Judge Tells DOJ Lawyers That A Search For FOIA Docs Requires More Than Chatting With A Couple Of Employees

from the SEARCH-HARDER dept

Jason Leopold is back in court (is he ever NOT there?) battling the NSA and the DOJ's Office of Legal Counsel (OLC) over the release of documents related to the NSA and FBI's surveillance of federal and state judges. The two parties had already been told to do more looking around for responsive records by Judge Tanya Chutkan, who rejected their original request for summary judgment last July.

The two agencies went back and performed another search. And still came up empty-handed.

Let me rephrase that: the two agencies went back and performed another "search." Here's what that "search" actually entailed, as described in the opinion [PDF].

The search that OLC ultimately conducted pursuant to the court’s July 2015 Memorandum Opinion and Order proceeded as follows:

[A]n OLC attorney asked an OLC Deputy Assistant Attorney General and an OLC Senior Counsel, both of whom are senior attorneys with long tenures in OLC (the Deputy Assistant Attorney General joined the Office in 1989; the Special Counsel joined the Office in 1998, departed for nine years in 2001, and rejoined the Office in 2010) and have close familiarity with OLC’s work on national security and surveillance matters, . . . whether they were aware of any classified or unclassified OLC projects concerning the “propriety of surveilling federal or state judges,” regardless of whether the project resulted in final legal advice. (Id. ¶¶ 6, 9).

“This inquiry yielded no responsive records.” (Id. ¶ 9).

According to the OLC, asking a couple of people if they've heard anything about a surveillance program is the same thing as actually searching its own files using keywords and phrases relevant to the subject matter.

In addition, the OLC claimed that actually searching for these documents would bring its slowly-moving FOIA machinery to a near halt.

Colborn avers that searching OLC’s paper files, the email files of departed OLC attorneys and the hard drives of departed users “likely would take several years and the diversion of resources from other FOIA requests,” which “would result in a dramatic increase in [OLC’s] FOIA processing backlog.”

Judge Chutkan didn't find either of these excuses persuasive. As for the OLC's claim that asking a few in-house lawyers about a surveillance program qualifies as a search for responsive documents, the judge had this to say:

The court agrees with Plaintiff, and finds that the senior attorneys’ responses to this inquiry do not provide sufficient basis to reasonably conclude either that OLC is unlikely to possess responsive records or that responsive records are unlikely to be found by a more in-depth search. Moreover, the court finds that asking all current OLC attorneys if they had, or were aware of, any draft legal memoranda or opinions relating to the propriety of surveilling federal or state judges – as was done here after Plaintiff filed his opposition brief – was also insufficient.

Judge Chutkan points out that there's way too much turnover in staff at the OLC to consider asking all current counsel whether or not they've heard of a program to be an adequate substitute for an actual records search. The latter method wouldn't be nearly so dependent on individuals' memory, or whether those who might be familiar with the surveillance program were still working for the agency.

As for its complaint about "diverted resources" and its FOIA processing backlog, the judge similarly has no sympathy.

The court finds that Defendants have not established that searching the email files of departed OLC attorneys would be unduly burdensome. While Colborn avers that it “likely would take several years and the diversion of resources from other FOIA requests” to search for responsive documents among OLC’s paper files, hard drives and emails, he does not break out the time and resources that would be required to search only the emails of departed OLC attorneys. (Id.). Given that these emails and their attachments can be searched using an eDiscovery tool without needing to open each email and its attachments individually, and in the absence of any representations from Colborn or any other declarant regarding the burden associated with running such searches separate and apart from searching OLC’s paper files and hard drives, Defendants have not demonstrated that doing so would constitute an undue burden.

So, for a second time, Judge Chutkan is forced to tell the OLC how to do its job.

Accordingly, the court hereby ORDERS OLC to use the Clearwell eDiscovery tool referenced in the Fourth Colborn Declaration to search the email files of departed OLC attorneys, as well as any attachments to those emails, for any draft legal memoranda or opinions relating to the propriety of surveilling federal or state judges.

Everyone seems to know what tools are available and how to use them… except the agency "responding" to the FOIA request. A search will finally be performed -- after two motions to dismiss, several misspent tax dollars, and an FOIA requester forced to use the court system to get an agency to do its job correctly.

Filed Under: doj, foia, jason leopold, searches

Prolific FOIA Requester Celebrates 50th Anniversary Of FOIA Law By Suing FBI Over Its Document Search Methods

from the lawsuit-not-so-much-'ironic'-as-it-is-'inevitable' dept

No better way to celebrate the 50th anniversary of the Freedom of Information Act than filing a lawsuit claiming an agency is refusing to comply with it. FOIA enthusiast Ryan Shapiro has done exactly that, suing the DOJ [PDF] for the FBI's continued refusal to perform anything more than a cursory search, using its most outdated software, for responsive records.

Foia requests to the FBI are processed by searching the Automated Case Support system (ACS), a software program that celebrates its 21st birthday this year.

Not only are the records indexed by ACS allegedly inadequate, Shapiro told the Guardian, but the FBI refuses to search the full text of those records as a matter of policy. When few or no records are returned, Shapiro said, the FBI effectively responds “sorry, we tried” without making use of the much more sophisticated search tools at the disposal of internal requestors.

“The FBI’s assertion is akin to suggesting that a search of a limited and arbitrarily produced card catalogue at a vast library is as likely to locate book pages containing a specified search term as a full text search of database containing digitized versions of all the books in that library,” Shapiro said.

Shapiro went meta to prove this point. Along with a handful of requests for documents about the FBI's "mosaic" theory, Shapiro also requested processing notes on the requests themselves. The FBI "failed" to locate much in the way of responsive documents, thanks to its insistence on using 21-year-old software, rather than more modern tools it has at its disposal.

The DOJ -- despite using millions of tax dollars to fund better search tools -- continues to insist it only needs to perform the bare minimum when searching for responsive documents. The software old enough to buy its own booze only searches for terms entered by FBI agents handling cases, not the text included in the files themselves.

It's not that the DOJ doesn't have the capability to perform a more in-depth search. It just feels it doesn't have to do anything more than a cursory surface scan for responsive documents. Whatever fails to turn up in this search is withheld without actually having to be declared "withheld" and justified with a FOIA exemption. Rather than present FOIA requesters with something they can challenge in court, the FBI simply claims it performed a search and shrugs at the lack of responsive files.

This non-responsiveness didn't impress Judge Randolph Moss back in January and it's that decision Shapiro is hoping will help him prevail in this lawsuit.

The FBI's use of an outdated system -- seemingly solely for the purpose of generating as few responsive files as possible -- is well-documented. And yet, there's almost no way to force the FBI to perform thorough searches -- utilizing the multiple tools and databases it has access to -- without dragging the DOJ to court. The FBI knows this, and knows that its unwillingness to utilize its internal FOIA tools is an easy way to discourage FOIA requests, as there are only a few filers with the means to pursue a lawsuit against the government. And any decision by a judge ordering the FBI to perform a more thorough search will be taken by the agency as only applying to the case at hand.

Of course, the FBI will do anything it can to keep Shapiro from obtaining more documents. Shapiro is the FBI's "mosaic" theory defined. The agency seems to fear his ability to pull together information from multiple, overlapping requests. And the DOJ has gone so far as to claim his dissertation research (involving the government's handling of animal rights activists) is a threat to national security. So, it will continue fighting for its "right" to deliberately perform inadequate document searches and maintain its non-responsive status quo.

Filed Under: acs, automated case support, doj, foia, old computers, ryan shapiro

Huge Win: Court Says Microsoft Does Not Need To Respond To US Warrant For Overseas Data

from the big-news dept

We've been following an important case for the past few years about whether or not the US can issue a warrant to an American company for data stored overseas. In this case, Microsoft refused to comply with the warrant for some information hosted in Ireland -- and two years ago a district court ruled against Microsoft and in favor of the US government. Thankfully, the 2nd Circuit appeals court today reversed that ruling and properly noted that US government warrants do not apply to overseas data. This is a hugely important case concerning the privacy and security of our data.

The key issue here is that the US government was basically on a fishing expedition for information hosted on Microsoft Outlook.com email servers. And there are a few really key issues, concerning jurisdiction, privacy and the all important difference between a subpoena and a warrant (something that many people seem to think are the same thing). Microsoft's own response to the lawsuit did a really good job explaining the issues and how the government wanted to pretend a warrant was a subpoena, and what that meant for the 4th Amendment:

The Government cannot seek and a court cannot issue a warrant allowing federal agents to break down the doors of Microsoft's Dublin facility. Likewise, the Government cannot conscript Microsoft to do what it has no authority itself to do -- i.e., execute a warranted search abroad. To end-run these points. the Government argues, and the Magistrate Judge held, that the warrant required by ECPA is not a "warrant" at all. They assert that Congress did not mean "warrant" when using that term, but instead meant some previously unheard of "hybrid" between a warrant and subpoena duces tecum. The Government takes the extraordinary position that by merely serving such a warrant on any U.S.-based email provider, it has the right to obtain the private emails of any subscriber, no matter where in the world the data may be located. and without the knowledge or consent of the subscriber or the relevant foreign government where the data is stored.

This interpretation not only blatantly rewrites the statute, it reads out of the Fourth Amendment the bedrock requirement that the Government must specify the place to be searched with particularity, effectively amending the Constitution for searches of communications held digitally. It would also authorize the Government (including state and local governments) to violate the territorial integrity of sovereign nations and circumvent the commitments made by the United States in mutual legal assistance treaties expressly designed to facilitate cross-border criminal investigations. If this is what Congress intended, it would have made its intent clear in the statute. But the language and the logic of the statute, as well as its legislative history, show that Congress used the word "warrant" in ECPA to mean "warrant," and not some super-powerful "hybrid subpoena." And Congress used the term "warrant" expecting that the Government would be bound by all the inherent limitations of warrants, including the limitation that warrants may not be issued to obtain evidence located in the territory of another sovereign nation.

The Government's interpretation ignores the profound and well established differences between a warrant and a subpoena. A warrant gives the Government the power to seize evidence without notice or affording an opportunity to challenge the seizure in advance. But it requires a specific description (supported by probable cause) of the thing to be seized and the place to be searched and that place must be in the United States. A subpoena duces tecum, on the other hand, does not authorize a search and seizure of the private communications of a third party. Rather. it gives the Government the power to require a person to collect items within her possession, custody, or control, regardless of location, and bring them to court at an appointed time. It also affords the recipient an opportunity to move in advance to quash. Here, the Government wants to exploit the power of a warrant and the sweeping geographic scope of a subpoena, without having to comply with fundamental protections provided by either. There is not a shred of support in the statute or its legislative history for the proposition that Congress intended to allow the Government to mix and match like this. In fact, Congress recognized the basic distinction between a warrant and a subpoena in ECPA when it authorized the Government to obtain certain types of data with a subpoena or a "court order," but required a warrant to obtain a person's most sensitive and constitutionally protected information -- the contents of emails less than 6 months old.

It was unfortunate that two judges at the district court level basically ignored this argument, so it's good to see the appeals court shoot it down completely.

For the reasons that follow, we think that Microsoft has the better of the argument. When, in 1986, Congress passed the Stored Communications Act as part of the broader Electronic Communications Privacy Act, its aim was to protect user privacy in the context of new technology that required a user’s interaction with a service provider. Neither explicitly nor implicitly does the statute envision the application of its warrant provisions overseas. Three decades ago, international boundaries were not so routinely crossed as they are today, when service providers rely on worldwide networks of hardware to satisfy users’ 21st–century demands for access and speed and their related, evolving expectations of privacy.

Rather, in keeping with the pressing needs of the day, Congress focused on providing basic safeguards for the privacy of domestic users. Accordingly, we think it employed the term “warrant” in the Act to require pre‐disclosure scrutiny of the requested search and seizure by a neutral third party, and thereby to afford heightened privacy protection in the United States. It did not abandon the instrument’s territorial limitations and other constitutional requirements. The application of the Act that the government proposes ― interpreting “warrant” to require a service provider to retrieve material from beyond the borders of the United States ―would require us to disregard the presumption against extraterritoriality that the Supreme Court re‐stated and emphasized in Morrison v. National Australian Bank Ltd., 561 U.S. 247 (2010) and, just recently, in RJR Nabisco, Inc. v. European Cmty., 579 U.S. __, 2016 WL 3369423 (June 20, 2016). We are not at liberty to do so.

In the full discussion, the court points out where the lower court went wrong, thinking that thanks to the PATRIOT Act, a warrant could apply to the location of the service provider rather than the location of the server. But the court says that's clearly wrong, and the Congressional record makes it pretty clear that it was looking to apply the law just to the United States. As for the idea that the warrant was really a subpoena in disguise, the court says that's not how it works:

Warrants and subpoenas are, and have long been, distinct legal instruments. Section 2703 of the SCA recognizes this distinction and, unsurprisingly, uses the “warrant” requirement to signal (and to provide) a greater level of protection to priority stored communications, and “subpoenas” to signal (and provide) a lesser level. 18 U.S.C. § 2703(a), (b)(1)(A). Section 2703 does not use the terms interchangeably. Id. Nor does it use the word “hybrid” to describe an SCA warrant. Indeed, § 2703 places priority stored communications entirely outside the reach of an SCA subpoena, absent compliance with the notice provisions. Id. The term “subpoena,” therefore, stands separately in the statute, as in ordinary usage, from the term “warrant.” We see no reasonable basis in the statute from which to infer that Congress used “warrant” to mean “subpoena.”

[....] We see no reason to believe that Congress intended to jettison the centuries of law requiring the issuance and performance of warrants in specified, domestic locations, or to replace the traditional warrant with a novel instrument of international application.

There is, of course, the further issue of Microsoft being a US company, but the court says that doesn't magically make its overseas data subject to these kinds of warrants, because the intent of the law is to protect the privacy of users' communications, not to make it easier for the government to snoop.

The reader will recall the SCA’s provisions regarding the production of electronic communication content: In sum, for priority stored communications, “a governmental entity may require the disclosure . . . of the contents of a wire or electronic communication . . . only pursuant to a warrant issued using the rules described in the Federal Rules of Criminal Procedure,” except (in certain cases) if notice is given to the user....

In our view, the most natural reading of this language in the context of the Act suggests a legislative focus on the privacy of stored communications. Warrants under § 2703 must issue under the Federal Rules of Criminal Procedure, whose Rule 41 is undergirded by the Constitution’s protections of citizens’ privacy against unlawful searches and seizures. And more generally, § 2703’s warrant language appears in a statute entitled the Electronic Communications Privacy Act, suggesting privacy as a key concern.

The overall effect is the embodiment of an expectation of privacy in those communications, notwithstanding the role of service providers in their transmission and storage, and the imposition of procedural restrictions on the government’s (and other third party) access to priority stored communications. The circumstances in which the communications have been stored serve as a proxy for the intensity of the user’s privacy interests, dictating the stringency of the procedural protection they receive—in particular whether the Act’s warrant provisions, subpoena provisions, or its § 2703(d) court order provisions govern a disclosure desired by the government. Accordingly, we think it fair to conclude based on the plain meaning of the text that the privacy of the stored communications is the “object[] of the statute’s solicitude,” and the focus of its provisions.

The court goes on at length arguing that the Stored Communications Act's default is that communication privacy must be protected, and the exceptions are narrow.

All three judges on the panel agreed, but one -- Judge Gerard Lynch -- wrote a concurrence that tries to undercut the strong 4th Amendment/privacy arguments in the overall opinion, basically noting that he believes the decision doesn't come down to 4th Amendment issues or privacy protection, but merely how Congress drew up the law in the Stored Communications Act -- and basically argues that if Congress doesn't like this result, it can just rewrite the law.

It's also important to note that Rule 41 is the underpinning of much of this case, and that's the rule that the courts recently agreed to change to allow the DOJ more power to simply hack overseas servers. That shouldn't directly impact this particular case or similar situations, but does show how the DOJ is looking for ways to create endruns around limitations on domestic laws to try to get international data.

Still, for now, this ruling is a surprisingly good one, reinforcing privacy protections in overseas data. Kudos to Microsoft for going to court over this when it would have been quite easy for it to just give in and hand over the data. I assume that the US government will seek to get this ruling overturned, either via an en banc hearing on the 2nd Circuit or going to the Supreme Court, so the case isn't over yet. But, as for right now, it's in a good position.

Filed Under: 2nd circuit, 4th amendment, communications, doj, ecpa, email, ireland, jurisdiction, privacy, sca, subpoena, warrant
Companies: microsoft

Judge Upholds UPS Employee/Paid Informant's Search Of An Intercepted Package

from the can't-challenge-what-you've-taken-steps-to-distance-from-yourself dept

Maybe this is part of UPS's large settlement with the DOJ. Maybe this is what FedEx won't do, which is why the DOJ tried to prosecute it for aiding and abetting illicit drug sales, right up until a federal judge called its prosecution "novel" and ushered it out of the court.

Whatever the case, there's at least one "inside man" (in this case a woman) at the UPS. A San Bernardino UPS store owner acted as a "citizen informant" for the county sheriff. In exchange for unspecified "compensation," the store owner would flag suspicious packages and call in the Sheriff's Department to come in and have a look/sniff at said shipments.

All well and good, if that's the sort of service you expect from a private company, rather than, say, the US Postal Service, which presumably does this sort of thing all the time. The Sheriff's Department, however, did instruct the store owner that she was not to open any suspicious packages.

So much for that. From the suppression order [PDF] (via Brad Heath):

On May 27, 2014, the UPS store owner contacted Officer Kristina Winegar, a deputy assigned to the narcotics division/parcel interdiction team in the Sheriff’s Department in the County of San Bernardino, California, about a “suspicious package.” The UPS store owner told the deputy that a black male entered the UPS store and paid $90 to have the package shipped to Houma, Louisiana. According to the deputy’s police report, “[d]ue to the [cost of shipping the package] and suspicious behavior of the suspect,” the store owner opened the package and found a container wrapped in cellophane. The store owner smelled a chemical order and resealed the box. The sender of the package, who provided the UPS store with the name “Sam Niel” and a Louisiana phone number, listed “John Lirette” in Houma as the recipient. The shipper used the UPS store address as the return address for the package.

You can't undo a package opening, even with access to official UPS box-sealing tape -- not under the Fourth Amendment. That's what led to this suppression hearing. The sheriff's department showed up and discovered that no "Sam Niel" existed in its criminal record database. It grabbed a dog to sniff the package. The dog alerted. Finally, a warrant was obtained to search the contents of the box that had already sort of been searched by a UPS employee on the Sheriff Department's payroll. This search led to a "controlled delivery" to the address on the box. That residence was also searched.

"Sam Niel," whose given name is actually Phillips Thompson, moved to suppress the evidence as the result of an illegal search. He might have had a point, too. A paid "citizen informant" working for the government and performing "private searches" (against instructions) is very different than non-government employees doing the same thing. The Geek Squad member who comes across child porn while repairing a computer performs a private search, and that's perfectly legal and constitutional.

The government is generally discouraged from availing itself of private searches, especially when it's paying someone at a private company to act on its behalf. So, interesting questions might have been raised, if not for the use of an "alias."

"Sam Niel" does not exist, therefore Phillips Thompson cannot challenge the search. It's a form of disavowal and the courts will not let someone make two incompatible claims:

1. That's not my stuff.

2. The search of that stuff was unconstitutional.

Suppression denied. But that ruling doesn't eliminate another interesting, but mostly unexplored, aspect of this decision. As Scott Greenfield points out, what the government refers to as an "alias," and ties solely to criminal activity, could be something far more innocuous.

Notice that it’s called an “alias” here, whereas it might be called a pseudonym if he used the name “Sam Niel” in a comment to this post telling me that I’m a dumbass. The distinction is that an alias is what’s used to conceal an identity to commit a crime, while a ‘nym is a time-honored, First Amendment protected, effort at quasi-anonymity.

But the government’s argument raises troubling issues. While a person’s intention to conceal his identity may be protected anonymity, should the government allege that its use related to crime, it would, by the government’s argument, morph into an alias, designed to distance the person from the offense. And further by the government’s argument, deprive a person of their right to challenge evidence based on this notion that he “forfeited any objectively reasonable expectation of privacy.”

As we're well aware, the US Postal Service scans every package and envelope and makes this available to law enforcement agencies on request (no warrant required). Maybe you feel the government doesn't really need to know who is sending communications back and forth, just the destination. You use fake names to throw off this tracking or just to dump some garbage data into the bulk collection. There's nothing illegal about it, but the government has determined that -- should one of these packages be searched -- you cannot challenge the search because you've used an "alias." Whatever bit of privacy you've tried to take back by using a pseudonym has only served to prevent you from challenging inspection of the communications content.

To put it another way, most people's email addresses aren't reflective of their real names. NSLs and subpoenas can grab to/from data but not the content. If the government treats email addresses as "aliases," the contents of communications are quickly painted as somehow criminal and it could argue the fake "name" contained in the email address is nothing more than the sender trying to distance themselves from what's contained in the messages. So much for suppression.

Of course, many email addresses are tied to actual people and that identifying info can be obtained from the service provider. But what about throwaway accounts containing nothing linking them to an actual person? There may be no criminal activity but it would be extremely difficult to challenge a search of email contents if someone has made an effort to distance the communications from themself and/or the other parts of their online identity. Pseudonymous speech is apparently protected by the First Amendment. Not so much by the Fourth.

Filed Under: 4th amendment, doj, informants, paid informants, searches, ups
Companies: fedex, ups

Leak Reveals Secret FBI Guidelines That Basically Give Them Free Rein To Spy On Journalists And Sources

from the not-cool,-doj dept

Eleven months ago, we wrote about a lawsuit filed by the Freedom of the Press Foundation seeking to get a copy of the DOJ's infamous new rules for spying on journalists. The new rules came about after it had come out that the DOJ had spied on Associated Press reporters as well as lied to a court to claim that Fox News reporter James Rosen was a co-conspirator in a leak investigation. To date, the DOJ has steadfastly refused to reveal the rules.

Thankfully, someone has now leaked the rules, or at least the 2013 version of some of the rules, which show that, contrary to what then Attorney General Eric Holder had suggested, it's still ridiculously easy for the FBI to spy on reporters and their sources in trying to hunt down a leak. In fact, it appears that these rules, around the use of NSLs are actually separate from the rules that Holder was talking about -- meaning that there's an entirely separate path for the DOJ to spy on journalists. The rules show that the FBI can just issue a National Security Letter (NSL), the mechanism that the FBI has been known to regularly abuse without consequence and which it's trying to expand. The "process" by which the media is supposedly protected under these new rules is that if someone in the DOJ is seeking an NSL to get phone records of someone in the media, they need to get some permission from someone else in the DOJ first: This is the fox watching the henhouse. These are not restrictions, these are just the DOJ getting to ask itself if it really wants to spy on these journalists, and the DOJ telling itself "sure, go ahead." There's a further exception that if someone is a member of the media, but the FBI "suspects" they're an intelligence officer or affiliated with a foreign intelligence service, "no additional approval requirements" are needed. So, as with the Rosen case, the FBI can just declare him a "co-conspirator" and voila, no approval necessary.

As the Freedom of the Press Foundation explains in response to this leak, this completely undermines the claims by the DOJ that there were strict controls on spying on journalists:

First, the rules clearly indicate—in two separate places—that NSLs can specifically be used to conduct surveillance on reporters and sources in leak investigations. This is quite disturbing, since the Justice Department spent two years trying to convince the public that it updated its “Media Guidelines” to create a very high and restrictive bar for when and how they could spy on journalists using regular subpoenas and court orders. These leaked rules prove that the FBI and DOJ can completely circumvent the Media Guidelines and just use an NSL in total secrecy.

Second, the DOJ told the New York Times in 2013 that, despite NSLs being exempt from the media guidelines, they were still used under a “strict legal regime.” Well, the “strict legal regime” here is basically non-existent. The only extra step the FBI has to go through to spy on journalists with an NSL—besides the normal, lax NSL procedures, which they have flagrantly and repeatedly violated over the past decade—is essentially get the sign off of a superior in the Justice Department. That’s it! They don’t have to even go through the motions for following any of the several rules laid out in the DOJ media guidelines: like get the Attorney General to sign off, exhaust all other means of investigation, alerting and negotiating with the affected media organization, making sure what is being sought is essential to the investigation, etc.

There's a separate important question here too: why were these rules kept secret? There is no national security reason to keep this secret. It does not reveal anything that helps anyone avoid surveillance. As Freedom of the Press Foundation notes, it appears the only reason to keep this secret is to avoid the embarrassment.

The information that has been redacted here by the Justice Department – and which they are fighting to keep secret in court – is incredibly mundane. The fact that the FBI has to get another person in the bureaucracy to sign off on a particular investigation should not be a state secret, nor would it remotely harm any ongoing investigation, nor would “tip off” any alleged criminals to how to evade surveillance.

The only reason to keep these rules secret, it seems, is that it’s incredibly embarrassing for the FBI to admit that they can use NSLs in leak cases to go after journalists. The fact that the FBI and DOJ are keeping these rules is outrageous, and they should use this opportunity to officially release the rules—and any updates to them—immediately.

The Foundation is also planning to continue its lawsuit for two reasons. First, as mentioned in the quote above, it wants the DOJ to officially release the rules, and, more importantly, it believes that the rules may have been updated since these 2013 rules were published.

The whole thing, once again, shows just how ridiculous this administration has been concerning protecting the rights of journalists to talk to confidential sources. "The most transparent administration in history" once again seems to be the exact opposite. Undermining the freedom of the press and spying on reporters and their sources is shameful. It's the activity of tyrants and insecure dictators, not democratically elected governments.

Filed Under: doj, fbi, journalists, national security letters, nsls, oversight, surveillance
Companies: freedom of the press foundation

Post Gag Order, Lavabit Founder Reveals Non-Secret That Feds Were After Ed Snowden's Emails

from the the-least-surprising-news-ever dept

Want some unsurprising news? Apparently a three year gag order has just lapsed, allowing Ladar Levison, the founder and former operator of Lavabit, the secure email service Ed Snowden famously used, to finally say that yes, the feds asked him to turn over his encryption key in order to access Ed Snowden's emails.

Lavabit founder Ladar Levison can finally confirm that Edward Snowden was the target of the 2013 investigation, which led to the shutdown of the Lavabit email service. The original case concerned law enforcement’s authority to compel the disclosure of an SSL/TLS private key, which belonged to Lavabit, and was used to protect the communications of all 410,000 customers, when only one of those customers was the subject of a criminal investigation. After three years, and five separate attempts, the federal judge overseeing the case has granted Mr. Levison permission to speak freely about investigation. The recently delivered court decision unseals the vast majority of the court filings, and releases Mr. Levison from the gag order, which has limited his ability to discuss the proceedings until now.

Mr. Levison has consistently relied on the First Amendment in his court filings, which sought to remove the gag orders entered against him. He argued that such orders are an unconstitutional restraint against speech, and an afront to the democratic process. He plans to use his newfound freedom to discuss the case during a planned presentation on Compelled Decryption at DEF CON 24 in Las Vegas, NV.

Of course, the fact that the feds were after Snowden isn't exactly news. First off, it's what everyone assumed the second the site shut itself down. But, more importantly, earlier this year, a redaction failure revealed it directly: Still, it's good that the gag order has finally been lifted, and it's great that Levison is now going to talk about these issues more widely. He also notes plans to create a legal defense foundation to help with similar cases:

In order to continue the fight, Mr. Levison is forming the Lavabit Legal Defense Foundation (or “LavaLegal”), a non-profit organization founded to, among other things, protect service providers from becoming complicit in unconstitutional activities, and fight secret attempts aimed circumventing digital privacy or impinging upon the right of those involved to speak of the experience. The foundation will be funded by donations from people and organizations all over the world that want to help protect digital privacy and bolster our collective defense against government overreach.

Filed Under: doj, ed snowden, encryption, first amendment, gag order, keys, ladar levison, service providers
Companies: lavabit

Senate Just Barely Rejects Plan To Expand FBI Surveillance Powers

from the two-votes dept

Just yesterday we wrote about how the Senate was, somewhat ridiculously, rapidly pushing forward plans on a vote for an amendment to the laws concerning what information the FBI can gather using National Security Letters (NSLs). Despite the fact that the big push for this bill began a few weeks ago, and the fact that it had absolutely nothing whatsoever to do with the Orlando shooting, cynical Senators including John McCain and Mitch McConnell pointed to the shootings in Orlando as a reason that this expansion of FBI surveillance powers was needed. Of course, the reality is that it wasn't needed, and the law is really there to paper over the fact that the FBI has already been widely abusing its NSL powers to get information it's not allowed to request.

After a vocal debate this morning, the measure (somewhat surprisingly) failed to pass, but by just two votes. It need 60 votes to move forward (it was a vote for "cloture" on debate, which requires 60 votes), and it only received 58. But McConnell already made it clear that the amendment will be reconsidered soon, which means he's likely going to be pushing strongly to get those two remaining votes.

In other words, this particular debate is far from over, and thus it's important to make sure your Senator knows not to support this. You can see the roll call on the votes here to see what your Senators voted. Somewhat surprisingly, neither of my Senators in California voted for it. Feinstein didn't vote or wasn't present and Boxer voted against. I'm guessing that Feinstein would likely vote for it in a revote, given her willingness to support greater surveillance, so it's possible that McConnell really only needs one more vote, unless people can convince some of the "Yea" voters to change their mind.

Filed Under: 4th amendment, doj, fbi, john mccain, mitch mcconnell, national security letters, nsls, politics, warrants

DOJ Insists That Rule 41 Change Is Not Important, Nothing To See Here, Move On Annoying Privacy Activist People

from the try-that-one-again? dept

We've been talking a lot about Rule 41 lately around here. As we've discussed, the DOJ had pushed for an update to the rule, basically granting the FBI much greater powers to hack into lots of computers, including those abroad (possibly creating diplomatic issues). We've been discussing the problems with the DOJ's proposed change for years, and we haven't been alone. Civil liberties groups and tech companies have both blasted the plans, but to no avail.

Back in March, a judicial panel approved the DOJ's proposed changes, and the Supreme Court gave its blessing a month later. The rule changes are set to go into effect on December 1st if they're not stopped. Senators Ron Wyden and Rand Paul have introduced a bill to block them, while the EFF, Tor and friends have kicked off a big No Global Warrants campaign, encouraging Congress to block this change.

The DOJ is being fairly proactive in trying to brush aside concerns about the Rule 41 change, and earlier this week put up a blog post insisting that there's nothing to see here at all, and everyone who's worried should just move along already.

The amendments do not change any of the traditional protections and procedures under the Fourth Amendment, such as the requirement that the government establish probable cause. Rather, the amendments would merely ensure that at least one court is available to consider whether a particular warrant application comports with the Fourth Amendment.

The amendments would not authorize the government to undertake any search or seizure or use any remote search technique, whether inside or outside the United States, that is not already permitted under current law. The use of remote searches is not new and warrants for remote searches are currently issued under Rule 41. In addition, most courts already permit the search of multiple computers pursuant to a single warrant so long as necessary legal requirements are met.

This is... skirting the truth, at best. Under the existing Rule 41, there are clear limits on warrants that are outside the jurisdiction of the court (see 41(b)). The new Rule 41 wipes away many of those restrictions by adding an entirely new form of warrants for "remote access to search electronic storage media." This is the kind of thing that Congress is supposed to decide upon, not the courts at the behest of the DOJ. If Congress hasn't granted this authority, it's pretty ridiculous for the courts to just do it on their own, and, furthermore, to insist this is little more than an administrative change.

The DOJ also leaves out that the new rules also effectively wipe out the requirement to give a copy of the warrant to the person whose computers are being hacked. Yes, the new rules require a "receipt" but they switch to a "reasonable efforts" standard, rather than the current standard, which is that they must give it to the person or "leave a copy" where the property was taken. That pretty much guarantees that some of the people who are hacked following this won't even know about it.

And if it were really true that this new rule doesn't change anything, then why is the DOJ pushing so hard for it? Remember that a bunch of courts have been throwing out some of these searches as being illegal, so clearly there's an issue here.

The DOJ insists that the new rules only apply in narrow cases WHERE YOU SHOULD ALL BE AFRAID because EXPLOITED CHILDREN ARE AT RISK IF YOU DON'T ALL SHUT UP.

First, where a suspect has hidden the location of his or her computer using technological means, the changes to Rule 41 would ensure that federal agents know which judge to go to in order to apply for a warrant. For example, if agents are investigating criminals who are sexually exploiting children and uploading videos of that exploitation for others to see—but concealing their locations through anonymizing technology—agents will be able to apply for a search warrant to discover where they are located. A recent investigation that utilized this type of search warrant identified dozens of children who suffered sexual abuse at the hands of the offenders. While some federal courts hearing cases arising from this investigation have upheld the warrant as lawful, others have ordered the suppression of evidence based solely on the lack of clear venue in the current version of the rule.

I'm all for the DOJ going after people sexually exploiting children. It seems like a pretty good use of their time. But we should always be skeptical when law enforcement starts throwing out "sexually exploited children!" and "terrorism!" as reasons to upend existing rules. Especially when they cover something as important as how broadly the FBI and DOJ can hack into people's computers.

The FBI has a rather long history of abusing its surveillance powers, and especially seeking to avoid strict oversight. Approving such a change just because the DOJ is insisting it's "FOR THE CHILDREN, WON'T YOU PLEASE THINK OF THE CHILDREN!" isn't a particularly good reason. If the DOJ really thinks this kind of expansion of its ability to hack computers both at home and overseas (again: this is a diplomatic nightmare waiting to happen) is really so important, then it should have Congress pass a law, rather than insisting that it's nothing more than an administrative change to clarify a rule.

Filed Under: doj, fbi, fud, hacking, jurisdiction, privacy, rule 41, warrants

DOJ Drops Stupid Drug Trafficking Charges Against FedEx After Judge Criticizes Its 'Novel Prosecution'

from the The-Man-reluctantly-moves-on-to-hassling-other-parties dept

After two years, the DOJ has decided to drop its bogus conspiracy/drug trafficking case against Federal Express. In July 2014, FedEx was hit with an indictment for allegedly knowingly delivering illegal/counterfeit drugs to a handful of sketchy recipients.

The government insisted FedEx perform interdiction efforts for it by opening boxes and determining (without guidance) whether or not the contents were legit. FedEx pointed out that it was in the package delivery business, not the law enforcement business. The DEA shrugged and said, "Do better." FedEx said, "Why don't you give us a list of people/businesses you think are engaged in illegal activities?" The DOJ refused to do so and rewarded FedEx's good faith efforts with an indictment.

An indictment is easy to obtain, as anyone familiar with the machinations of grand juries is aware. The DOJ's case, however, immediately fell apart after it dragged its purple and orange ham sandwich into a process that's actually adversarial. Judge Charles Breyer -- who we know from his hilariously-redacted denial of HP's heavily-redacted request to seal documents and his interest in the FBI's possibly-illegal courthouse step wiretaps -- presided over the opening arguments… and that was pretty much all he had to hear.

Maria Dinzeo of Courthouse News Service reports:

Addressing the court briefly, Breyer said, "I'm quite familiar with this industry. I'm deeply concerned by tragic consequences caused by sales of toxic substances to individuals, including children, who have not had a direct consultation with a licensed physician"

But this case was "entirely different," Breyer said. "The court has been asked to determine if defendant should be held criminally liable as a co-conspirator. As a result of detailed opening statements by the government and defense and accepting factual assertions as uncontested, the court concludes the defendants are factually innocent. They did not have criminal intent."

Breyer emphasized that FedEx repeatedly offered to help the government, asking officials to identify a particular customer shipping illegal substances, so that it might stop picking up its packages.

"The DEA was unwilling or incapable of providing that information to FedEx," Breyer said. "Rather the government decided to pursue this novel prosecution."

When judges call something "novel," it's rarely because they're impressed. "Novel" is a polite way of saying "bullshit." Or "insane." It's a word pro se plaintiffs hear quite frequently. The DOJ is probably not quite as used to it, as even its weakest arguments tend to be granted more deference than they deserve.

That was enough to convince the DOJ to drop the charges, wrapping up another ridiculous situation where drug warrior zealotry has culminated in The Man sticking it to Himself.

The DEA certainly could have intercepted suspicious packages and examined them itself, but it chose to pass that burden on to the intermediary. This suggests its investigations aren't going as smoothly as it might have hoped. Probable cause for search warrants isn't a particularly high bar, but the DEA presumably either can't meet it, or would rather let others do the work for it and save it the trouble of filling out the paperwork.

Filed Under: dea, deliveries, doj, drug trafficking
Companies: fedex

FBI's Facial Recognition Database Still Huge, Still Inaccurate, And DOJ Shows Zero Interest In Improving It

from the ALL-YOUR-FACE-ARE-BELONG-TO-US dept

The FBI's biometric database continues to grow. Its Next Generation Identification system (NGI) is grabbing everything it can from multiple sources, compiling millions of records containing faces, tattoos, fingerprints, etc. from a blend of criminal and non-criminal databases. It went live in 2014, but without being accompanied by the Privacy Impact Assessment (PIA) it promised to deliver back in 2012.

Lawsuits and pressure from legislators finally forced the FBI to comply with government requirements. That doesn't mean the FBI has fully complied, not even two years past the rollout. And it has no interest in doing so in the future. It's currently fighting to have its massive database exempted from federal privacy laws.

Much of the information we have about the FBI's NGI database has come from outside sources. The EFF and EPIC have forced documentation out of the agency's hands via FOIA lawsuits. And now, the Government Accountability Office (in an investigation prompted by Sen. Al Franken) is turning over more information to the public with its review of the system.

What the GAO found is more bad news. The FBI is all about collecting data. It has little interest in ensuring the data is accurate or even usable.

The FBI’s system searches not just its own database, but also photo databases maintained by seven participating states, the US Department of State – which issues passports – and the US Department of Defense, shared among federal law enforcement agencies and the participating agencies, though access on the state level is obtained through the FBI.

This is only part of the NGI. To amass the 411 million photos it has collected to this point, the FBI dumps in the contents of a national criminal database.

[T]he GAO report found a much larger program, run by the criminal justice information services division of the FBI (CJIS), called Facial Analysis, Comparison and Evaluation, or Face, which “conducts face recognition searches on NGI-IPS and can access external partners’ face recognition systems to support FBI active investigations”.

The multiple inputs -- which allow criminal and non-criminal biometric data to intermingle -- still return an alarmingly high number of false positives. According to data obtained by EPIC, the facial recognition portion shows an error rate of 15-20% in the top 50 results returned from searches. That was the error rate in 2010. We can assume the hit rate has improved since then, but we have no way of knowing what the current error rate is because the FBI is uninterested in policing the accuracy of its database.

From the GAO report [PDF]:

Prior to deploying NGI-IPS, the FBI conducted limited testing to evaluate whether face recognition searches returned matches to persons in the database (the detection rate) within a candidate list of 50, but has not assessed how often errors occur. FBI officials stated that they do not know, and have not tested, the detection rate for candidate list sizes smaller than 50, which users sometimes request from the FBI… Additionally, the FBI has not taken steps to determine whether the face recognition systems used by external partners, such as states and federal agencies, are sufficiently accurate for use by FACE Services to support FBI investigations

The GAO report also points out the FBI has been severely delinquent in its obligations to the public. Reports it was supposed to deliver prior to rollout have only just recently appeared, including one release apparently prompted by the GAO's assessment of the NGI program.

NGI-IPS has been in place since 2011, but DOJ did not publish a System of Records Notice (SORN) that addresses the FBI's use of face recognition capabilities, as required by law, until May 5, 2016, after completion of GAO's review. The timely publishing of a SORN would improve the public's understanding of how NGI uses and protects personal information.

The GAO has made six recommendations to the agency, three of which are being disputed by the DOJ. According to the DOJ, the reason for the mandatory reports being delivered after-the-fact doesn't need to be examined because the FBI "has established practices that protect privacy and civil liberties beyond the requirements of the law." This sounds like the FBI has "nothing to hide," which is at odds with the lack of responsiveness by the agency to demands for updated PIAs and SORNs over the last eight years.

The DOJ also disagrees that it should have to audit the facial recognition database's "hit rate," something that was only 80-85% accurate five years ago. (In fact, the FBI's specifications consider 85% accuracy to be acceptable when returning lists of possible suspects.) The DOJ claims the database can never return a false positive because it apparently has enough manpower and resources to chase down every bogus lead.

In its response, DOJ stated that because searches of NGI-IPS produce a gallery of likely candidates to be used as investigative leads instead of for positive identification, NGI-IPS cannot produce false positives and there is no false positive rate for the system.

The GAO understandably disagrees. Accuracy is important, especially if the FBI is going to put innocent people under investigation… or overlook potentially dangerous suspects.

Without actual assessments of the results from its state and federal partners, the FBI is making decisions to enter into agreements based on assumptions that the search results may provide valuable investigative leads. In addition, we disagree with DOJ’s assertion that manual review of automated search results is sufficient. Even with a manual review process, the FBI could miss investigative leads if a partner does not have a sufficiently accurate system.

The DOJ apparently still feels a 20% chance of putting the wrong person under investigation is still acceptable. And it still believes that it's so far ahead of the privacy curve that it doesn't need to apprise the public of the potential privacy implications of its massive biometric database. The information forced out of its hands by litigants and outside agencies shows the FBI is far more interested in collection than dissemination -- that it should be able to take all it wants from the public without having to hand out anything in return.

Filed Under: accuracy, doj, facial recognition, fbi, next generation identification, ngi, privacy