James Clapper's Report On Progress Towards President's Surveillance Reforms Mainly Explores Executive Branch Loopholes

from the not-so-much-what-it-can-do,-but-what-it-can-get-away-with dept

James Clapper, the Director of National Intelligence, has issued an interim report on the intelligence community's minimal progress towards minimal compliance with the minimal reforms ordered by the administration last year in response to the Snowden leaks. Presidential Policy Directive 28 (PPD-28) was issued in January and Jame Clapper's office is proud to announce that it's still in the process of thinking about complying with the stuff the President asked them to do so many months ago.

As we work to meet the January 2015 deadline, PPD-28 called on the Director of National Intelligence to prepare an interim report on the status of our efforts and to evaluate, in coordination with the Department of Justice and the rest of the Intelligence Community, additional retention and dissemination safeguards.

The DNI's interim report is now being made available to the public in line with our pledge to share as much information about sensitive intelligence activities as is possible, consistent with our national security.

We're blown away with all the openness, Mr. Clapper. This must be the same transparency that has seen Clapper's office dump documents without referencing the federal lawsuits prompting this "largesse." Or the same transparency that tossed out the above-mentioned presidential directive -- one month after it went public -- with a self-congratulatory Tumblr post. (Yes. That is the world we live in now. The Director of National Intelligence speaks to the public through Tumblr, a venue more known for its porn gifs and faint odor of Yahoo! desperation. Thanks, Obama Snowden.)

At this point, the interim effort is mostly talk. There's little that indicates any movement has been made towards the goals of the directive. In fact, any detectable movement is limited to shrugs of deference towards the Executive Branch, as the EFF points out.

Here are a few choice sections from our initial read of today's report:

"To that end, PPD-28 states that personal information of non-U.S. persons shall be retained and disseminated only if the retention and dissemination 'of comparable information concerning U.S. persons would be permitted under section 2.3 of Executive Order 12333.'"

We are disheartened to see ODNI pinning its privacy protections to Executive Order 12333. EO 12333 is a poorly-understood Reagan-era authority; one former State Department chief said:

"…Section 215 permits the bulk collection only of U.S. telephone metadata — lists of incoming and outgoing phone numbers — but not audio of the calls.

Executive Order 12333 contains no such protections for U.S. persons if the collection occurs outside U.S. borders. Issued by President Ronald Reagan in 1981 to authorize foreign intelligence investigations, 12333 is not a statute and has never been subject to meaningful oversight from Congress or any court…"

Repeatedly, the interim report addresses the new ideals… and then immediately appends, "unless EO 12333 says we can do otherwise." Admittedly, this flaw traces back to the administration's directive, which contains much of the "unless EO 12333" language referred to in the report.

Somewhat surprisingly, the ODNI's report calls out the overly-broad language contained in EO 12333.

Executive Order 12333 defines this term as "information relating to the capabilities, intentions, or activities of foreign governments or elements thereof, foreign organizations, foreign persons, or international terrorists." This definition ensures that the Intelligence Community is able to retain and disseminate information necessary for the United States to advance its national security and foreign policy interests. Nonetheless, the definition's reference to "information relating to . . . activities of. . . foreign persons,' if read literally, could permit an element to permanently retain or to disseminate any information about any activity of any foreign person. Intelligence Community elements should permanently retain or disseminate such personal information only if the personal information relates to an authorized intelligence requirement, is reasonably believed to be evidence of a crime, or meets one of the other standards for retention or dissemination identified in section 2.3 of Executive Order 12333 for U.S. person information, and not solely because of the person's non-U.S. person status.

The EFF asks if the NSA has ever used this reading to its own advantage. Certainly no answer is expected, but the agency has long been a fan of fluid terms and malleable definitions. Which brings us to the ultimate show of executive branch deference, albeit one that implies the administration will help the agency do the things it really wants to, Presidential Policy Directive or no.

It is important that elements have the ability to deviate from their procedures when national security requires doing so, but only with approval at a senior level within the Intelligence Community element and notice to the DNI and the Attorney General.

Even the most modest of reforms still apparently needs ample breathing room and the ODNI carves out plenty with this single paragraph -- all without even bothering to address the mass surveillance programs that prompted the reforms in the first place.

Filed Under: james clapper, nsa, odni, reform, surveillance

Two Top Intelligence Officials, Both Of Whom Admitted To Lying In The Past, Now Try To Rewrite History And Deny The Lies

from the don't-get-dizzy-from-all-that-spin dept

Apparently the US intelligence community has decided that they should start trying to totally rewrite the history of two of its top officials directly lying to Congress. First up: Director of National Intelligence (DNI) James Clapper. This lie is the famous one, in which while testifying before Congress, Senator Ron Wyden engaged in this exchange:

Wyden: Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?

Clapper: No sir.

Wyden: It does not?

Clapper: Not wittingly. There are cases where they could, inadvertently perhaps, collect—but not wittingly.

At first, Clapper denied lying, saying he merely misunderstood the question, and thought it was about "voyeuristically" poring through emails. But the question is pretty explicit: "any type of data at all." Later, Clapper changed his story to claim that he did understand the question, but was taken off guard by it and gave "the least untruthful answer" he could. At that point, Wyden pointed out that he had actually given Clapper the questions a day earlier and then reached out to his office after to confirm that his answers were accurate, leaving Clapper plenty of opportunity to correct his error -- but Clapper did not. At that point, Clapper finally admitted he had lied and gave a semi-apology to Wyden, saying: "mistakes will happen, and when I make one, I correct it."

Except, now, over a year later, Clapper is back to denying that he lied. Before a "friendly" audience of defense and intelligence contractors (one of the questions to him started out, "You have a very supportive private sector in front of you..."), Clapper again pretended that he never lied to Congress at all. Even worse, he did so while introducing new "principles of professional ethics" for the intelligence community, and arguing that he did so because of the awful situation he endured when he was falsely accused of lying:

“When I got accused of lying to congress because of a mistake ... I had to answer on the spot about a specific classified program in a general, unsecure setting.”

Except, almost none of that is true. It wasn't on the spot. Wyden gave him the questions a day earlier. He didn't have to answer the question (before and since that questioning, Clapper and others have responded to nearly identical questions by saying they could only give details in a classified setting). And, again, Wyden gave Clapper a chance to correct the answer via a letter, and Clapper stood by the original letter. In other words, he lied. He flat out lied. And then he stood by it afterwards when he had a chance to correct the lie. And now he's lying about the lying. Oh, and as for the new "ethics" principles? 1) mission; 2) truth; 3) lawfulness; 4) integrity; 5) stewardship; 6) excellence; and 7) diversity.

And just to add to this mess, Clapper also claimed that the intelligence community has not been shown to have violated the law. That's also flat out false. Both a federal judge and the federal government's privacy and civil liberties oversight board (PCLOB) found the program unconstitutional and illegal.

Moving on, we've got CIA director John Brennan. After the big mess with Senator Dianne Feinstein accusing the CIA of spying on Senate staffers, Brennan tried to deny it (while his denials more or less confirmed the facts). However, he specifically told reporters:

"Let me assure you the CIA was in no way spying on [the Senate Intelligence Committee] or the Senate."

He also claimed that "when the facts come out on this," those who claimed that there was "spying" by the CIA "will be proved wrong." Fast forward a few months and the CIA's Inspector General confirmed everything in Feinstein's story, leading Brennan to apologize to Feinstein. In fact, the full CIA report revealed that the spying was even worse than Feinstein initially detailed.

And... guess what? Brennan is now denying he lied. At the very same conference he pulled a "who, me?" routine:

"Thwart the investigation? Hacking in? We did not."

Note that he's parsing words carefully. He's focusing on "thwarting the investigation" and "hacking" in -- though that depends on your definition of hacking. Under the DOJ's definition, what the CIA did was clearly hacking. It's why Senators Wyden and Udall asked Brennan about whether or not the US hacking statute, the CFAA, applied to the CIA. Because the CIA clearly was unauthorized to access the Senate staffers' network, based on a previous fight with the Senate Intelligence Committee, as detailed by Feinstein when she revealed the details:

Per an exchange of letters in 2009, then-Vice Chairman Bond, then-Director Panetta, and I agreed in an exchange of letters that the CIA was to provide a “stand-alone computer system” with a “network drive” “segregated from CIA networks” for the committee that would only be accessed by information technology personnel at the CIA—who would “not be permitted to” “share information from the system with other [CIA] personnel, except as otherwise authorized by the committee.”

Yet, now Brennan is twisting the story, to say that there was no hacking because they were the CIA's computers all along:

On Thursday, he pointed out the computers technically belonged to the CIA, even though they had been partitioned to create private work space for the Senate staffers.

There was more hairsplitting when he explained his apology. “I apologized then to them for any improper access that was done, despite the fact that we didn’t have a memorandum of understanding.”

Again, that directly contradicts reality. We'll see if Feinstein decides to respond to all of this, but Senator Wyden already has with a bit of internet slang in this hilarious tweet: If you can't see it, that's Wyden's press office linking to one of these stories, saying "smh" which is internet shorthand for "shaking my head."

Filed Under: cia, dianne feinstein, james clapper, john brennan, lies, nsa, odni, ron wyden, senate, spying, surveillance, torture report

New Intercept Leak Shows That Intelligence Agencies Are Ready And Willing To Perform Economic Espionage If US Tech Edge 'Slips'

from the altitude-of-high-road-rapidly-approaching-sea-level dept

The NSA has repeatedly assured the public that it definitely does not perform economic espionage. It may collect metadata and communications from around the world (including that of US citizens) and intercept shipments of computer hardware in order to install its own spying devices, but it doesn't perform espionage in service of American corporate interests.

This was the small thing that set our intelligence agencies slightly above similar agencies in China. Last August, the ODNI (Jame Clapper's office) sent this categorical denial to the Washington Post in response to leaked documents. (Emphasis in original.)

“The department does ***not*** engage in economic espionage in any domain, including cyber.”

And then the truth came rolling in, thanks to Snowden's leaks.

After that categorical statement to the Post, the NSA was caught spying on plainly financial targets such as the Brazilian oil giant Petrobras; economic summits; international credit card and banking systems; the EU antitrust commissioner investigating Google, Microsoft, and Intel; and the International Monetary Fund and World Bank. In response, the U.S. modified its denial to acknowledge that it does engage in economic spying, but unlike China, the spying is never done to benefit American corporations.

A slight change in wording and the denial still holds. Or does it? The Intercept's latest set of documents -- issued by Clapper's office -- show the US government definitely has plans to do the one thing Clapper says we don't: spy for the benefit of US corporations.

The document, the 2009 Quadrennial Intelligence Community Review—provided by NSA whistleblower Edward Snowden—is a fascinating window into the mindset of America’s spies as they identify future threats to the U.S. and lay out the actions the U.S. intelligence community should take in response…

According to this document, one of the threats that the government might call in the services of its intelligence agencies to handle is a slip in America's "technological and innovative edge." The appropriate response in the free world -- especially a country that always tells its citizens they can achieve anything through hard work and determination -- would be to allow the struggling corporations to solve their own problems. If it really needed to get involved, the government could take a close look to see if it was creating bottlenecks with iffy IP laws or its random blend of regulation and deregulation. Anything but take the easiest way out.

But if the American way of life (such as it were) is threatened in the future, Clapper's office recommends letting the spies fix it.

The report recommends “a multi-pronged, systematic effort to gather open source and proprietary information through overt means, clandestine penetration (through physical and cyber means), and counterintelligence” (emphasis added). In particular, the DNI’s report envisions “cyber operations” to penetrate “covert centers of innovation” such as R&D facilities.

Cheat to win. And saying everyone else is doing it (even if they are) doesn't do anything more than drag the US down to their level. One scenario included in the document posits Russia and India working together to outpace the US. At this point, the NSA and others would step in to perform cyber-espionage, hacking into the foreign research facilities and making off with proprietary data. The data collected would be (this is a direct quote)

...assesse[d] whether and how its findings would be useful to U.S. industry.

As is noted by Glenn Greenwald, there's no indication the US has actually done this in the past. But it is a long-term document, meant to envision the intelligence agencies' roles over the next 20 years. And one of those roles being discussed is stealing secrets to put US companies ahead.

Some may defend this as being a purely speculative document that details numerous what-if scenarios that will never be played out. But that defense is inadequate. The speculations aren't tied to scenarios in which the US government shifts towards a more China-like role and gives up its ambitions of being the leader of the free world. In these scenarios, the United States is presumed to be doing business as a democratic republic -- one that has often sought to rise above this sort of behavior.

The NSA has the capabilities to do many things, some of which remain unexplored (or at least unrevealed). This is one of them. The agency's defenders have argued that it doesn't abuse these powers, but its internal documents (along with statements from former NSA head Keith Alexander) that it will always "play to edges" of its confinements. This document shows it's willing to step into this role if asked to. Or if it thinks it was asked to. Or it may perform this role proactively and ask forgiveness later.

The fact is that this scenario never should have been presented. It's not that much different than using the threat of domestic terrorism as a what-if projection for unencumbered harvesting of US citizens' communications. There are lines you don't cross -- not in this nation -- even hypothetically. Corporate espionage is one of them. Especially when the US Attorney General is handing out indictments for corporate espionage by the Chinese.

Nothing may ever come of this. But it's important for the world to know that offer is on the table.

Filed Under: economic espionage, intelligence community, james clapper, lies, nsa, odni, surveillance

James Clapper's Office Declassifies Another Set Of Fully-Redacted Pages

from the also-jabs-public-in-eyes-with-godawful-scans dept

The ODNI continues to comply with court orders from FOIA lawsuits but its compliance is in letter only. Declassifying documents the way the ODNI does isn't helping further the debate on privacy vs. security or making the government's arguments for surveillance dragnets any more clear.

Two more documents were released late Friday, with one of them being more about what it doesn't include than what it does and the other potentially leading to irreversible eye damage.

First up, the FBI's report on the maintenance and use of [REDACTED] databases. About the only thing surviving the redaction knife is a few footnotes which indicate this document has something to do with the pen register/trap and trace bastardization that turned a targeted surveillance technique with a low legal barrier to entry into a broad, untargeted dragnet with a low legal barrier to entry. (PDF link.)

But this is how most of the "declassified" report looks.

Right-margin barely large enough to contain the exemptions.


The unexpected use of black in a sea of white redactions.


All of the above is in addition to several pages that were withheld in their entirety, without even being given the chance to be redacted into uselessness.

What remains is mainly footnotes. One supplies a description of PR/TT surveillance pulled directly from the US code. One references CALEA (Communications Assistance for Law Enforcement Act). One footnote points out that the FBI is not allowed to "affirmatively search" content gathered incidentally by this program, unless, of course, (truck-sized loophole ahead) it needs to "prevent harm to national security."

In total, the document is of zero value to anyone anywhere. No information was freed, nor will it be -- not if intelligence officials have the final say for redactions. The redactions can be challenged, but that's in EPIC's hands.

The second document, a declaration in support of the PR/TT program by CIA director George Tenet, contains more readable info… but just barely. There's a lot of redactions in here as well but the main struggle is reading the remaining text which looks like it was rolled off a myopic, 75-year-old mimeograph. (PDF link.)

Most of Tenet's declaration revolves around threats the CIA was tracking, none of which are allowed past the censor, despite it being a decade later. The name Al-Qaeda appears every so often, and there's hints of a discussion revolving around surveillance tactics and government actions related to the 9/11 attacks, but most of this information is withheld as well.

Interestingly, Tenet notes that the CIA (and other agencies) have picked up signals that signal a "US strike" in the "next four months," possibly in conjunction with the 2004 elections. It also cautions that being too effective may be accelerating terrorists' attack plans, with detainments and other factors possibly causing terrorism leaders to believe their operations are compromised.

Tenet declares all the redacted surveillance programs to have been essential in disrupting terrorists' plans and/or possibly pushing attack timetables forward, noting that the PR/TT has been invaluable in lots of things that are completely redacted. In conclusion, please give the NSA/FBI PR/TT dragnet privileges.

So much for transparency. Even a discontinued surveillance program is subject to page after page of complete redaction, including documents discussing threats over a decade old whose attacks and plans were either thwarted or never came to fruition. The word "declassify" generally is taken to mean a release of information previously withheld, but in the ODNI's hands, all it means is the release of as little as possible.

Filed Under: declassify, foia, james clapper, nsa, odni, surveillance

Senators Slam White House For CIA Torture Report Redactions That Make It 'Incomprehensible'

from the just-release-it dept

The fight over the redactions of the CIA's torture report continue. Last week, Senator Dianne Feinstein noted that she and her staff were somewhat taken aback by the amount of redacted information when they received back the black ink-drenched copy of the executive summary to the $40 million, 6,300 page "devastating" report on the CIA's torture program prepared by the Senate Intelligence Committee. In response, James Clapper shot back that the redactions were "minimal" and over 85% of the document was free from black ink (it's not clear if he was counting the margins as well...).

Of course, as Marcy Wheeler has pointed out, this is just about the executive summary of the report -- which was specifically written to be published. In other words, the really "secret" stuff is in the rest of the report, but the 408 page exec summary was written with public disclosure in mind -- meaning that the Senate Intelligence Committee staffers certainly wrote it with the expectation that it would need few, if any, redactions. So the fact that large chunks of it were redacted immediately set off some alarms.

On Tuesday, multiple Senators on the Intelligence Committee spoke out angrily about the redactions. It kicked off with Feinstein who noted that the review her staff went through of the redactions shows that the censors are trying to hide information that should be public:

“After further review of the redacted version of the executive summary, I have concluded the redactions eliminate or obscure key facts that support the report’s findings and conclusions. Until these redactions are addressed to the committee’s satisfaction, the report will not be made public.

“I am sending a letter today to the president laying out a series of changes to the redactions that we believe are necessary prior to public release. The White House and the intelligence community have committed to working through these changes in good faith. This process will take some time, and the report will not be released until I am satisfied that all redactions are appropriate.

“The bottom line is that the United States must never again make the mistakes documented in this report. I believe the best way to accomplish that is to make public our thorough documentary history of the CIA’s program. That is why I believe taking our time and getting it right is so important, and I will not rush this process.”

Senator Carl Levin then came out with a much more strongly worded condemnation of the redactions suggesting that they were clearly designed to hide embarrassing information, which is not a legitimate reason for redactions:

“The redactions that CIA has proposed to the Intelligence Committee’s report on CIA interrogations are totally unacceptable. Classification should be used to protect sources and methods or the disclosure of information which could compromise national security, not to avoid disclosure of improper acts or embarrassing information. But in reviewing the CIA-proposed redactions, I saw multiple instances where CIA proposes to redact information that has already been publicly disclosed in the Senate Armed Services Committee report on detainee abuse that was reviewed by the administration and authorized for release in 2009. The White House needs to take hold of this process and ensure that all information that should be declassified is declassified.”

Senator Mark Udall issued a statement in which he notes that the "strategic" redactions are used to distort the nature of what's in the report:

"While Director Clapper may be technically correct that the document has been 85 percent declassified, it is also true that strategically placed redactions can make a narrative incomprehensible and can certainly make it more difficult to understand the basis for the findings and conclusions reached in the report. I agree wholeheartedly that redactions are necessary to protect intelligence sources and methods, but the White House must work closely with this committee to reach this goal in a way that makes it possible for the public to understand what happened.

"I am committed to working with Chairman Feinstein to declassify the Senate Intelligence Committee's study to the fullest extent possible, correct the record on the CIA's brutal and ineffective detention and interrogation program, and ensure the CIA learns from its past mistakes. And in light of the importance of the work the Senate Intelligence Committee has undertaken, I believe that the chairman should take all necessary time to ensure that the redactions to the executive summary are appropriate — not merely made to cover up acts that could embarrass the agency.

"The CIA should not face its past with a redaction pen, and the White House must not allow it to do so."

All three of those Senators are well aware of what's in the report, and it appears they recognize that the black ink was being used not to protect national security or "sources and methods" but rather to hide or distort the facts of the CIA's torture program.

Filed Under: carl levin, cia, dianne feinstein, james clapper, mark udall, odni, redactions, senate intelligence committee, torture report, white house

How Serious Is James Clapper About Cybersecurity When His Office Can't Even Get Its SSL Certificate Right?

from the just-asking dept

James Clapper and the Office of the Director of National Intelligence (ODNI) have been among the loudest FUD-spewers concerning the "threats" to cybersecurity out there, and the need for massively dangerous "cybersecurity" legislation that would really just open up the ability for the Intelligence Community to get more access to private data. However, security researcher and ACLU guy Chris Soghoian noticed yesterday that the SSL security certificate on the ODNI website isn't even valid:

The Director of National Intelligence (@ODNIgov) can't be bothered install a valid HTTPS cert on their website #cyber pic.twitter.com/iiPIkFEfhD

— Christopher Soghoian (@csoghoian) July 23, 2014

In response, Soghoian joked: "[ODNI], I'll make you a deal: You fix your website's broken encryption cert, and I'll start to take your cyber fearmongering seriously."

Filed Under: cybersecurity, fud, james clapper, odni, ssl

Court Rules Against EFF In DOJ FOIA Lawsuit... But Mainly Because ODNI Already Declassified Most Of It

from the progress dept

We've joked about how James Clapper and the Office of the Director of National Intelligence (ODNI) like to claim that the various documents they've been declassifying and releasing in the post-Snowden era are decisions they've made out of the goodness of their transparency-loving hearts, when the reality is that much of it is in response to FOIA lawsuits from the EFF. When it comes to Section 702 of the FISA Amendments Act, the part of the law that covers PRISM and (more importantly) the direct "upstream" tapping of the internet backbone via companies like AT&T, EFF had asked for a variety of documents pertaining to how the program was run. After ODNI did everything possible to refuse to provide such documents in any meaningful way, EFF sued.

Following the Snowden revelations, and the sudden "we love transparency*" (*not really) attitude of the ODNI, it started re-reviewing the original redactions and (look at that!) suddenly realized that it didn't actually need to have wasted so much black ink on the originals. EFF continued to push back on certain redactions, and ODNI magically discovered even more wasted black ink. Eventually, huge portions of the various documents that had previously been withheld were revealed. EFF kept pushing, and asked the court to review some of the remaining redactions, just to make sure that ODNI wasn't hiding anything solely out of embarrassment, rather than for legitimate national security purposes. The court got to secretly review the unredacted document, asked some detailed questions of the DOJ, leading to even more redactions falling by the wayside. So, now, finally, after all of that, the judge has basically said that all of the remaining redactions are legitimate, and thus effectively rules "against" the EFF.

However, this is a pretty clear victory for the EFF, considering that during the course of the case it was able to remove many of the original redactions. Of course, this is still problematic, because it highlights how many of those original redactions were clearly improper, and it took this long and convoluted process (and Ed Snowden) before ODNI was willing to reveal these documents concerning a rather key program in how the NSA conducts surveillance.

Filed Under: doj, eff, foia, odni, section 702
Companies: eff

James Clapper Issues Non-Denial Denial Of Greenwald's Story About Surveillance Of Muslim-Americans

from the want-to-try-that-again? dept

We already wrote about Glenn Greenwald's big story concerning how the FBI has been spying on prominent Muslim American politicians, lawyers and civil rights activists. If you follow this stuff closely, you may have heard that Greenwald was originally supposed to publish that story last week, but held off at the last minute due to some "new information" from the government. This resulted in some silly and ill-informed conspiracy theories, but in the article Greenwald explains what actually happened:

The Justice Department did not respond to repeated requests for comment on this story, or for clarification about why the five men’s email addresses appear on the list. But in the weeks before the story was published, The Intercept learned that officials from the department were reaching out to Muslim-American leaders across the country to warn them that the piece would contain errors and misrepresentations, even though it had not yet been written.

Prior to publication, current and former government officials who knew about the story in advance also told another news outlet that no FISA warrant had been obtained against Awad during the period cited. When The Intercept delayed publication to investigate further, the NSA and the Office of the Director of National Intelligence refused to confirm or deny the claim, or to address why any of the men’s names appear on the FISA spreadsheet. Prior to 2008, however, FISA required only an authorization from the attorney general—not a court warrant—for surveillance against Americans located overseas. Awad frequently travelled to the Middle East during the timeframe of his surveillance.

The fact that it was out warning people that the story was inaccurate before anything had even been written is... quite telling. Also, the fact that it only seemed to focus on the lack of a FISA warrant (and against one individual) seems like the standard form of the intelligence community choosing their words especially carefully to say one thing, while implying something else entirely. Now that the report has actually come out, the Office of the Director of National Intelligence (ODNI) has issued a statement that is more of the same. You will note, for instance, that it does not deny spying on the five named individuals -- only that it doesn't spy on people because of their political, religious or activist views:

It is entirely false that U.S. intelligence agencies conduct electronic surveillance of political, religious or activist figures solely because they disagree with public policies or criticize the government, or for exercising constitutional rights.

Unlike some other nations, the United States does not monitor anyone’s communications in order to suppress criticism or to put people at a disadvantage based on their ethnicity, race, gender, sexual orientation or religion.

Our intelligence agencies help protect America by collecting communications when they have a legitimate foreign intelligence or counterintelligence purpose.

Again, note the specific denial they're making. They're not denying they spied on these five individuals. They're claiming that if they spied on them, it wasn't because of their religion -- though the evidence presented in the Intercept article certainly rules out many other explanations. And, remember, it was just a week ago that it was revealed that the NSA, does, in fact, consider people interested in Tor or open source privacy to be extremists. So, while it may be technically true that these individuals weren't targeted because of their religion, it does seem fairly clear that the intelligence community has fairly low standards for what it takes to convince themselves that someone may be a threat.

Furthermore, the statement admits that there are cases where it spies on people without approval from the FISA Court, but doesn't say what those examples are beyond "in an emergency." That may imply the only cases are in an emergency, but that's not what the statement actually says:

With limited exceptions (for example, in an emergency), our intelligence agencies must have a court order from the Foreign Intelligence Surveillance Court to target any U.S. citizen or lawful permanent resident for electronic surveillance.

These court orders are issued by an independent federal judge only if probable cause, based on specific facts, are established that the person is an agent of a foreign power, a terrorist, a spy, or someone who takes orders from a foreign power.

And, again, as the Intercept report itself notes, prior to 2008, there were different standards in place for people traveling overseas (even Americans) which could explain how some of these individuals were targeted.

The ODNI statement more or less concludes by suggesting that the five people named may have been agents of foreign powers, which is quite a claim:

No U.S. person can be the subject of surveillance based solely on First Amendment activities, such as staging public rallies, organizing campaigns, writing critical essays, or expressing personal beliefs.

On the other hand, a person who the court finds is an agent of a foreign power under this rigorous standard is not exempted just because of his or her occupation.

It's a neat little out. Accused of spying on five Americans who pretty clearly do not appear to be agents of foreign powers, just hint strongly that they really are agents of foreign powers. It's back to the good old days of McCarthyism.

Filed Under: fbi, glenn greenwald, james clapper, muslim americans, odni, surveillance

EFF Sues NSA Again Over Failure To Release Procedures For Dealing With Zero Days

from the eff-may-need-a-whole-floor-devoted-to-nsa-lawsuits dept

Another day, another lawsuit filed by the EFF against the NSA. As you may recall, back in April there was some discussion about how the NSA deals with zero day exploits it discovers, and (specifically) whether or not it reveals them to relevant parties or keeps them for its own ability to exploit them. The NY Times revealed that President Obama had put in place an official rule that said the NSA should have a "bias" towards revealing the flaws, but left open a gaping loophole in saying the NSA could exploit those zero days for "a clear national security or law enforcement need." That's a pretty big loophole -- especially when you consider how law enforcement has been abusing every opportunity of late.

EFF filed a FOIA request to find out about the NSA's process for determining whether to exploit or reveal a zero day... and hasn't received a response, despite a promise by the government to "expedite" the request. Hence: the new lawsuit.

"This FOIA suit seeks transparency on one of the least understood elements of the U.S. intelligence community's toolset: security vulnerabilities," EFF Legal Fellow Andrew Crocker said. "These documents are important to the kind of informed debate that the public and the administration agree needs to happen in our country."

Over the last year, U.S. intelligence-gathering techniques have come under great public scrutiny. One controversial element has been how agencies such as the NSA have undermined encryption protocols and used zero days. While an intelligence agency may use a zero day it has discovered or purchased to infiltrate targeted computers or devices, disclosing its existence may result in a patch that will help defend the public against other online adversaries, including identity thieves and foreign governments that may also be aware of the zero day.

"Since these vulnerabilities potentially affect the security of users all over the world, the public has a strong interest in knowing how these agencies are weighing the risks and benefits of using zero days instead of disclosing them to vendors," Global Policy Analyst Eva Galperin said.

These days, it really does seem that the only way to get the government to cough up these kinds of documents is to file a lawsuit, which really defeats the purpose of the whole FOIA process. Perhaps the government should just admit it's a charade and let people go straight to the lawsuit filing process instead.

Filed Under: cybersecurity, exploit, foia, james clapper, nsa, odni, surveillance, zero days
Companies: eff

New FISC Memorandum Says Bulk Metadata Program Still Good To Go Until Congress Or Supreme Court Says Otherwise

from the we-still-have-the-greatest-enthusiasm-and-confidence-in-the-mission dept

As was noted in the writeup of the ODNI's First Ever Transparency Report, this tentative and forced step into transparency was a step forward for No Such Agency, even if each document release has been accompanied by the unmistakable sound of gritting teeth and a nearly universal refusal to acknowledge that most of the "openness" had been compelled by court orders following FOIA lawsuits.

Also noted was the fact that the new transparency was short a few documents, namely the March renewal order for the bulk phone metadata collection. Lo and behold and under the cover of late Friday afternoon (to better be smuggled in as the nation punched its collective timeclock), the Office of the Director of National Intelligence released two orders: the March and June renewals of the bulk records collections.

There's nothing very notable about either of the two renewal orders, both of which say roughly the same thing and wear their fashionable black redaction marks on exactly the same words. What is notable is the memorandum opinion released with them, which details the events that have occurred in recent months that have affected both the collection and the minimization procedures the NSA follows.

In the past few months, two metadata-related lawsuits have resulted in court orders demanding preservation of evidence, some of which was due to age off as part of the normal minimization procedures. The court orders wreaked a bit of havoc in FISC judge Reggie Walton's court, forcing him to first order data to be destroyed (noting again that the minimization procedures were one of the few things that even allowed this bulk collection of American data to be legal) and finally, once the DOJ had stopped misleading him (and the cases' plaintiffs themselves), to halt the destruction of relevant (to the cases, not to counterterrorism) metadata.

Throughout it all, the DOJ performed a remarkable plate-spinning act, keeping all decisions aloft while it contemplated best-case scenarios. Unlike true plate-spinning acts, the DOJ really didn't care whether the plates continued spinning or crashed to the ground, as it's unlikely to ever allow this evidence to be used in court. (Indeed, it spent much of its plate-spinning time destroying data it was ordered to preserve.) Though the three involved courts had plenty to do to ensure the rights of non-NSA Americans weren't violated, the DOJ's main purpose was to shuttle paperwork back and forth until it could be safely revealed that the multi-billion dollar superspyplex was incapable of doing the very thing under discussion: preserving data past the expiration date. (This should have come as no surprise, considering the NSA had announced previously that it was incapable of searching its own email system. [And yet, it claims to have found only one email related to Snowden whistleblowing attempts.])

Also, during the past few months, two contradicting court opinions on the legality of the bulk record collections were released. The one that found it unconstitutional (DC district court judge Richard Leon) was stayed awaiting appeal, changing nothing in the NSA's plans to collect it all, but prompting some reflection from the FISA court. The other confirmed the status quo.

All the while, millions of gallons of prime (and confidential) desert water (acquired at budget rates) continued to flow into the NSA's new Utah spybox even as, ironically, fires broke out within the building itself. The security state is still alive and well… even if it seems to be pausing more frequently to catch its breath and favoring a limb or two.

But back to the order. During the disarray of the last few months, two bulk records orders were renewed. While the memorandum changes nothing, it does at least acknowledge the fact that the collection is under considerable public scrutiny, not to mention awaiting implementation of the administration's reforms. But it does point out that there are really only two entities that can bring a complete halt to this collection -- and so far, neither have made that move.

The unauthorized disclosure of the bulk telephony metadata collection more than a year ago led to many written and oral expressions of opinions about the legality of collecting telephony metadata. Congress is well aware that this Court has interpreted the provisions of 50 U.S.C. 1861 to permit this particular collection, and diverse views about the collection have been expressed by individual members of Congress. In recent months, Congress has contemplated a number of changes to the Foreign Intelligence Surveillance Act, a few of which would specifically prohibit this collection. Congress could enact statutory changes that would prohibit this collection going forward, but under the existing statutory framework, I find that the requested authority for the collection of bulk telephony metadata should be granted. Courts must follow the law as it stands until the Congress or the Supreme Court changes it.

The House stripped the USA Freedom Act of nearly all of its teeth before passage, which makes it a long shot for Congress to explicitly outlaw this collection any time soon. Various other reform measures, including an amendment that slammed one domestic surveillance backdoor shut, have fared better.

The issue may eventually end up in the Supreme Court (which has shot down two attempts already), but despite a recent victory for the Fourth Amendment, the court system's deference to "national security" arguments has generally resulted in wins for the government. Even if it does land in front of the justices, there's little to indicate that whatever case forces consideration of the issue will be the best scenario to "test" the issue, much less provide a solid platform for Fourth Amendment arguments. And even if the Supreme Court does agree bulk records collection violates citizens' rights, the government will swiftly act to ensure the decision has only a minimal effect on its collection efforts.

Finally, there's a small paragraph that indicates that the release of these two documents was, again, not the result of the ODNI's half-hearted embrace of openness.

In light of the public interest in this particular collection and the government's declassification of related materials, including substantial portions of Judge Eagan's August 29 Opinion, Judge McLaughlin's October 11 Memorandum, and Judge Collyer's March 20 Opinion and Order, I request pursuant to FISC Rule 62 that this Memorandum Opinion and Accompanying Primary Order also be published, and I direct such request to the Presiding Judge as required by the Rule.

The rule cited allows FISC judges to order the release of orders, opinions and decisions and is by no means a recent development. The rules date back to 2006, but it's only in the last year that we've seen anyone exercise this option. Does anyone out there think this would have occurred without "unauthorized disclosure?" Those looking to lock up Snowden for his leaks would do well to remember small details like this. Going through "proper channels" wouldn't have forced this level of transparency or prompted the secretive FISA court to start ordering declassifications on its own. It took a whole lot of pushing and the stripping away of layer after layer of secrecy and plausible deniability to achieve this.

Filed Under: bulk records, congress, fisa court, fisc, odni, phone records, section 215, supreme court