FBI Vacuums Up Local Law Enforcement Documents To Block Open Records Requests About Orlando Shooting

from the PROPERTY-OF-THE-FBI-stamp-ink-running-dangerously-low dept

The FBI has decided to insert itself into another public records battle. The agency has long been known to cc: itself to public records requests for Stingray documents, but this time it's claiming any requests for local law enforcement documents related to the Orlando nightclub shooting need to be routed through it.

A June 20 letter from the FBI, attached to the City or Orlando's lawsuit over withholding 911 calls and other records from 25 media outlets including the Orlando Sentinel, was also sent to the Seminole County Sheriff's Office with instructions pertaining to how they should respond to records requests.

The letter requests that agencies deny inquiries and directs departments to "immediately notify the FBI of any requests your agency received" so "the FBI can seek to prevent disclosure through appropriate channels, as necessary."

Notice the FBI says "prevent disclosure," rather than, say, "assist in determining which documents can be released." The letter [PDF] claims that all records generated by local law enforcement agencies are now the FBI's by proxy and that the "investigative documents" exemption [Exemption 7(A)] prevents the release of all documents related to the shooting.

The FBI flat-out states all documents are belong to it.

The FBI considers information obtained from state and local law enforcement agencies in furtherance of its investigation to be evidence, or potential evidence.

Presto! Instant blanket exemption from disclosure at both federal and state level. The FBI takes care to point out which Florida Sunshine Law exemption local agencies can use to withhold documents from requesters.

There's significant public interest in these documents, especially those related to EMS/police response to emergency calls. This obviously conflicts with the FBI's determination that its ongoing investigation -- which now apparently contains every document created by every responding law enforcement agency in Florida -- should preempt any and all requests for documents via Florida open records laws.

Not for nothing have there been several efforts mounted to alter blanket exemptions like the one the FBI is using to insert itself into local level records requests. Unfortunately, it's very likely the FBI's wielding of this "open investigation" exemption will be granted deference by the federal court currently presiding over an open records lawsuit between the Orlando Sentinel and the City of Orlando, even though this fight never should have included a federal agency conducting its own concurrent investigation of the mass shooting.

Filed Under: fbi, foia, imsi catcher, law enforcement, orlando, public records, stingray

FBI: Clinton 'Should Have Known' Private Email Server 'No Way To Handle Classified Info', But No Charges Will Be Sought

from the not-even-the-sting-of-a-wrist-slap dept

FBI Director James Comey just held a press conference detailing the FBI's findings during its investigation of Hillary Clinton's use of a private email server. The findings are irrefutably ugly.

The FBI, "painstakingly" reassembling emails scattered to the digital wind by device abandonment, multiple server upgrades, lawyers' brute-force attempts to separate personal emails from work-related emails, and a general lack of professionalism across the board, found that Clinton's private email server contained :

• 110 classified emails in 52 chains
• 8 top secret emails
• 36 "secret" emails
• 8 "confidential" emails

All were clearly designated as such at the time sent or received. Additionally, another 2,000 emails had been "up-classified" to confidential after being sent or received.

It also found several work-related emails Clinton's staff did not include with the 30,000 handed over to the State Department for release to FOIA requesters.

There was no built-in archival function in Clinton's private server setup, a basic feature considered essential by professionals. This slowed the FBI's investigation as it was forced to reconstruct emails from the digital detritus left behind by "routine purging" and device deactivation.

As noted above, Clinton's lawyers made several efforts to delete "personal" emails, but they did so by using searches and header info, rather than actually reading the emails' content. The FBI did read the content of what it could recover, finding it likely that some work-related emails vanished during these purges. It also discovered Clinton hired some smart lawyers: "lawyers cleaned their devices in such a way as to preclude complete forensic recovery."

But at the end of it all, the FBI found Clinton's use of private email server to be severely stupid, rather than criminal. Comey says the FBI found no signs of "intentional misconduct" by lawyers during personal email deletions or routine purges. Likewise, there was "no clear evidence of intentional misconduct by staffers," but Clinton's emails were "clearly mishandled."

The FBI's final conclusion is damning, but only in terms of harsh words, not actual punishment. Clinton and her staff "knew or should have known" a private email server was "no way to properly handle classified email" -- especially when housed on private server with "no full-time staff" or anything approaching the level of service one would equate with email services like Gmail. Comey also noted that Clinton used her personal domain "extensively" outside of the US, needlessly exposing sensitive information in the "presence of hostile actors."

James Comey also took a little time to bash her agency, stating that the FBI found the "security culture" of the State Department to be "lacking."

But for anyone who was hoping this would result in criminal charges, the FBI has nothing in the way of good news. Comey says it's not the FBI's call to pursue prosecution, but stated that "no reasonable prosecutor would bring such a case" against Clinton, despite her repeated careless handling of sensitive info via her barely-competent private email service.

Final call, according to Comey: Clinton, staffers may be subject to security or administrative sanctions, but "no [criminal] charges are appropriate" in this case.

Clinton walks. The FBI has determined there was no malice in her actions. Being stupid and dishonest is no crime, at least not as far as the FBI is willing to push it. The DOJ has the final call, but it's highly unlikely it will override the FBI's recommendation. The decision is one that people in Clinton's position are far more likely to receive. Others lower on the political ladder -- or, god forbid, just average voting Americans -- are far less likely to receive this much deference from the nation's top prosecutors.

Filed Under: fbi, hillary clinton, james comey, state department

Leak Reveals Secret FBI Guidelines That Basically Give Them Free Rein To Spy On Journalists And Sources

from the not-cool,-doj dept

Eleven months ago, we wrote about a lawsuit filed by the Freedom of the Press Foundation seeking to get a copy of the DOJ's infamous new rules for spying on journalists. The new rules came about after it had come out that the DOJ had spied on Associated Press reporters as well as lied to a court to claim that Fox News reporter James Rosen was a co-conspirator in a leak investigation. To date, the DOJ has steadfastly refused to reveal the rules.

Thankfully, someone has now leaked the rules, or at least the 2013 version of some of the rules, which show that, contrary to what then Attorney General Eric Holder had suggested, it's still ridiculously easy for the FBI to spy on reporters and their sources in trying to hunt down a leak. In fact, it appears that these rules, around the use of NSLs are actually separate from the rules that Holder was talking about -- meaning that there's an entirely separate path for the DOJ to spy on journalists. The rules show that the FBI can just issue a National Security Letter (NSL), the mechanism that the FBI has been known to regularly abuse without consequence and which it's trying to expand. The "process" by which the media is supposedly protected under these new rules is that if someone in the DOJ is seeking an NSL to get phone records of someone in the media, they need to get some permission from someone else in the DOJ first: This is the fox watching the henhouse. These are not restrictions, these are just the DOJ getting to ask itself if it really wants to spy on these journalists, and the DOJ telling itself "sure, go ahead." There's a further exception that if someone is a member of the media, but the FBI "suspects" they're an intelligence officer or affiliated with a foreign intelligence service, "no additional approval requirements" are needed. So, as with the Rosen case, the FBI can just declare him a "co-conspirator" and voila, no approval necessary.

As the Freedom of the Press Foundation explains in response to this leak, this completely undermines the claims by the DOJ that there were strict controls on spying on journalists:

First, the rules clearly indicate—in two separate places—that NSLs can specifically be used to conduct surveillance on reporters and sources in leak investigations. This is quite disturbing, since the Justice Department spent two years trying to convince the public that it updated its “Media Guidelines” to create a very high and restrictive bar for when and how they could spy on journalists using regular subpoenas and court orders. These leaked rules prove that the FBI and DOJ can completely circumvent the Media Guidelines and just use an NSL in total secrecy.

Second, the DOJ told the New York Times in 2013 that, despite NSLs being exempt from the media guidelines, they were still used under a “strict legal regime.” Well, the “strict legal regime” here is basically non-existent. The only extra step the FBI has to go through to spy on journalists with an NSL—besides the normal, lax NSL procedures, which they have flagrantly and repeatedly violated over the past decade—is essentially get the sign off of a superior in the Justice Department. That’s it! They don’t have to even go through the motions for following any of the several rules laid out in the DOJ media guidelines: like get the Attorney General to sign off, exhaust all other means of investigation, alerting and negotiating with the affected media organization, making sure what is being sought is essential to the investigation, etc.

There's a separate important question here too: why were these rules kept secret? There is no national security reason to keep this secret. It does not reveal anything that helps anyone avoid surveillance. As Freedom of the Press Foundation notes, it appears the only reason to keep this secret is to avoid the embarrassment.

The information that has been redacted here by the Justice Department – and which they are fighting to keep secret in court – is incredibly mundane. The fact that the FBI has to get another person in the bureaucracy to sign off on a particular investigation should not be a state secret, nor would it remotely harm any ongoing investigation, nor would “tip off” any alleged criminals to how to evade surveillance.

The only reason to keep these rules secret, it seems, is that it’s incredibly embarrassing for the FBI to admit that they can use NSLs in leak cases to go after journalists. The fact that the FBI and DOJ are keeping these rules is outrageous, and they should use this opportunity to officially release the rules—and any updates to them—immediately.

The Foundation is also planning to continue its lawsuit for two reasons. First, as mentioned in the quote above, it wants the DOJ to officially release the rules, and, more importantly, it believes that the rules may have been updated since these 2013 rules were published.

The whole thing, once again, shows just how ridiculous this administration has been concerning protecting the rights of journalists to talk to confidential sources. "The most transparent administration in history" once again seems to be the exact opposite. Undermining the freedom of the press and spying on reporters and their sources is shameful. It's the activity of tyrants and insecure dictators, not democratically elected governments.

Filed Under: doj, fbi, journalists, national security letters, nsls, oversight, surveillance
Companies: freedom of the press foundation

Judge Says FBI Can Hack Computers Without A Warrant Because Computer Users Get Hacked All The Time

from the broken-blinds-policing dept

The FBI's use of a Network Investigative Technique (NIT) to obtain info from the computers of visitors to a seized child porn site has run into all sorts of problems. The biggest problem in most of the cases is that the use of a single warrant issued in Virginia to perform searches of computers all over the nation violated the jurisdictional limits set down by Rule 41(b). Not coincidentally, the FBI is hoping the changes to Rule 41 the DOJ submitted last year will be codified by the end of 2016, in large part because it removes the stipulation that limits searches to the area overseen by the magistrate judge signing the warrant.

For defendant Edward Matish, the limits of Rule 41 don't apply. He resides in the jurisdiction where the warrant was signed. He had challenged the veracity of the data obtained by the NIT, pushing the theory that the FBI's unexamined NIT was insecure (data obtained from targets was sent back to the FBI in unencrypted form) and info could have been altered in transit.

It's not much of a legal theory as any person performing these alterations would have had to know someone was performing long-distance acquisitions of identifying computer information and the IP addresses normally hidden by the use of Tor.

But that questionable legal theory is nothing compared to those handed down in Judge Henry Coke Morgan Jr.'s denial [pdf] of several motions by Matish. As the judge sees it, the FBI really didn't even need a warrant. Morgan Jr. says there's no expectation of privacy in an IP address, even if Tor is used to obscure it, which follows other judges' conclusions on the same matter. However, Morgan Jr. goes much further.

Morgan Jr. hints at the Third Party Doctrine but refuses to consider the fact that this information was not obtained from third parties, but rather directly from the user's computer via the FBI's hacking tool.

The Court recognizes that the NIT used in this case poses questions unique from the conduct at issue in Farrell. In Farrell, the Government never accessed the suspect's computer in order to discover his IP address, whereas here, the Government deployed a set of computer code to Defendant's computer, which in turn instructed Defendant's computer to reveal certain identifying information. The Court, however, disagrees with the magistrate judge in Arterburv. who focused on this distinction, see No. 15-cr-182, ECF No. 42. As the Court understands it, Defendant's IP address was not located on his computer; indeed, it appears that computers can have various IP addresses depending on the networks to which they connect. Rather, Defendant's IP address was revealed in transit when the NIT instructed his computer to send other information to the FBI. The fact that the Government needed to deploy the NIT to a computer does not change the fact that Defendant has no reasonable expectation of privacy in his IP address.

This reading of the Third Party Doctrine closely aligns with how the DOJ prefers it to be read. If someone knowingly or unknowingly turns over identifying info to a third party, it now belongs to the government -- even if the government obtains it directly through a search/seizure, rather than approaching third parties.

But more disturbing than this is Judge Morgan Jr.'s declaration that no expectation of security is the same thing as no expectation of privacy -- first highlighted by Joseph Cox of Motherboard.

“It seems unreasonable to think that a computer connected to the Web is immune from invasion,” Morgan, Jr. adds. “Indeed, the opposite holds true: in today's digital world, it appears to be a virtual certainty that computers accessing the Internet can—and eventually will—be hacked,” he writes, and then points to a series of media reports on high profile hacks. He posits that users of Tor cannot expect to be safe from hackers.

If hackers can break into computers and extract information, then law enforcement can do the same thing without fear of reprisal or suppression of evidence. Morgan Jr. equates it to "broken blinds" on a house window, where previous rulings have said it's perfectly fine for passing police officers to peer into windows that don't completely obscure the house's interior.

[I]n Minnesota v. Carter, the Supreme Court considered whether a police officer who peered through a gap in a home's closed blinds conducted a search in violation of the Fourth Amendment. 525 U.S. 83, 85 (1998). Although the Court did not reach this question, id at 91, Justice Breyer in concurrence determined that the officer's observation did not violate the respondents' Fourth Amendment rights. Id at 103 (Breyer, J., concurring). Justice Breyer noted that the "precautions that the apartment's dwellers took to maintain their privacy would have failed in respect to an ordinary passerby standing" where the police officer stood.

But that flies directly in the face of his previous determination that there's no expectation of privacy in IP addresses, even if a person takes steps to obscure that identifying info. Tor may be imperfect and can be compromised, but applying Morgan Jr.'s analogy to this situation means it's OK for the FBI to not only peer into the interior of a house, but to break the blinds in order to look inside.

The world Judge Morgan Jr. prefers is clear: that law enforcement should not be bound by the constraints of legal activity and, in fact, should be allowed to deploy hacking tools simply because computers get hacked every day. It's a judicial shrug that says the good guys should be able to do everything criminals do because the ends justify the means. Morgan Jr. explicitly states that "the balance weighs heavily in favor of surveillance" in cases like these (child pornography prosecutions) because of the criminal activity involved.

The ends will justify the means in cases like these, if Morgan Jr. is overseeing them. Even if you are sympathetic to the judge's belief that certain crimes call for more drastic law enforcement responses, the fact is that if given this judicial pass, law enforcement will not confine its use of jurisdiction-less warrants and invasive tech tools to only the worst of the worst. We need look no further than the deployment of a Stingray device to track down someone who stole $57 worth of fast food to see how this will play out in real life. The decision -- if it stands -- opens citizens up to a host of invasive, warrantless searches, just because security breaches are common and the pursuit of criminal suspects is more important than protecting citizens from government overreach.

Filed Under: 4th amendment, fbi, hacking, nit, privacy, rights

Senate Just Barely Rejects Plan To Expand FBI Surveillance Powers

from the two-votes dept

Just yesterday we wrote about how the Senate was, somewhat ridiculously, rapidly pushing forward plans on a vote for an amendment to the laws concerning what information the FBI can gather using National Security Letters (NSLs). Despite the fact that the big push for this bill began a few weeks ago, and the fact that it had absolutely nothing whatsoever to do with the Orlando shooting, cynical Senators including John McCain and Mitch McConnell pointed to the shootings in Orlando as a reason that this expansion of FBI surveillance powers was needed. Of course, the reality is that it wasn't needed, and the law is really there to paper over the fact that the FBI has already been widely abusing its NSL powers to get information it's not allowed to request.

After a vocal debate this morning, the measure (somewhat surprisingly) failed to pass, but by just two votes. It need 60 votes to move forward (it was a vote for "cloture" on debate, which requires 60 votes), and it only received 58. But McConnell already made it clear that the amendment will be reconsidered soon, which means he's likely going to be pushing strongly to get those two remaining votes.

In other words, this particular debate is far from over, and thus it's important to make sure your Senator knows not to support this. You can see the roll call on the votes here to see what your Senators voted. Somewhat surprisingly, neither of my Senators in California voted for it. Feinstein didn't vote or wasn't present and Boxer voted against. I'm guessing that Feinstein would likely vote for it in a revote, given her willingness to support greater surveillance, so it's possible that McConnell really only needs one more vote, unless people can convince some of the "Yea" voters to change their mind.

Filed Under: 4th amendment, doj, fbi, john mccain, mitch mcconnell, national security letters, nsls, politics, warrants

DOJ Insists That Rule 41 Change Is Not Important, Nothing To See Here, Move On Annoying Privacy Activist People

from the try-that-one-again? dept

We've been talking a lot about Rule 41 lately around here. As we've discussed, the DOJ had pushed for an update to the rule, basically granting the FBI much greater powers to hack into lots of computers, including those abroad (possibly creating diplomatic issues). We've been discussing the problems with the DOJ's proposed change for years, and we haven't been alone. Civil liberties groups and tech companies have both blasted the plans, but to no avail.

Back in March, a judicial panel approved the DOJ's proposed changes, and the Supreme Court gave its blessing a month later. The rule changes are set to go into effect on December 1st if they're not stopped. Senators Ron Wyden and Rand Paul have introduced a bill to block them, while the EFF, Tor and friends have kicked off a big No Global Warrants campaign, encouraging Congress to block this change.

The DOJ is being fairly proactive in trying to brush aside concerns about the Rule 41 change, and earlier this week put up a blog post insisting that there's nothing to see here at all, and everyone who's worried should just move along already.

The amendments do not change any of the traditional protections and procedures under the Fourth Amendment, such as the requirement that the government establish probable cause. Rather, the amendments would merely ensure that at least one court is available to consider whether a particular warrant application comports with the Fourth Amendment.

The amendments would not authorize the government to undertake any search or seizure or use any remote search technique, whether inside or outside the United States, that is not already permitted under current law. The use of remote searches is not new and warrants for remote searches are currently issued under Rule 41. In addition, most courts already permit the search of multiple computers pursuant to a single warrant so long as necessary legal requirements are met.

This is... skirting the truth, at best. Under the existing Rule 41, there are clear limits on warrants that are outside the jurisdiction of the court (see 41(b)). The new Rule 41 wipes away many of those restrictions by adding an entirely new form of warrants for "remote access to search electronic storage media." This is the kind of thing that Congress is supposed to decide upon, not the courts at the behest of the DOJ. If Congress hasn't granted this authority, it's pretty ridiculous for the courts to just do it on their own, and, furthermore, to insist this is little more than an administrative change.

The DOJ also leaves out that the new rules also effectively wipe out the requirement to give a copy of the warrant to the person whose computers are being hacked. Yes, the new rules require a "receipt" but they switch to a "reasonable efforts" standard, rather than the current standard, which is that they must give it to the person or "leave a copy" where the property was taken. That pretty much guarantees that some of the people who are hacked following this won't even know about it.

And if it were really true that this new rule doesn't change anything, then why is the DOJ pushing so hard for it? Remember that a bunch of courts have been throwing out some of these searches as being illegal, so clearly there's an issue here.

The DOJ insists that the new rules only apply in narrow cases WHERE YOU SHOULD ALL BE AFRAID because EXPLOITED CHILDREN ARE AT RISK IF YOU DON'T ALL SHUT UP.

First, where a suspect has hidden the location of his or her computer using technological means, the changes to Rule 41 would ensure that federal agents know which judge to go to in order to apply for a warrant. For example, if agents are investigating criminals who are sexually exploiting children and uploading videos of that exploitation for others to see—but concealing their locations through anonymizing technology—agents will be able to apply for a search warrant to discover where they are located. A recent investigation that utilized this type of search warrant identified dozens of children who suffered sexual abuse at the hands of the offenders. While some federal courts hearing cases arising from this investigation have upheld the warrant as lawful, others have ordered the suppression of evidence based solely on the lack of clear venue in the current version of the rule.

I'm all for the DOJ going after people sexually exploiting children. It seems like a pretty good use of their time. But we should always be skeptical when law enforcement starts throwing out "sexually exploited children!" and "terrorism!" as reasons to upend existing rules. Especially when they cover something as important as how broadly the FBI and DOJ can hack into people's computers.

The FBI has a rather long history of abusing its surveillance powers, and especially seeking to avoid strict oversight. Approving such a change just because the DOJ is insisting it's "FOR THE CHILDREN, WON'T YOU PLEASE THINK OF THE CHILDREN!" isn't a particularly good reason. If the DOJ really thinks this kind of expansion of its ability to hack computers both at home and overseas (again: this is a diplomatic nightmare waiting to happen) is really so important, then it should have Congress pass a law, rather than insisting that it's nothing more than an administrative change to clarify a rule.

Filed Under: doj, fbi, fud, hacking, jurisdiction, privacy, rule 41, warrants

FBI's Facial Recognition Database Still Huge, Still Inaccurate, And DOJ Shows Zero Interest In Improving It

from the ALL-YOUR-FACE-ARE-BELONG-TO-US dept

The FBI's biometric database continues to grow. Its Next Generation Identification system (NGI) is grabbing everything it can from multiple sources, compiling millions of records containing faces, tattoos, fingerprints, etc. from a blend of criminal and non-criminal databases. It went live in 2014, but without being accompanied by the Privacy Impact Assessment (PIA) it promised to deliver back in 2012.

Lawsuits and pressure from legislators finally forced the FBI to comply with government requirements. That doesn't mean the FBI has fully complied, not even two years past the rollout. And it has no interest in doing so in the future. It's currently fighting to have its massive database exempted from federal privacy laws.

Much of the information we have about the FBI's NGI database has come from outside sources. The EFF and EPIC have forced documentation out of the agency's hands via FOIA lawsuits. And now, the Government Accountability Office (in an investigation prompted by Sen. Al Franken) is turning over more information to the public with its review of the system.

What the GAO found is more bad news. The FBI is all about collecting data. It has little interest in ensuring the data is accurate or even usable.

The FBI’s system searches not just its own database, but also photo databases maintained by seven participating states, the US Department of State – which issues passports – and the US Department of Defense, shared among federal law enforcement agencies and the participating agencies, though access on the state level is obtained through the FBI.

This is only part of the NGI. To amass the 411 million photos it has collected to this point, the FBI dumps in the contents of a national criminal database.

[T]he GAO report found a much larger program, run by the criminal justice information services division of the FBI (CJIS), called Facial Analysis, Comparison and Evaluation, or Face, which “conducts face recognition searches on NGI-IPS and can access external partners’ face recognition systems to support FBI active investigations”.

The multiple inputs -- which allow criminal and non-criminal biometric data to intermingle -- still return an alarmingly high number of false positives. According to data obtained by EPIC, the facial recognition portion shows an error rate of 15-20% in the top 50 results returned from searches. That was the error rate in 2010. We can assume the hit rate has improved since then, but we have no way of knowing what the current error rate is because the FBI is uninterested in policing the accuracy of its database.

From the GAO report [PDF]:

Prior to deploying NGI-IPS, the FBI conducted limited testing to evaluate whether face recognition searches returned matches to persons in the database (the detection rate) within a candidate list of 50, but has not assessed how often errors occur. FBI officials stated that they do not know, and have not tested, the detection rate for candidate list sizes smaller than 50, which users sometimes request from the FBI… Additionally, the FBI has not taken steps to determine whether the face recognition systems used by external partners, such as states and federal agencies, are sufficiently accurate for use by FACE Services to support FBI investigations

The GAO report also points out the FBI has been severely delinquent in its obligations to the public. Reports it was supposed to deliver prior to rollout have only just recently appeared, including one release apparently prompted by the GAO's assessment of the NGI program.

NGI-IPS has been in place since 2011, but DOJ did not publish a System of Records Notice (SORN) that addresses the FBI's use of face recognition capabilities, as required by law, until May 5, 2016, after completion of GAO's review. The timely publishing of a SORN would improve the public's understanding of how NGI uses and protects personal information.

The GAO has made six recommendations to the agency, three of which are being disputed by the DOJ. According to the DOJ, the reason for the mandatory reports being delivered after-the-fact doesn't need to be examined because the FBI "has established practices that protect privacy and civil liberties beyond the requirements of the law." This sounds like the FBI has "nothing to hide," which is at odds with the lack of responsiveness by the agency to demands for updated PIAs and SORNs over the last eight years.

The DOJ also disagrees that it should have to audit the facial recognition database's "hit rate," something that was only 80-85% accurate five years ago. (In fact, the FBI's specifications consider 85% accuracy to be acceptable when returning lists of possible suspects.) The DOJ claims the database can never return a false positive because it apparently has enough manpower and resources to chase down every bogus lead.

In its response, DOJ stated that because searches of NGI-IPS produce a gallery of likely candidates to be used as investigative leads instead of for positive identification, NGI-IPS cannot produce false positives and there is no false positive rate for the system.

The GAO understandably disagrees. Accuracy is important, especially if the FBI is going to put innocent people under investigation… or overlook potentially dangerous suspects.

Without actual assessments of the results from its state and federal partners, the FBI is making decisions to enter into agreements based on assumptions that the search results may provide valuable investigative leads. In addition, we disagree with DOJ’s assertion that manual review of automated search results is sufficient. Even with a manual review process, the FBI could miss investigative leads if a partner does not have a sufficiently accurate system.

The DOJ apparently still feels a 20% chance of putting the wrong person under investigation is still acceptable. And it still believes that it's so far ahead of the privacy curve that it doesn't need to apprise the public of the potential privacy implications of its massive biometric database. The information forced out of its hands by litigants and outside agencies shows the FBI is far more interested in collection than dissemination -- that it should be able to take all it wants from the public without having to hand out anything in return.

Filed Under: accuracy, doj, facial recognition, fbi, next generation identification, ngi, privacy

Judge In Playpen Case: FBI's Warrant Is Valid, Even If Its Claims About No Privacy In IP Addresses Are Not

from the a-net-win-for-the-feds dept

Another court handling an FBI Playpen case has handed down its decision on a motion to suppress. Like other courts fielding prosecutions resulting from this massive investigation, it has found [PDF] that the FBI's NIT (Network Investigative Technique) is invasive enough to be called a "search." (via FourthAmendment.com)

The FBI must have felt its NIT deployment would be considered a search. That's why it obtained a warrant in the first place. But it's been frantically peddling "not a search" theories as court after court has declared its warrant invalid because the searches were performed outside of the issuing magistrate's jurisdiction.

In this case, the issue of whether or not the NIT deployment was a search has not been disputed by either party. The court addresses it anyway because it affects the reasoning that follows.

Before reaching the merits of Defendant's motions, it will be useful to address a preliminary question unaddressed by the parties: Was the deployment of the NIT a "search" of Defendant's computer within the meaning of the Fourth Amendment? If the use of the NIT was not a search, the Fourth Amendment was not implicated, no warrant was required, and any violation of Rule 41(b) irrelevant.

Rule 41(b), which may be drastically altered by the end of this year, restricts searches to the jurisdiction where the warrants were issued. The FBI is well aware of the deficiencies of its NIT warrant, which is why it presented this legal theory to court in response to an earlier motion.

The government in its response to Defendant's First Motion to Suppress never argues that no warrant was required because deployment of the NIT was not a Fourth Amendment search. See Gov't's Resp. to First Mot. at 15-38. In failing to raise this argument when it would have been appropriate, the government has likely waived it. The government does, in justifying the scope of the warrant, argue that Defendant had no reasonable expectation of privacy in his IP address, even though he was using the Tor network.

The court blows past the "no expectation of privacy in IP addresses" for the moment, instead focusing on the execution of the FBI's NIT.

The "contents" of a computer are nothing but its code. In placing code on Defendant's computer, the government literally—one writes code—invaded the contents of the computer. Additionally, the code placed on Defendant's computer caused Defendant's computer to transmit certain information without the authority or knowledge of Defendant. In this manner the government seized the contents of Defendant's computer. Just as in Riley, it is irrelevant that Defendant might not have a reasonable expectation of privacy in some of the information searched and seized by the government. The government's deployment of the NIT was a Fourth Amendment search.

This key element having been decided, the court moves on to the warrant itself, as well as the government's contention that an IP address has no expectation of privacy. As to the latter, the court points out that the government obtained much more than just an IP address with its NIT and that it used an intrusive means to do so. The court ultimately agrees with the assertion about the lack of privacy in IP addresses, but does not agree that obtaining an IP address in this fashion can be considered harmless under the Fourth Amendment. Hence the nod to the Supreme Court's Riley decision. While many records contained on a phone may be subject the Third Party Doctrine and obtained without a warrant, they must be obtained from the third parties, rather than from the phone itself. Replace "phone" with "computer," and information with no built-in expectation of privacy gains a privacy shield due to where these "records" are stored.

The defendant's second motion to suppress brings up the Rule 41(b) issue. But it fails, spectacularly, because of the defendant's location.

Defendant argues that Rule 41(b) only allows magistrate judges to issue warrants for searches outside of their districts in limited, well-defined circumstances, none of which apply to the facts of the instant case. Second Mot. at 6-11. Of course, Defendant acknowledges that the website was being run from within the Eastern District of Virginia, that the magistrate judge sits in the Eastern District of Virginia, and that Defendant's computer was located in the Eastern District of Virginia when the NIT was deployed.

The legal theory advanced by the defense is that the warrant is still invalid, even when deployed in its proper jurisdiction, because it permitted the FBI to search an untold number of computers located all over the country. The court doesn't buy this rationale. In fact, it states it would have denied suppression even if the warrant had failed to hold up because the FBI took every step it could to ensure the legitimacy of its search.

The FBI agents in this case did the right thing. They gathered evidence over an extended period and filed a detailed affidavit with a federal magistrate in support of their search warrant application. They filed the warrant application in the federal district that had the closest connection to the search to be executed. The information gathered by the warrant was limited: primarily the IP addresses of those that accessed Playpen and additional information that would aid in identifying what computer accessed the site and what individual used that computer.

The judge doesn't let the FBI off the hook entirely. It also addresses the FBI's last-minute argument that the defendant shouldn't even have been allowed to challenge the warrant.

The government also argues that Defendant does not have standing to challenge the warrant because the alleged defect in the warrant, that it exceeded the magistrate's jurisdiction, does not apply to him because his computer was in the Eastern District. This seems to be a novel interpretation of standing law in Fourth Amendment cases. The standing inquiry in Fourth Amendment cases asks if the individual seeking suppression had a reasonable expectation of privacy in the thing searched. See Rakas v. Illinois. 439 U.S. 128, 133-34 (1978). Defendant's computer was searched, and he has a reasonable expectation of privacy in his computer.

The Playpen saga is a complete mess. There's nothing in this mixed bag of decisions that tips the scale in either direction. For every win about the lack of privacy in IP addresses the FBI secures, it loses another one to the invasive method it used to obtain these addresses. Every time a court grants its credit for "good faith," multiple courts countered with opinions finding the warrants invalid from the moment they were signed by a magistrate.

About the only "win" the FBI can definitively claim is that its NIT secrets are still mostly secret. And in order to achieve that, it had to watch its evidence be dismissed by a judge who actually believed the FBI had legitimate reasons for refusing to disclose this info.

And yet, it's unlikely that this will result in the FBI examining its investigation methods. As of right now, it has less than six months before the proposed Rule 41(b) changes are adopted by Congress. And there's a good chance they will be because Congress has to have the will and determination to "opt out" while distracted by an extended holiday season of shorter work weeks, the annual budget process, reelection campaigns, and a change in regimes.

Filed Under: doj, fbi, ip address, nit, playpen, privacy, warrant

DOJ Rushed To Link Orlando Shooter To ISIS, Now Plans To Redact What He Said During 911 Call For... Reasons

from the huh? dept

The FBI/DOJ had no problem rushing out claims last week that Omar Mateen, the guy who killed 49 people in a rampage at a club in Orlando last weekend, had "pledged allegiance" to ISIS. James Comey delivered remarks that said as much last Monday:

It is also not entirely clear at this point just what terrorist group he aspired to support; although, he made clear his affinity, at the time of the attack, for ISIL, and generally, leading up to the attack, for radical Islamist groups. He made 911 calls from the club, during the attack, at about 2:30 in the morning, Sunday morning. There were three different calls. He called and he hung up. He called again and spoke briefly with the dispatcher, and then he hung up, and then the dispatcher called him back again and they spoke briefly. There were three total calls.

During the calls he said he was doing this for the leader of ISIL, who he named and pledged loyalty to, but he also appeared to claim solidarity with the perpetrators of the Boston Marathon bombing, and solidarity with a Florida man who died as a suicide bomber in Syria for al Nusra Front, a group in conflict with Islamic State. The bombers at the Boston Marathon and the suicide bomber from Florida were not inspired by ISIL, which adds a little bit to the confusion about his motives.

By now, it's pretty clear that the link to terrorism is basically non-existent, and that he fits the profile of a "typical mass shooter" rather than someone doing this for ISIS or any other terrorist reasons. As Marcy Wheeler points out, this also may explain why even though the FBI had checked out Mateen twice, including using the FBI's infamous "confidential informants" who often push people to join them in made up terrorist plots, they decided he wasn't a threat. It appears that Mateen didn't give any indication that he was really into aligning himself with ISIS or any other terrorist group, and Wheeler wonders if the FBI cared that he might do other damage, since they're so focused just on terrorism these days.

Instead, it appears, the FBI assessed Mateen for one and only one thing: whether his bogus claims of ties to terrorist organizations were real. There have been a slew of articles, such as this one or this one, wondering why the FBI didn’t “identify” Mateen as a “real” terrorist in its two investigations of him. But it appears the FBI was assessing only whether he was likely to commit violence because of–and with the support of–an Islamic terrorist group. It appears they weren’t assessing whether he was, like the overwhelming majority of men who commit mass shootings in this country, really screwed up, expressing it in violent ways, and seeking attention with such actions.

It is true that Islamic extremists want to attack this country. It is also true that far, far more Americans die when men carry out mass killings because they’re fucked up and begging for attention. If you’re Muslim, the easiest way to get attention right now is to say that word, “ISIS,” because it’s a guarantee law enforcement and politicians will give that killing more due then they might give the next disturbed mass shooter.

Of course, now that the DOJ seems to be realizing that this wasn't based on any connection to middle east groups, it seems to want to bury the issue. Attorney General Loretta Lynch has declared that when the transcript of Mateen's 911 calls are released, they're going to redact his claims to be doing it for ISIS for [reasons].

LORETTA LYNCH:

Yes, I’ll be going to Orlando on Tuesday to continue my briefings in the case. Actually though what we are announcing tomorrow is that the F.B.I. is releasing a partial transcript of the killer’s calls with law enforcement from inside the club. These are the calls with the Orlando P.D. negotiating team who were trying to ascertain who he was, where he was, and why he was doing this, all the while the rescue operations were continuing. That’ll be coming out tomorrow and I’ll be headed to Orlando on Tuesday.

CHUCK TODD:

Including the hostage negotiation part of this?

LORETTA LYNCH:

Yes. It will be primarily a partial transcript of his calls with the hostage negotiators.

CHUCK TODD:

You say partial. What’s being left out?

LORETTA LYNCH:

Well, what we’re not going to do is further proclaim this individual’s pledges of allegiance to terrorist groups and further his propaganda.

CHUCK TODD:

So we’re not going to hear him talk about those things?

LORETTA LYNCH:

We will hear him talk about some of those things, but we’re not going to hear him make his ascertains of allegiance and that. This will not be audio. This will be a printed transcript. But it will begin to capture the back and forth between him and the negotiators. We’re trying to get as much information about this investigation out as possible. As you know, because the killer is dead, we have a bit more leeway there. And so we will be producing that information tomorrow.

Marcy Wheeler again points out how absolutely ridiculous this is, including the idea that releasing such statements would "re-victimize" people. That makes absolutely no sense:

If releasing these claims of affiliation would “revictimize” the victims, then releasing them in the first place served to victimize them. So the much better approach would be the release the full transcripts and admit the Department fucked up, both in its assessment of a potential mass killer, and in rushing to blame ISIS in the first place. Not to mention that this will just feed conspiracy theories.

If DOJ fucked up — and the claim this could revictimize people is tacit admission it seriously fucked up — then admit that and make it right. Pay the political consequences of admitting that our obsessive focus on terrorism has distracted us from the more general, and therefore more lethal, problem with mass killings. Don’t try to pretend there’s a good reason for suppressing the very same claims you made a big deal of a week ago.

If DOJ now believes the claims served to do nothing more than give Mateen’s rampage more attention — and it was a key part of generating that attention — then it needs to come clean.

And, of course, as everyone knows, redacting such information is only calling more attention to it, and almost certainly feeding into the typical plot lines of conspiracy theorists. Why not just release the full transcripts (as required under Florida's public records laws) and with it a full explanation for why the claims of being associated with various groups (many of which are in conflict with each other) make no sense. That is, why not try to calm down the kneejerk reaction the DOJ set off in the first place?

Filed Under: doj, fbi, isis, omar mateen, redactions, streisand effect

The FBI Says Its Homegrown Terrorist Stings Are Nothing More Than A Proactive Fight Against 'Going Dark'

from the MADE-WITH-PRIDE-IN-THE-USA! dept

The New York Times is taking a look at the FBI's battle against terrorism (not the first time it's done this) -- namely, its near-total reliance on sting operations to round up would-be terrorists. As the Times' Eric Lichtblau points out, stings used to be a last-resort tactic. Now, it's standard operating procedure. Two out of every three terrorism prosecutions begin with undercover agents nudging citizens and immigrants toward acts of violence and "material support." In some cases, the FBI agents are doing all the work themselves.

The FBI, of course, maintains that these terrorists would have acted on their own without the agency's intercession -- even though it seems to be placing a rather heavy finger on the scale.

While F.B.I. officials say they are careful to avoid illegally entrapping suspects, their undercover operatives are far from bystanders. In recent investigations from Florida to California, agents have helped people suspected of being extremists acquire weapons, scope out bombing targets and find the best routes to Syria to join the Islamic State, records show.

According to the agency, this stuff that looks like entrapment is nothing more than expedience.

“We’re not going to wait for the person to mobilize on his own time line,” said Michael B. Steinbach, who leads the F.B.I.’s national security branch. He added that the F.B.I. could not afford to “just sit and wait knowing the individual is actively plotting.”

I guess this all depends on your definition of "actively plotting." In cases we've covered here (and mentioned in the NYT article), federal agents have done everything from script and film "declaration of intent" videos to purchase all of the supplies needed for a "terrorist attack" they planned from start to finish.

The rogues gallery compiled by the FBI over the past half-decade is hardly threatening. It includes senior citizens, mentally-disabled teens, would-be terrorists who weren't even threatening enough to get their mothers to give them back their passports, and an assortment of extremely-impressionable young men who were all talk and no action.

While the FBI maintains it's doing nothing wrong, former FBI agents and intelligence community members aren't so sure.

“They’re manufacturing terrorism cases,” said Michael German, a former undercover agent with the F.B.I. who researches national security law at New York University’s Brennan Center for Justice. In many of the recent prosecutions, he said, “these people are five steps away from being a danger to the United States.”

Karen J. Greenberg, the director of the Center on National Security at Fordham University, said undercover operations had become the norm for the F.B.I. in the most recent Islamic State cases, with little debate or understanding of how the bureau actually conducts its investigations, especially its online stings.

“I think the F.B.I. is really going down the wrong path with a lot of these ISIS cases,” she said…

When pressed to defend aggressive sting operations, FBI officials fall back on one their favorite scapegoats: encryption.

“When the bad guys turn to encrypted areas, we’re dark, and the only way to gain a better understanding of what we’re up against may be through an undercover,” Mr. Steinbach said.

But exactly how much terrorism is this stopping? There's no way to gauge the effectiveness of these tactics other than to count up successful prosecutions, as the FBI likes to do. What the FBI says is the "least intrusive" method of fighting terrorism often appears to be nothing more than padding the stats. As long as the FBI can continue to chalk up terrorism prosecutions, it can avail itself of a nearly-bottomless well of funding. The agency has shifted its focus to intelligence rather than law enforcement since 2001, and nothing brings in the bucks like counterterrorism efforts.

Does it make us safer? That's also unquantifiable, although every day that goes by without a successful domestic terrorist attack could theoretically be added to the "win" column. But it's hard to believe these sting operations are actually taking credible threats out of circulation.

The FBI's tactics have a lot in common with the DEA/ATF's reliance on stash house robbery stings -- busts in which no actual drug dealers, weapons suppliers, weapons, or drugs are actually taken off the street. Everything inside the bogus stash houses exists only in the minds of the undercover agents. The only tangible aspect of the sting operations are the sentences handed down, the length of which is determined by the total amount of drugs federal agents say was "present" in the stash house that never existed and was never robbed.

Both "wars" being fought by law enforcement seem to be incredibly counterproductive. Four decades of drug warring has done almost nothing to stop the flow of illicit drugs into the country. What it has done, however, is turn the manufacturing countries into violent hellholes.

As for the War on Terror, the only terrorists being locked up appear to be those pushed and cajoled into acting out undercover agents' fantasies. The terrorist threat in other parts of the world remains almost unchanged, despite a decade-plus of FBI counterterrorist operations and CIA drone strikes. Here, too, there appears to be a certain amount of "looking busy" -- treadmill-like activity that does little to attack the threat but still guarantees a healthy budget year after year.

Filed Under: counterterrorism, entrapment, fbi, homegrown terrorists, own plot