Sen. Feinstein Calls For Section 702 Reforms, No 'Forever' Reauthorization

from the also-applying-for-an-advisory-position-at-the-EFF dept

I don't want to view this as a disingenuous move prompted by partisanship. I also don't want to view this as the belated realization that broad surveillance powers aren't exactly something you want to hand over to your political enemies. But, given the circumstances, it's hard to believe these statements by longtime surveillance statist Dianne Feinstein are anything but politically-motivated:

Lost in this week’s outcry over the latest presidential controversy was a very important hearing on the future of a key intelligence program: Section 702 of the Foreign Intelligence Surveillance Act. This program, which involves the collection of the content of internet and phone communications of foreigners outside the United States, is a vital intelligence tool.

Section 702 has been a valuable part of our counterterrorism efforts and I support its continuation, but I believe a sunset provision and key reforms should be considered.

This comes in response to (Republican) Senator Tom Cotton's legislative proposal to give Section 702 a clean re-auth FOREVER. Would this have been handled differently if someone more politically-aligned with Feinstein had proposed it? We can only speculate.

But that's not all Feinstein is proposing. She also wants to codify the NSA's voluntary shutdown of its "about" collection. As was noted here when the announcement was made, there's nothing stopping the NSA from deciding it wants to start incidentally collecting US persons communications on a mass scale, and I'm sure it has plenty of vague national security reasons for doing so. Amending the FISA Amendments Act before re-auth would hit the NSA with a federal "no backsies" stipulation that would ensure greater privacy protections for Americans' internet communications.

What's difficult to track down is any sort of Road to Damascus conversion point for Sen. Feinstein. Even dealing with the CIA's intrusiveness/abusiveness during the compiling of the Torture Report failed to cool her enthusiasm for maximum spying and minimal oversight. I'm happy to see someone who pulls this much IC weight calling for these reforms, but also suspicious these would not have materialized with Clinton in the Oval Office or the Democrats holding a majority in Congress.

But, we'll take what we can get. The downside is, of course, the current president's desire to push through a 702 re-auth with zero discussion and a hearty enthusiasm for any form of spying that isn't directed at him or his inner circle.

Filed Under: dianne feinstein, nsa, section 702, surveillance

Congress Getting Pissed Off Over Failure Of Intel Community To Reveal How Many Americans Are Being Spied On

from the outright-lies dept

As we've pointed out for many, many years, Senator Ron Wyden has been banging the drum, asking the Director of National Intelligence to reveal how many Americans are having their communications swept up under Section 702 of the FISA Act. We have posts going back to 2011 of Wyden asking for a number and being stonewalled. At the time, many tried to brush it off as nothing to be concerned about -- after all, the "F" in FISA is supposed to stand for "Foreign" and so it was assumed (incorrectly) that Americans' communications were mostly unlikely to be caught up in the matter. Of course, as we now know quite well, that's not even remotely true. Between the Snowden revelations and other declassified FISA court orders, we know that tons of Americans had their communications swept up, without any kind of warrant. Throughout all of this time, Wyden kept asking that question over and over again, without getting any answers. Last year, others finally joined in, with a large bipartisan group from the House Intelligence Committee all (finally!) asking the same question.

Eventually, late last year (after years of stalling), then Director of National Intelligence, James Clapper, said that his office would deliver an estimate to Congress. Indeed, the House Judiciary Committee worked with Clapper's office to set up the parameters for that number, noting that it needed to be provided "early enough to inform the debate" about the renewal of Section 702, and had to be provided in a format that could be provided to the public, rather than kept in secret. That estimate never came. This issue came up again during the hearings for Clapper's replacement, Dan Coats, who also said he would try to get Congress a number. Specifically, he told Wyden: "I'm going to do everything I can to work with Admiral Rogers in NSA to get you that number."

As we noted, two months ago, another bipartisan letter was sent to Coats, this time signed by both the chair of the committee, Bob Goodlatte, and the ranking member, John Conyers. That generally means that the Committee is getting serious about stuff. In the letter, they noted that they were still waiting on Coats to deliver this number and expected to see it soon.

Then, yesterday, there was a public Senate Intelligence Committee hearing over the issue of the 702 renewal. While most of the press is focused on the refusal of those testifying to say whether President Trump had spoken to them about various investigations concerning Russia, there was something else concerning that was brought up. Coats, despite his earlier promises and the promises of his office, is now saying that it would be impossible to give a number.

Not surprisingly, for the folks in Congress who have been insisting on getting this number (and giving it to the public), this... did not sit well. When it was Senator Wyden's turn to question the panel, he went off on Coats for going back on his word.

This morning you went back on that promise and you said that even putting together a sampling, a statistical estimate, would jeopardize national security. I think that is a very, very damaging position to stake out.

Later in that exchange, there was this exchange (which, if you watch it, involved both men being fairly testy with each other):

Wyden: Can the government use FISA 702 to collect communications it knows are entirely domestic?

Coats: Not to my knowledge. It would be against the law.

As Marcy Wheeler points out, that exchange may prove to be similar to Wyden's now infamous question to Coats' predecessor, Clapper, about whether or not the NSA collected information on millions of Americans (the "not wittingly" response, which was later shown to be completely bogus). Wheeler points out that for Coats to actually believe that, it would appear that he doesn't know how 702 is actually used, even though he signed a memo about this very thing. Wheeler points to the recent FISC opinion reauthorizing 702 data collection that states that if the Director of the NSA signs a waiver for all of the domestic collections, then the NSA can still collect a wholly domestic communication under 702. That FISC opinion cites a March 30th memo that Coats would have signed as the justification for this argument. So for him to now say that it's illegal for the very thing his own memo from March says is okay... seems like a serious problem.

And Wyden's not the only one upset about this. Since this was a Senate hearing, Rep. Conyers wasn't there, but he put out a blistering statement calling Coats' statements "unacceptable."

The intelligence community has—for many months—expressly promised members of both parties that they would deliver this estimate to us in time to inform our debate on the reauthorization of Section 702. As late as last August, we had discussed and approved the specific methodologies that the NSA might use to make good on their promise.

Today, Director Coats announced that the estimate is ‘infeasible’ and will not be forthcoming. I find that outcome unacceptable.

Over the course of the last year, we believed we had worked past the excuses we are offered today. The nation’s leading civil liberties organizations see no threat to privacy in this project, and have said so publicly. The agencies demonstrated to us how they might perform this analysis without significant diversion of resources. I am deeply disappointed in a return to these old talking points.

Section 702 is built on trust. It will be more difficult to find that trust as we move forward with the debate.

As we discussed earlier this week, a bunch of Senators have already been pushing a permanent renewal of 702 with no changes at all. As the debate heats up on the renewal of Section 702 ahead of its expiration later this year, we're going to need Congress to hold the intelligence community to its promise to reveal at least some data on how these programs impact Americans' communications.

Filed Under: congress, dan coats, estimate, john conyers, nsa, odni, ron wyden, section 702, surveillance

Senator Tom Cotton Introduces Bill That Would Renew Section 702 Forever With Zero Changes

from the shut-up,-they-legislated dept

The debate over the renewal of Section 702 surveillance continues, but a group of legislators is looking to short-circuit the discussion. Senator Tom Cotton and a whole bunch of Republicans have introduced a bill that would ensure this discussion is never raised again. [h/t Julian Sanchez]

Senator Tom Cotton (R-Arkansas) along with Senators Richard Burr (R-North Carolina), Jim Risch (R-Idaho), Marco Rubio (R-Florida), Susan Collins (R-Maine), Roy Blunt (R-Missouri), James Lankford (R-Oklahoma), John Cornyn (R-Texas), John McCain (R-Arizona), Thom Tillis (R-North Carolina), Pat Roberts (R-Kansas), Lindsey Graham (R-South Carolina), John Thune (R-South Dakota), and David Perdue (R-Georgia) today introduced legislation making Section 702, and the entirety of Title VII, of the Foreign Intelligence Surveillance Act (FISA) permanent.

This followed Cotton's statements on the Senate floor, where he used recent attacks in the UK to make incoherent points about domestic security.

The attacks in London last weekend exposed in a matter of minutes just how vulnerable our free societies truly are. All it takes is a van or a knife and an unsuspecting bystander to turn a fun night out on the town into a horrific nightmare. Course, we shouldn't need any reminders, but let me give one yet again: We are at war with Islamic extremists. We have been for years, and, I'm sorry to say, there's no end in sight. It's easy to forget this as we go about our daily lives, but our enemies have not-and they will not. They've never taken their eyes off the ultimate target either: the United States.

Attacks in other countries are apparently just pre-game warmups for terrorists. The only way to prevent a domestic attack is to never ask questions about Section 702 again, apparently. If we don't trust our government to respect our privacy and civil liberties, it's not because the NSA constantly abused its Section 702 collection programs (and then hid these abuses from its oversight). No, the real villain here is the man who exposed this abuse to the general public.

Unfortunately, this and other programs were distorted in the public debate by a traitor, disgruntled ex-NSA contractor Edward Snowden, who now sits in the warm embrace of Russian intelligence services. And ever since his very damaging leak of classified material a few years back, many Americans have grown doubtful of these programs-and section 702 in particular.

I love it when someone describes the dumping of internal documents as "distorting." It underlines the speaker's desire to have the Great Unwashed remain in the dark while the government expands its collection capabilities and surveillance powers.

Cotton's Senate statement goes on to make it clear that nothing but a "forever" renewal will do, while handwaving away NSA abuses with meaningless phrases about privacy protections.

It's true that this program occasionally does collect information about American citizens-and that will be true of any attempt to stop any kind of homegrown terrorism. But if you're concerned about protecting Americans' privacy rights, then you should support extending this program. It puts in place a host of privacy protections to scrub raw intelligence of any unnecessary identifying information. To allow this program to expire on December 31 would hurt both our national security and our privacy rights.

That's why today I'm introducing a bill that would reauthorize section 702 permanently, as is, with no changes.

If nothing changes, then the "host of privacy protections" simply don't exist. The NSA itself made the biggest step towards fixing its routine, decade-long run of privacy violations by dropping the "about" program. A clean re-auth adds nothing to anyone's privacy. A forever re-auth would ensure this status quo in perpetuity.

As astounding as Cotton's contradictory assertions are, they're topped by Sen. Lindsey Graham. Earlier in the day, Graham was reported to have stated he would not support the reauthorization of this surveillance program because it could be "politically manipulated." And yet his name appears in the list of legislators pushing this bill.

So here we are, with the debate just officially beginning in the Senate and already surveillance proponents are making it clear they're not interested in discussing Section 702. Ever.

Filed Under: nsa, oversight, section 702, surveillance, tom cotton

Appeals Court Revives Wikimedia's Lawsuit Against The NSA

from the doesn't-'collect-it-all'-mean-'collect-it-all?' dept

Back in 2015, Wikimedia's lawsuit against the NSA -- filed with several other plaintiffs and with the help of the ACLU -- was tossed out by the district court. Wikimedia argued it was illegally the subject of NSA upstream surveillance, thanks to the nature of this Section 702 collection. Wikimedia's reach is global, making it highly likely the NSA was gathering its content and communications while snagging data off internet backbones.

To further demonstrate the probability of this happening, Wikipedia submitted leaked Snowden documents, including an NSA presentation slide that contained Wikimedia's logo.

>

No dice. The district court said Wikimedia had no standing to pursue these claims, even with the unexpected buttress of leaked NSA documents. The court went even further, disabusing Wikipedia of its "99.9999999999% certainty" notion that the NSA had illegally harvested at least one of its trillions of internet transactions. In all, it was a very ugly day for Wikimedia and its lawsuit.

Fortunately, for Wikimedia, its lawsuit has been revived on appeal. The Fourth Circuit Appeals Court is far more amenable to Wikimedia's claims, finding them to be more credible than the lower court determined. From the opinion [PDF]:

[A]t least at this stage of the litigation, Wikimedia has standing to sue for a violation of the Fourth Amendment. And, because Wikimedia has self-censored its speech and sometimes forgone electronic communications in response to Upstream surveillance, it also has standing to sue for a violation of the First Amendment.

The court doesn't necessarily treat all of Wikimedia's allegations as true, but finds it has handed over enough background evidence to give it standing to pursue its First and Fourth Amendment claims.

But this revival is limited to Wikimedia and only some of its claims. The seven other plaintiffs aren't invited to the next district court round. A lack of produced evidence appears to have killed off the "dragnet" claims raised by the plaintiffs (which includes Wikimedia). The other defendants have a much smaller web footprint, making it less plausible their communications were subjected to upstream collection by the NSA. The only way those claims would be plausible is if the court found the "dragnet" assertions plausible… which it doesn't.

The Dragnet and Wikimedia Allegations share much in common. Because each alleges the same particularized and ongoing cognizable injuries, our analysis of the injury-in-fact, traceability, and redressability elements of Article III standing with respect to the Wikimedia Allegation also applies here. But there’s a key difference in the scope of the two allegations. In the Dragnet Allegation, Plaintiffs must plausibly establish that the NSA is intercepting “substantially all” text-based communications entering and leaving the United States, whereas it’s sufficient for purposes of the Wikimedia Allegation to show that the NSA is conducting Upstream surveillance on a single backbone link. Because Plaintiffs don’t assert enough facts about Upstream’s operational scope to plausibly allege a dragnet, they have no Article III standing.

The difference between the two claims is one of numbers. Wikimedia only had to show its traffic traveled across enough internet backbones to plausibly claim harvesting from any one of them would result in interception of its communications. The "dragnet" argument claims the NSA is harvesting almost everything that travels across multiple backbones. The majority finds this assertion unlikely. The dissent, however, says the same arguments Wikimedia put forth to demonstrate the probability of illegally-intercepted communications lend credence to the "dragnet" argument simply because that's how internet traffic works.

Plaintiffs have plausibly alleged that the NSA surveils most backbone links because — based on the technical rules governing internet communications — the agency cannot know which link the communications it targets will traverse when they enter or leave the United States. The path that packets take along the internet backbone is determined dynamically based on unpredictable conditions. Thus, a communication sent by a surveillance target can enter the United States through one backbone link, but an immediate response returned to the surveillance target can traverse a different backbone link. Similarly, communications sent by a surveillance target at different times or locations can traverse different backbone links. Given this technical limitation, the government’s disclosure that the NSA seeks to “comprehensively acquire communications that are sent to or from its targets,” J.A. 49, renders Plaintiffs’ allegation plausible. If the NSA cannot know which backbone link its targets’ internet communications will traverse, then the only way it can comprehensively acquire its targets’ communications is by surveilling virtually every backbone link.

It's a good point but it's not enough to save the rest of the plaintiffs, which include the National Association of Criminal Defense Lawyers, Human Rights Watch, and Amnesty International. Perhaps a further examination of Wikimedia's arguments by the lower court will aid these plaintiffs in their future legal endeavors.

Filed Under: 4th circuit, nsa, section 702, standing, surveillance, upstream collection
Companies: wikimedia

Inspector General's Report Shows Section 702 Isn't The Only Thing Being Abused By The NSA

from the does-the-NSA-even-understand-the-concept-of-'internal-controls?' dept

There's more than Section 702 up for renewal at the end of this year. Most of the attention has been focused on Section 702 because it's used most frequently for internet communications and data collections. Not only does the NSA make use of this collection, but other agencies (FBI, CIA) are allowed unminimized access to NSA 702 data stores. With this many agencies reliant on NSA communications interception, the sales pitches have been focusing on this particular authority.

But there are other surveillance authorities under Title VII: Sections 704 and 705, which allow the NSA to target US persons located outside of the country. The numbers put up by these sections aren't as impressive as Section 702's (~3,000 selectors for 151 million records), but 704/705 isn't supposed to result in incidental collection. It's a US spy agency actively spying on US citizens.

According to Marcy Wheeler, these collections only target about 80 people. But protections for US citizens aren't supposed to evaporate just because they've travelled out of the country. Agencies seeking to use these authorities must obtain a FISA court order to collect communications and data. Section 704 covers new requests for collections and Section 705 allows for "streamlined" requests/renewals for orders covering US persons already targeted by the agency.

The NSA may be compliant in terms of obtaining court orders, but the 2016 Inspector General's report [PDF] released last week shows the agency has done almost nothing to prevent abuse of its collections.

At the time of our review, the Agency could not reliably identify queries performed using selectors associated with FAA 704 and 705(b) targets because the SIGINT databases did not uniformly send records in the correct format to [REDACTED] (NSA's SIGINT auditing and logging system).

[...]

We identified [REDACTED] queries that were not compliant with the FAA 704 and 705(b) targeting and minimization procedures. [LONG REDACTION] We identified another [REDACTED] queries that were performed outside the targeting authorization periods in E.O. 12333 data, which is prohibited by the E.O. 12333 minimization procedures. We also identified [REDACTED] queries performed using USP slectors in FAA 702 upstream data, which is prohibited by the FAA 702 minimization procedures.

According to the NSA, the problem is its own software. These collections are obtained beforehand. The FISA orders only limit what analysts can search for in the collected data. Everything apparently funnels into one big pile, and it's up to analysts to search according to the controlling statute (702, 704, 705, or Executive Order 12333). The problem is the NSA's system immediately gives access to "all authorities to which analysts are entitled access." Someone who's supposed to be performing a more limited search under 704 may not take steps to remove 702 collections from the queried data or add the limiters needed to ensure proper minimization of US persons' communications.

That's already a terrible way to handle the querying of NSA collections. The default is everything, and affirmative, unprompted steps must be taken by analysts to ensure their queries are lawful. Making it worse is the issue the IG first mentioned: the NSA has no system for tracking possibly-prohibited searches.

Then there's this wrinkle in the statutory authorities the NSA seems unable to comply with: the NSA cannot engage in domestic surveillance so its targeting of US persons overseas must end when the US person arrives back on US soil. Possible violations of this nature were, again, not being tracked by the NSA.

FAA 704 and 705(b) targeting and minimization procedures prohibit targeting USPs while they are in the United States. Although the Agency is not required to document [REDACTED], maintaining these records is important for securing compliance with the targeting and minimization procedures.

The upshot of this report is that the NSA has probably engaged in wholly domestic surveillance thanks to lax recordkeeping and its all-access internet communications haystack. Having to get permission from the FISA court to search collected records is an important step, but it's completely meaningless when analysts are given full access to data stores under multiple authorities and expected to "opt out" of potentially unlawful searches.

As Marcy Wheeler points out in her post about 704/705 violations, the NSA is a "dumpster fire of noncompliance." She points to a just-released opinion by FISC judge Rosemary Collyer, in which the judge notes the NSA's new 704/705 search tool (put in place in 2012) resulted in far more violations than approved searches.

NSA examined all queries using identifiers for “U.S. persons targeted pursuant to Sections 704 and 705(b) of FISA using the tool [redacted] in [redacted] . . . from November 1, 2015 to May 1, 2016.” Id. at 2-3 (footnote omitted). Based on that examination, “NSA estimates that approximately eighty-five percent of those queries, representing [redacted] queries conducted by approximately [redacted] targeted offices, were not compliant with the applicable minimization procedures.” Id. at 3. Many of these non-compliant queries involved use of the same identifiers over different date ranges. Id. Even so, a non-compliance rate of 85% raises substantial questions about the propriety of using of [redacted] to query FISA data. While the government reports that it is unable to provide a reliable estimate of the number of non-compliant queries since 2012, id., there is no apparent reason to believe the November 2015-April 2016 period coincided with an unusually high error rate.

In other words, the tool was broken from the moment it was introduced and very likely resulted in four out of every five searches being noncompliant over that four-year period. This is the sort of thing that will be glossed over during the run up to renewal, with the NSA touting its multiple layers of oversight and rigorous self-reporting as reasons it should be given extended permission to engage in future noncompliance.

Filed Under: inspector general, nsa, section 702, surveillance

NSA Boss: Section 702 Should Be Renewed Because It Helped Prove Russia Hacked Election

from the pay-no-attention-to-the-abuses-and-violations dept

The push for a smooth Section 702 renewal continues. The never-not-abused surveillance program has received some vocal support in recent weeks. Former FBI Director James Comey's Senate testimony began with his praise for Section 702, despite there being about a million investigation-related questions Senators were dying to hear answers to.

Any opening will do for promoting the NSA's internet-based collections, even with the agency voluntarily shutting down its upstream email collection because it just couldn't stop sweeping up (and searching) domestic communications. Such is the case here, with NSA boss Admiral Mike Rogers aiming to remain the commander of oceans of internet data/communications (some of it gathered under actual oceans!) for the foreseeable future. The selling point here is the popular Jeopardy category CURRENT EVENTS.

"I would highlight much, not all, much of what was in the intelligence community's assessment, for example, on the Russian efforts against the U.S. election process in 2016, was informed by knowledge we gained through (Section) 702 authority," Rogers said.

Rogers said allowing the statute to expire on Dec. 31, unless Congress votes to reauthorize it, would degrade U.S. intelligence agencies' ability to provide "timely warning and insight" on a variety of criminal and national security threats.

There is little doubt the 702 program provides all the things Rogers says it does. How could it not? The program pulls millions of communications directly from internet backbones, in addition to what it gathers with the help of service providers. It also gathers plenty of US persons' communications, the recent culling of the "about" collection notwithstanding. And it gathers tons of useless communications because that's just how the collection works: the collection continues regardless. FISA court orders just narrow the searches analysts can perform.

Even with a pro-surveillance president and a controlling party that's shown little interest in pushing back against the administration, the Section 702 renewal process isn't going to go as smoothly as the NSA (and FBI) would hope. Too many documents have been leaked and the NSA has been caught abusing the program far too often. Sure, it's great the program helped track down evidence of politically-motivated hacking, but no one has ever argued the program is useless. They've argued it violates privacy and civil liberties in bulk and no amount of "usefulness" changes that fact.

Filed Under: admiral mike rogers, nsa, renewal, russia, section 702

At Senate Hearing, Comey Hints At Expanded NSL Powers And Encryption Backdoors

from the now-has-a-president-willing-to-cater-to-his-desires dept

James Comey testified in front of the Senate Judiciary Committee today where he faced an oddly-unified bipartisan group of senators irritated with the FBI (but for different reasons). Most senators took a large amount of the their time during the first round of questions to not actually ask questions, but to express their displeasure with the Clinton email investigation and the ongoing Trump-Russia investigation.

The opening statements varied depending on the party of the senator addressing James Comey. Comey had very few answers about various Trump-related investigations (which are still ongoing), but made the most of his opening statement by dodging the questions and making a sales pitch for the renewal of Section 702 -- the statute permitting the NSA's internet data/communications collection the FBI makes frequent use of.

According to Comey, the 702 collection is essential to national security. Possibly true. But not so essential that concerns about Fourth Amendment violations should be swept aside. This was only one of the sales pitches Comey managed to squeeze in during questioning.

He also touched on a couple of other issues worth noting. Both involve legislation. After pitching a clean Section 702 renewal, Comey spent some time talking around the subject of backdoor 702 searches, noting that "all courts" have found the FBI's secondhand domestic surveillance lawful… without specifying the only court to really reach this conclusion is the FISA Court. And this court also found the NSA had abused its collection repeatedly. This court also approved zero 702 applications in 2016 and the NSA itself has shut down part of its upstream collection because it kept grabbing too many communications from US persons.

This shutdown will affect the FBI's backdoor searches. Comey, of course, didn't refer to them as backdoor searches, but did make it clear the FBI would be ever so pleased if Section 702 was renewed with a minimum of legislator interference.

The FBI's own collection efforts were a concern to Comey as well. Comey continued his misrepresentation of the statutes governing what the FBI can collect with National Security Letters. According to the FBI director, the only thing standing between what the FBI can legally get with NSLs (subscriber info and billing records) and what it wants (a very long list of things, including web history and geolocation data) is a "typo." Not sure which part of the statute contains the typo, but Comey claimed to be able to channel the intent of legislators who passed it back in 1986.

Not that the lack of statutory authority has prevented the FBI from demanding more than it's supposed to get. An NSL published by Yahoo contained a much longer list of requested data than is permissible under the law. Comey expressed his desire to have Congress take another look at the statute and see if it doesn't agree with Comey's assessment.

The other legislative issue near and dear to Comey's heart was addressed a bit more obliquely, but managed to make it clear the current administration would be far more sympathetic to Comey's other backdoor plan. Both Sen. Orin Hatch and Sen. Dianne Feinstein spoke favorably about encryption backdoors. Comey noted the Obama Administration wasn't interested in passing bills containing encryption bans or backdoors, but the new team in the White House has possibly expressed an interest in doing just that.

The Obama administration was not in a position where they were seeking legislation. I don't know yet how President Trump intends to approach this. I know he spoke about it during the campaign, I know he cares about it, but it's premature for me to say.

There were a lot of things that Comey wouldn't say. Many things he wouldn't confirm or deny in an open hearing. But he let us know he's still pushing encryption legislation, even if he's opted for more of a soft sell in recent months.

Generally speaking, the hearing ended up being more about how the FBI plans to continue expanding its power and decreasing civil liberties. Comey wants a clean 702 reauth, even with the NSA shutting down part of the collection because it can't comply with the law otherwise. He wants legislators to hand him greater NSL powers, even though the FBI's history of NSL abuse is well-documented. And he still wants the government to solve his "going dark" problem, even though the problem has been greatly exaggerated and no amount of harder nerding is going to generate a safe, government-only backdoor in encryption.

Filed Under: fbi, going dark, investigation, james comey, section 702, senate judiciary commitee

NSA Statements On 'About' Collection Shutdown Contradict PCLOB's Findings

from the nothing-is-real-and-nothing-to-get-hung-about dept

The impact the dropping of the "about" collection will have on the NSA's upstream harvesting will either be massive or minimal, depending on who you ask.

The Privacy and Civil Liberties Oversight Board's report on the "about" collection noted a few things, one of them being the supposed impossibility of preventing inadvertent collection.

All of these types of “about” communications can provide intelligence value, helping the government learn more about terrorist networks and their plans or obtain other foreign intelligence. While “about” collection is valued by the government for its unique intelligence benefits, it is, to a large degree, an inevitable byproduct of the way the NSA conducts much of its upstream collection. As discussed earlier in this Report, because of the technical manner in which this collection is performed, the NSA cannot entirely stop acquiring “about” communications without also missing a significant portion of “to/from” communications. Nor does the agency have the capability to selectively acquire certain types of “about” communications but not others.

At least some forms of “about” collection present novel and difficult issues regarding the balance between privacy and national security. But current technological limits make any debate about the proper balance somewhat academic, because it is largely unfeasible to limit “about” collection without also eliminating a substantial portion of upstream’s “to/from” collection, which would more drastically hinder the government’s counterterrorism efforts.

According to the PCLOB's interpretation, the "about" collection -- despite its many civil liberties issues -- could not be dropped without causing a significant loss of intel. In fact, the report goes so far as to claim the "about" collection itself is an "inevitable byproduct" of upstream surveillance -- rather than the way it actually appears to be: the inadvertent collection of US persons' communications is an inevitable byproduct of the "about" collection.

The NSA's statements on the ending of this program don't seem to cohere with the PCLOB's assertions, something pointed out by Jake Laperruque on Twitter.

Two statements were released by the NSA. The first seems more aligned with the PCLOB report's assertions about tech impossibilities and intel loss.

Even though NSA does not have the ability at this time to stop collecting "about" information without losing some other important data, the Agency will stop the practice to reduce the chance that it would acquire communications of U.S. persons or others who are not in direct contact with a foreign intelligence target.

The second statement, however, hints that the intel loss will not be nearly as significant as it's being portrayed... and that the "about" part was never a necessary part of intercepting "to/from" communications.

After considerable evaluation of the program and available technology, NSA has decided that its Section 702 foreign intelligence surveillance activities will no longer include any upstream internet communications that are solely "about" a foreign intelligence target. Instead, this surveillance will now be limited to only those communications that are directly "to" or "from" a foreign intelligence target. These changes are designed to retain the upstream collection that provides the greatest value to national security while reducing the likelihood that NSA will acquire communications of U.S. persons or others who are not in direct contact with one of the Agency's foreign intelligence targets.

The PCLOB's assertion that the "about" collection was an "inevitable byproduct" of upstream surveillance is nowhere to be found. The NSA itself states it can still perform upstream interception without nearly as much inadvertent collection simply by eliminating the "about" variable. If this is true, the NSA always had the capability to reduce the amount of inadvertently-collected communications. It just chose not to.

In any event, the upstream collection lives on, albeit in a slightly more constitutional form. The technical problem the NSA claimed prevented it from inadvertently collecting US persons' communications turns out to be something else: a minimal-impact search variable the agency could have eliminated years ago, bringing back some semblance of targeting to its surveillance work.

Filed Under: 702, about, about searches, mass surveillance, nsa, pclob, section 702, surveillance

The Email Collection The NSA Shut Down Has Been Abused For Years

from the and-it's-only-part-of-a-larger-collection dept

As was noted here earlier, the NSA surprised many people by shutting down its email collection. This collection was authorized by the FISA Amendments Act, which is due for renewal at the end of this year. Since the point the collection began, it was clear the NSA was also harvesting (inadvertently, it said) US persons' communications.

Ron Wyden, along with a few other lawmakers, has been asking the NSA for years to turn over information on this program -- specifically, how many US persons had been swept up "incidentally" in the bulk collection. For years, the NSA has refused to do so, claiming it would be impossible to compile this information and, somewhat hilariously, claiming it would violate the privacy of those swept up in the collection to query the database for incidental collections.

This decision to shut down the program may result in that answer never being given to Wyden. The ODNI (Office of the Director of National Intelligence) may decide the shutdown renders this particular query moot. It shouldn't. Now that the email program has been shut down EXPLICITLY because it sweeps up too many US persons' in the dragnet, the answer is more important than ever. And the ODNI has recently (and very belatedly) promised to deliver this number and should keep that promise even though the program has been shut down. Not only that, but this shutdown only affects the collection of email. It doesn't prevent the NSA from collecting other internet-based communications. With fewer people using email as their primary communication method, the NSA will still have plenty of communications to harvest.

There's another good reason for turning over that number: the Section 702 collection has been plagued with problems pretty much since its inception. The FISA court determined in 2011 that the program -- as operated by the NSA -- was unconstitutional. Apparently some fixes were made as the program was allowed to continue. But as Marcy Wheeler pointed out a year ago, the program has never not been violating the Foreign Intelligence Surveillance Act.

In his November 6, 2015 opinion reauthorizing Section 702, presiding judge Thomas Hogan described two more definite violations of 50 U.S.C. §1809(a)(2), and one potential one, bringing the list of times the FISC caught NSA illegally surveilling Americans to four, and potentially five, times.

Fall 2009 confession/July 2010 opinion: Collection of categories of data under the bulk PRTT program not permitted by the FISC (Bates’ opinion describes a category violation reported to FISC in the very first PRTT docket, along with NSA’s assurances it would never happen again)

June 2010 confession/December 10 2010, May 13, 2011 opinions: Retention of overcollected data from a traditional FISA warrant in mission management systems ultimately not deemed necessary for collection avoidance

May 2011 confession/October 3, 2011 opinion: Collection of entirely domestic communications on upstream surveillance MCTs

July 13, 2015 confession/November 6, 2015 opinion: Retention of 702 communications that had been otherwise purged in mission management systems, even though FISC had ruled against such retention in 2011

[Potential] July 13, 2015 confession/November 6, 2015 opinion: Retention of data that should have been purged or aged off in compliance databases

This is the authority the NSA wants approved at the end of the year. This shutdown might be an attempt to finally make the program legal -- or at least legal enough to survive a closer examination as the issue heads towards a vote.

This shutdown -- along with the NSA's long history of abuse -- also explains why there were no Section 702 approvals from the FISA court. As Wheeler suggested when the information was first released, the lack of approvals in 2016 indicated the program had "serious issues." Her post from last year shows the program has always had "serious issues." The number of requests the government made in 2016 was redacted from the report, but the footnote attached to it suggests it was more than one.

Perhaps the court no longer found the program Constitutional, at least not the way the NSA routinely operated it. While incidental collection is always a problem with bulk surveillance, the internal controls, which NSA talking points claim prevent abuse, apparently aren't controlling much or preventing much. It appears the NSA can't find a way to operate this part of the Section 702 program without collecting (and querying) US persons' communications, so it has decided to shut it down, rather than spend any more time and effort trying to talk the FISA court into approving its ritualistic abuse.

Despite having years to improve its practices and improve its segregation of collected data, the agency apparently did very little to rein this program in. A 2014 DOJ/ODNI report quoted by Wheeler shows misuse of collected data continued to increase even as the NSA sought orders to collect even more.

The joint oversight team, however, is concerned about the increase in incidents involving improper queries using United States person identifiers, including incidents involving NSA’s querying of Section 702-acquired data in upstream data using United States Person identifiers. Specifically, although section 3(b)(5) of NSA’s Section 702 minimization procedures permits the scanning of media using United States person identifiers, this same section prohibits using United States person identifiers to query Internet communications acquired through NSA’s upstream collection techniques. NSA [redacted] incidents of non-compliance with this subsection of its minimization procedures, many of which involved analysts inadvertently searching upstream collection. For example, [redacted], the NSA analyst conducted approved querying with United States persons identifiers ([long redaction]), but inadvertently forgot to exclude Section 702-acquired upstream data from his query.

This continued abuse and misuse is highly problematic, although the ODNI has been the last entity to officially recognize this. The "upstream" collection not only results in vast amounts of intercepted communications, but is one the FBI's favorite sources for intel. The ODNI denies to this day the FBI's searches of the NSA's collections are "backdoor searches," but it's information and communications the FBI certainly can't collect itself under its legal authorities. The supposedly foreign-facing collection is routinely used by a domestic law enforcement agency to obtain US persons' communications without a warrant. That's a "backdoor" search, no matter how the ODNI portrays it.

No matter what else comes of it, this shutdown is huge. Even though it's a smaller part of a larger internet communications collection program, it's still a significant closure. And once again, this is a result of Snowden's leaks. Wyden's persistent pestering about incidental collection likely played a small part as well. But without documents clearly showing how much the program collected and how it was being used, the NSA would most likely still be trying to find a way to push these requests past the FISA court. And without this additional scrutiny, the court itself might have found itself more easily persuaded.

Filed Under: 702, about, mass surveillance, nsa, searches, section 702, surveillance

Surprise: NSA Stops Collecting Americans' Emails 'About' Foreign Targets

from the this-is-big dept

There aren't many details yet, but Charlie Savage at the NY Times has a major scoop: apparently, the NSA has halted "about" email collections. This is important. As we've discussed in the past, under Section 702 of the FISA Amendments Act, the NSA can collect info on approved "foreign targets." But here's where it got sketchy: they could collect the communications "to" them or "from" them -- which most people would expect -- but also they could collect any communications "about" them. In other words, did you joke about Osama bin Laden in an email? It's possible that under Section 702, the NSA could collect that email without a warrant. That was massively concerning because the "about" emails from Americans could contain lots of other info, and once sucked up into the NSA's system and made available to the FBI for "backdoor" incidental collection searches, could expose people to lots and lots of trouble. There have been pushes over the past few years to limit the collection to no longer include "about" communications, but those had been (as far as we knew!) unsuccessful.

And, for an unclear reason, the NSA has stopped doing that. Trevor Timm speculates that perhaps the FISA court ruled that collection illegal, which is possible (also we just noted that there were no new 702 approvals by the FISA Court last year), so perhaps the FISC is finally taking its job a bit more seriously. We've also pointed out that there have been legal fights over the fact that the DOJ lied to the Supreme Court about the nature of these "about" collections, which may have created more pressure to stop them from happening.

I'm sure that we'll find out more about what happened in the near future, but this will certainly play a large role in the upcoming debate about renewing Section 702.

Filed Under: about searches, backdoor searches, doj, fisa court, fisc, mass surveillance, nsa, section 702, surveillance