entity, such as AT&T and Sprint). Curiously, the Government makes this argument at the same time it is describing in its pleadings a bulk metadata collection program that can function only because it "creates an historical repository that permits retrospective analysis of terrorist-related communications across multiple telecommunications networks, and that can be immediately accessed as new terrorist-associated telephone identifiers come to light."

[....] Put simply, the Government wants it both ways. Virtually all of the Government's briefs and arguments to this Court explain how the Government has acted in good faith to create a comprehensive metadata database that serves as a potentially valuable tool in combating terrorism--in which case the NSA must have collected metadata from Verizon Wireless, the single largest wireless carrier in the United States, as well as AT&T and Sprint, the second and third-largest carriers.... Yet in one footnote, the Government asks me to find that plaintiffs lack standing based on the theoretical possibility that the NSA has collected a universe of metadata so incomplete that the program could not possibly serve its putative function. Candor of this type defies common sense and does not inspire confidence!

But, the appeals court just doesn't buy it. From the opinion by Judge Janice Brown:

The record, as it stands in the very early stages of this litigation, leaves some doubt about whether plaintiffs’ own metadata was ever collected. Plaintiffs’ central allegation is that defendants “violated the Fourth Amendment to the U.S. Constitution when they unreasonably searched and seized and continue to search Plaintiffs’ phone records . . . without reasonable suspicion or probable cause.” ... Plaintiffs have supported this claim with specific facts, notably: (1) The NSA operates a bulk telephony-metadata collection program; and (2) on April 25, 2013, the FISC issued an order requiring Verizon Business Network Services to produce its subscribers’ call detail records to the NSA on a daily basis from April 25, 2013 to July 19, 2013. However, plaintiffs are Verizon Wireless subscribers and not Verizon Business Network Services subscribers. Thus, the facts marshaled by plaintiffs do not fully establish that their own metadata was ever collected.

Judge Brown admits that Judge Leon explains why the government's own statements make it clear that its metadata collection goes beyond just Verizon Business Network Services, but doesn't think it's enough evidence. She also highlights how there is at least some more substantial evidence than in the Clapper/Amnesty International case that the Supreme Court ruled on, but still doesn't find it enough:

However, the burden on plaintiffs seeking a preliminary injunction is high. Plaintiffs must establish a “substantial likelihood of success on the merits.” ... Although one could reasonably infer from the evidence presented the government collected plaintiffs’ own metadata, one could also conclude the opposite. Having barely fulfilled the requirements for standing at this threshold stage, Plaintiffs fall short of meeting the higher burden of proof required for a preliminary injunction.

Instead, Judge Brown says that the lower court could try to determine if it's appropriate for Klayman/Freedomworks to be allowed to conduct discovery with the government to obtain more evidence that his phone record info was collected -- while admitting that's unlikely because "secret program" and all that.

On remand it is for the district court to determine whether limited discovery to explore jurisdictional facts is appropriate.... Of course, I recognize that, in order for additional discovery to be meaningful, one of the obstacles plaintiffs must surmount is the government’s unwillingness to make public a secret program.... It is entirely possible that, even if plaintiffs are granted discovery, the government may refuse to provide information (if any exists) that would further plaintiffs’ case. Plaintiffs’ claims may well founder in that event. But such is the nature of the government’s privileged control over certain classes of information. Plaintiffs must realize that secrecy is yet another form of regulation, prescribing not “what the citizen may do” but instead “what the citizen may know.”... Regulations of this sort may frustrate the inquisitive citizen but that does not make them illegal or illegitimate. Excessive secrecy limits needed criticism and debate. Effective secrecy ensures the perpetuation of our institutions. In any event, our opinions do not comment on the propriety of whatever privileges the government may have occasion to assert.

Got that? Excessive government secrecy sucks, but, hey, what can you do?

In a separate ruling, Judge Stephen Williams also says there's no standing, giving even more deference to the Supreme Court's ruling in the Clapper/Amnesty International case. While at least Judge Brown was willing to distinguish the two, Judge Williams sees no such distinction:

Here, the plaintiffs’ case for standing is similar to that rejected in Clapper. They offer nothing parallel to the Clapper plaintiffs’ evidence that the government had previously targeted them or someone they were communicating with (No. 3 above). And their assertion that NSA’s collection must be comprehensive in order for the program to be most effective is no stronger than the Clapper plaintiffs’ assertions regarding the government’s motive and capacity to target their communications

In fact, Judge Williams takes the odd position of adding in possible reasons why the NSA might not be collecting everyone's metadata to show why such an inference is unfounded:

The strength of plaintiffs’ inference from the government’s interest in having an effective program rests on an assumption that the NSA prioritizes effectiveness over all other values. In fact, there are various competing interests that may constrain the government’s pursuit of effective surveillance. Plaintiffs’ inference fails to account for the possibility that legal constraints, technical challenges, budget limitations, or other interests prevented NSA from collecting metadata from Verizon Wireless. Many government programs (even ones associated with national defense) seem to be calibrated or constrained by collateral concerns not directly related to the program’s stated objectives, such as funding deficiencies, bureaucratic inertia, poor leadership, and diversion to non-defense interests of resources nominally dedicated to defense. It is possible that such factors have operated to hamper the breadth of the NSA’s collection.

Basically, we can't assume that Verizon Wireless metadata was collected because, you know, maybe it wasn't. Maybe "bureaucratic inertia" meant the NSA really didn't care about Verizon Wireless. Who can really say?

The only "dissent" on the three judge panel comes from Judge David Sentelle, who says he basically agrees with absolutely everything Judge Williams says except for the idea that the case should be remanded to the district court for further discovery, saying the entire case should be dismissed outright.

Plaintiffs have not demonstrated that they suffer injury from the government’s collection of records. They have certainly not shown an “injury in fact” that is “actual or imminent, not conjectural or hypothetical.” ... I agree with the conclusion of my colleagues that plaintiffs have not shown themselves entitled to the preliminary injunction granted by the district court. However, we should not make that our judicial pronouncement, since we do not have jurisdiction to make any determination in the cause. I therefore would vacate the preliminary injunction as having been granted without jurisdiction by the district court, and I would remand the case, not for further proceedings, but for dismissal.

[....]

Without standing there is no jurisdiction. Without jurisdiction we cannot act.... Therefore, I agree with my colleagues that the issuance of the preliminary injunction was an ultra vires act by the district court and must be vacated. However, I believe we can do no more. I would remand the case for dismissal, not further proceedings.

So... that's not great. However, it also creates a pretty clear circuit split between the DC Circuit and the 2nd Circuit, which you may recall ruled that the ACLU and others had standing in a similar lawsuit. Given this clear circuit split, perhaps the Supreme Court can actually be persuaded to take up the case and fix the mistake it made in the Clapper case a couple years ago...

Filed Under: doj, larry klayman, mass surveillance, metadata, nsa, phone records, section 215, standing, surveillance

Australian Reporter Makes A Year's Worth Of His Metadata Available For Public To Rummage Through

from the brave-man dept

One of the key realizations over the last few years, especially post-Snowden, is that there is no such thing as "just metadata". Collecting metadata is not only as bad as collecting content, it is arguably worse. Whereas content must be parsed and understood -- something that is still quite hard to do well in an automated fashion -- metadata by definition is already classified and tagged. That makes it very easy to combine with other information, and in a way that scales, to reveal extremely intimate details about the person it refers to.

Techdirt has already run a couple of stories that demonstrate this. Back in 2011, the German politician Malte Spitz obtained his own phone location data, and cross-referenced it with his Twitter feeds, blog entries and other digital information to give a remarkably full picture of his daily life. More recently, Ton Siedsma went even further, allowing researchers to analyze all of the metadata generated by his phone -- with a predictably detailed picture of Siedsma emerging as a result.

Now a brave reporter from the Australian Broadcasting Corporation, Will Ockenden, has requested and made available a year's worth of his outgoing call and SMS records, and six months of his data sessions on a Web page:

All in all, this simple data request returned 13,000 individual records. There were 1,500 outgoing phone calls and SMSes but the vast majority -- 11,200 records -- were data sessions, complete with the time and date his phone connected to the mobile network and which cell tower it connected to.

In other words, by carrying a smartphone Will was in effect carrying a tracking device that logged roughly where he was every 20 minutes of every day, on average.

Government departments, police and security agencies have access to all the data Will received about himself -- and more -- without the need for a warrant.

As the article points out, this exercise has a special relevance for Australians because of a new data retention law that has been brought in this year. Like many other leaders doing the same, the Australian Prime Minister tried to soothe people's fears about this manifest intrusion into their private lives using the standard "it's just metadata" argument:

"We're talking here about metadata; we're not talking here about the content of communications," Prime Minister Tony Abbott said in February. "It's just the data that the system generates."

What's particularly valuable about this latest provision of real-life metadata is that the public can explore for themselves how much it reveals, by playing with the interactive tools provided on the site:

Over the coming days we're going to use these tools to delve deeper into Will's data and report back on what we discover.

We'll be writing about what we can infer about Will, as well as how police and other agencies might use data like this.

But we want your help. We're releasing these exploratory tools so you can tell us what you're able to find out about Will. You can also get the complete dataset to explore yourself.

This is a great way to get across to people that there is no such thing as "just metadata". Let's hope it encourages Australians to start questioning the huge data grabs of highly personal information being carried out by their government, along with its bogus assurances on privacy.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: australia, data retention, metadata, privacy, revealed, will ockenden

Intel Officials' Claims That NSA Couldn't Access Majority Of Cellphone Records Apparently Bogus

from the misrepresenting-the-haul dept

The recent Snowden documents published by the New York Times and ProPublica confirm the close relationship between AT&T and the NSA, which would explain the deafening silence the company issued in response to the first few months of leaks. (Such "partnerships" likely exist with Verizon and other providers, although nothing has been directly confirmed by leaked documents, and such partnerships may have done a bit of "dissolving" shortly after the leaks began.)

But the documents also highlighted the difference between what NSA officials claimed they were getting and what they were actually getting from telcos. In early 2014, officials claimed they were only obtaining between 20-30% of domestic call records. According to unnamed "current and former officials," the explosion of cellphone use was leaving the NSA's bulk collection programs in the dust.

These documents show there's a huge discrepancy between the unofficial "official" statements and the NSA's actual capabilities, as the ACLU's Kade Crockford points out.

The New York Times reports on documents disclosed by former NSA contractor and whistleblower Edward Snowden:

"In 2011, AT&T began handing over 1.1 billion domestic cellphone calling records a day to the N.S.A. after “a push to get this flow operational prior to the 10th anniversary of 9/11,” according to an internal agency newsletter. This revelation is striking because after Mr. Snowden disclosed the program of collecting the records of Americans’ phone calls, intelligence officials told reporters that, for technical reasons, it consisted mostly of landline phone records."

I must quibble a bit with the New York Times excellent reporting here, only to suggest that what's "striking" about the discrepancy between what journalists reported and the truth isn't the fact that the NSA would lie to journalists. What's striking is that journalists continue to print official, often anonymous claims about government surveillance programs without a shred of evidence that those claims are true.

This has long been the problem with journalists' reliance on "unnamed government sources." Without a name to attach the statement to, no one can be held accountable for lying to the American public. While many sources would not comment at all without the protection of anonymity, the statements issued are seldom questioned by entities with an obligation to challenge anonymous assertions.

On the other hand, emptywheel's Marcy Wheeler points out these claims may have an element of truth, but only because Snowden's leaks and problematic cell location data (which isn't specifically covered by Section 215) was preventing the agency from collecting all it wanted to, or perhaps all it used to.

We know from the Congressional notice AT&T was willing to strip [location data]. For a lot of reasons, it’s likely Verizon was unwilling to strip it.

This is one of the possible explanations I’ve posited for why NSA wasn’t getting cell data from Verizon, because any provider is only obliged to give business records they already have on hand, and it would be fairly easy to claim stripping the cell location data made it a new business record.

Which is another important piece of evidence for the case made against AT&T in the story. They were willing to play with records they were handing over to the government in ways not required by the law.

Though who knows if that remain(ed) the case? To get to the 30% figure quoted in all the pieces claiming NSA wasn’t getting cell data, you’d probably have to have AT&T excluded as well. So maybe after the Snowden releases, they, too, refused to do things they weren’t required to do by law...

So, it could very well be that the NSA wasn't getting all the cell records it wanted to, making these claims mostly factual. But the Wall Street Journal and New York Times both attribute quotes to "former officials" as well, which would include officials in place prior to the Snowden leaks. If the leaks resulted in a sudden reluctance to provide these records, it would only have occurred after June 2013. The questionable statements were made in the first few months of 2014. That's not much of a gap, especially if former officials are speaking from their personal experience.

Maybe the NSA was only getting 20-30% of what it was seeking. Or maybe it only wanted to give that impression. Nothing about the statements reflect a sudden downturn in collections. Instead, they portray it as an ongoing problem. The underlying issue is the secrecy of surveillance programs, which leads to statements that can't be confirmed (or refuted) until evidence is provided. And these officials aren't going to hand out this info. It has to come from whistleblowers and leakers. The government can skate by on lies and misperceptions, especially when national security is involved.

Filed Under: lies, metadata, mobile phones, nsa, partnership, phone records, section 215, surveillance
Companies: at&t