On Second Thought: Why Was Verizon's Challenge To Bulk Phone Records Collection So Weak?

from the you-can-do-better-than-that dept

On Friday we wrote about an unnamed phone company apparently challenging the FISA Court's order to hand over certain phone records on basically every phone call, noting that the FISA Court shot down that challenge. The phone company was not identified, but the Washington Post says that people have confirmed that it's Verizon. That isn't all that surprising. As far as we know, the Section 215 bulk phone record orders are mainly used on Verizon and AT&T, but not other, smaller phone companies.

In our post, we suggested the nameless telco deserved kudos for actually challenging the order, but in retrospect, the company only deserves very partial kudos. First, assuming it's Verizon, the company has been receiving these orders every three months for something close to eight years. And it just challenged them now? Second, the challenged relied entirely on Judge Richard Leon's ruling from December that found the Section 215 program unconstitutional. Verizon did not make any specific statutory or constitutional challenges itself to the order. It just pointed to Judge Leon's ruling and said that, based on that ruling, it was questioning the order. In fact, it's not even clear if Verizon was actively challenging the order, or just asking for clarification based on Judge Leon's ruling.

That's a fairly weak challenge, and allowed FISC judge Rosemary Collyer to just handwave away Judge Leon's arguments, without Verizon having to present any real arguments itself. It's a challenge, certainly, but a rather weak one that Verizon had to know it would lose, and which didn't require much effort at all.

Filed Under: fisa court, fisc, richard leon, rosemary collyer, section 215
Companies: verizon

Unnamed Phone Company Challenges NSA's Bulk Records Collection; FISC Says It's Perfectly Legal

from the of-course-they-would dept

Late on Friday, the FISA Court unclassified a few documents, including a ruling on an until now secret attempt by a telco to challenge the latest FISC order demanding that the telco hand over metadata on all phone records under Section 215 of the Patriot Act. The telco's name is redacted, but it relied entirely on Judge Richard Leon's ruling from December, which found the bulk collection of phone records unconstitutional. Basically, the telco appears to have received the renewed Section 215 bulk collection order from FISC in January, and then challenged it on the basis of Judge Leon's ruling. The FISC shoots down that challenge, rejecting Judge Leon's reasoning, and insisting that bulk collection of phone records is perfectly legal and constitutional.

Turning now to the merits of the Fourth Amendment issue, this Court finds Judge Leon's analysis in Klayman to be unpersuasive and concludes that it provides no basis for vacating or modifying the Secondary Order issued [REDACTED] January 3, 2014....

FISC, of course, immediately highlights the infamous Smith v. Maryland case that all defenders of bulk collection point to (and which Judge Leon said did not apply here, given the very different circumstances). But, FISC still argues it applies claiming that the differences are "indistinguishable."

The information [REDACTED] produces to NSA as part of the telephony metadata program is indistinguishable in nature from the information at issue in Smith and its progeny. It includes dialed and incoming telephone numbers and other numbers pertaining to the placing or routing of calls, as well as the date, time and duration of the calls.

That seems disingenuous at best. You need to be willfully distorting the facts to argue that Smith and the bulk data collection programs are "indistinguishable" from one another. Smith involved information on a single person. The bulk collection covers everyone. In fact, Judge Leon himself went through a rather detailed explanation of what "distinguishes" the Smith case from the bulk collection, including the fact that while people may expect phone companies to occasionally provide information to law enforcement on suspects, they do not reasonably expect the telcos to do that on everything from every person.

FISC Judge Rosemary Collyer admits that Judge Leon explained why the two situations are wholly different, but simply disagrees on every distinguishing factor.

This Court respectfully disagrees with Judge Leon's reasons for deviating from Smith. To begin with, Judge Leon focused largely on what happens (and what could happen) to the telephony metadata after it has been acquired by NSA -- e.g., how long the metadata could be retained and how the Government could analyze it using sophisticated technology. Smith and the Supreme Court's other decisions applying the third-party disclosure principle make clear that this focus is misplaced in assessing whether the production of telephony metadata constitutes a search under the Fourth Amendment.

Smith reaffirmed that the third-party disclosure principle -- i.e., the rule that "a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties" ... applies regardless of the disclosing person's assumptions or expectations with respect to what will be done with the information following its disclosure.

From there, Judge Collyer goes on to restate the rather expansive view that, under the third party doctrine, basically you have absolutely no 4th Amendment rights whatsoever to anything held by a third party. There's also this fun tidbit, in which the ruling dismisses the "everyone's content" vs. "just one target's content"

The aggregated scope of the collection and the overall size of NSA's database are immaterial in assessing whether any person's reasonable expectation of privacy has been violated such that a search under the Fourth Amendment has occurred. To the extent that the quantity of the metadata collected by NSA is relevant, it is relevant only on a user-by-user basis. The pertinent question is whether a particular user has a reasonable expectation of privacy in the telephony metadata associated with her or her own calls. For purposes of determining whether a search under the Fourth Amendment has occurred, it is irrelevant that other users' information is also being collected and that the aggregate amount acquired is very large.

Basically, even though there is a very big distinguishing factor between collecting one targeted person's info and everyone's info, the FISA Court insists that this factor can be ignored, because you have to look at it in terms of each person's individual situation. That seems like a highly questionable analysis, and a very dangerous "cheat" to hide from the biggest factor that makes the 215 bulk collection orders so different from the situation in Smith.

Even more troubling, is that the FISC seems to argue that phone metadata probably isn't that revealing anyway -- which is clearly bogus. It points to the case that Smith mainly relied upon, the Miller case involving bank records, and argues that phone metadata and bank records are basically the same:

It is far from clear to this Court that even years' worth of non-content call detail records would reveal more of the details about a telephone user's personal life than several months' worth of the same person's bank records. Indeed, bank records are likely to provide the Government directly with detailed information about a customer's personal life -- e.g., the names of the persons with whom the customer has had financial dealings, the sources of his income, the amounts of money he has spent and on what forms of goods and services, the charities and political organizations that he supports -- that the call detail records simply do not, by themselves, provide.

I find it equally questionable that bank record information isn't considered private, but even if we grant that premise, the rest of the argument makes little sense. In fact, much of the above information may not actually be supplied by bank records, and a person can often use cash to leave no such record. While both records may be quite revealing (beyond what I think the 4th Amendment should allow), given the choice, I'd argue that my phone records are a hell of a lot more revealing and private than my bank records.

FISC also rejects the idea that the Supreme Court's decision in the Jones case (arguing that GPS tracking may go too far) changes the analysis here. Judge Collyer points out that the rulings that Judge Leon relies on were concurring opinions, but not, technically part of the majority ruling (he basically lumped together Justice Alito and Justice Sotomayor's rulings, despite each taking slightly different approaches).

In the end, the FISC rejects the attempt by the unnamed telco, and basically says that Judge Leon's ruling is wrong. Kudos to the nameless telco for actually challenging the Section 215 order. Hopefully we'll find out soon which telco actually made a move to protect its users' privacy.

Filed Under: 4th amendment, bulk data, bulk records collection, fisa court, fisc, larry klayman, metadata, patriot act, richard leon, rosemary collyer, section 215

DOJ Updates FISA Court On Its Bulk Record Data Retention, Glosses Over Earlier Misconduct

from the see-how-GREAT-we-are-at-STUFF! dept

The DOJ, via its Deputy Assistant Attorney General, has sent a memo to FISC Judge Reggie Walton, informing him of just how compliant the agency has been during the last couple of months as conflicting orders over the retention of bulk record data went flying as a result of multiple BR-related lawsuits.

The DOJ, speaking for the NSA and FBI (who actually collect the collections), went from one court to the other (the Northern District Court of California and the FISA Court), trying to figure out whether it would be destroying aged-off data or holding onto it. It was hard to discern which route the DOJ preferred to take, but FISA Judge Walton managed to sniff out the agency's true intentions, calling them out for not only failing to inform the FISA court of standing retention orders but also attempting to talk the involved plaintiffs from passing this information along to the involved courts.

Given these actions, it would appear the DOJ preferred to dump the data rather than have it actually appear in court as evidence. But Judge Walton, along with the district court, prevented that. The DOJ's letter to Judge Walton conveniently glosses over its misconduct, instead portraying the agency as a conscientious party doing the best it could under the circumstances.

The DOJ's letter notes that it managed to restrain itself from destroying any aged-off data while waiting for the conflicting orders to be settled (March 5 - March 12), which means the BR data still has a chance to be used in court. According to the letter, this retained data is being held separately from the rest of the bulk collections, which means it can't be accessed by analysts searching the metadata. Supposedly, the NSA will only be allowed to peek in on the retained data to verify it's all still present and accounted for.

While this sort of hi-gloss portrayal is to be expected from an agency that probably still believes it did nothing wrong, it's rather audacious of the DOJ to attempt to pass this narrative off to the same judge that called it out for misleading the FISA court and attempting to bury plaintiffs' concerns.

Filed Under: destruction, doj, fisa, fisc, metadata, reggie walton

DOJ Apologizes For Misleading FISC Concerning Evidence; Hints Strongly That It Used Opportunity To Destroy Evidence

from the evidence,-who-needs-it? dept

A few weeks ago, we noted that FISC Judge Reggie Walton was quite reasonably pissed off at the DOJ for directly withholding key information about evidence in a series of lawsuits concerning NSA surveillance programs. The full details are a bit down in the weeds, but the short summary is that there's been some debate over whether or not the government needs to retain surveillance data because it's evidence in these cases, or if it needs to destroy the surveillance data, as required by the rules over its holding of the data. There's been a bit of back and forth over all of this, but the DOJ apparently directly withheld from the FISC a request by EFF lawyers to inform the court that a data preservation order should cover two of the key NSA surveillance cases that it has been involved in for years (since well before the Snowden disclosures). The DOJ not only did not inform the court, but it also appears to have tried to dissuade the lawyers from raising the issue. Judge Walton ordered the DOJ to explain itself, and it gives a long apology, repeatedly insisting that it didn't believe those cases were related, since they were focused on surveillance data ordered by the President, rather than the FISA Court -- a weak excuse at best:

Based upon the nature of the claims made in Jewel and Shubert, which the Government has always understood to be limited to certain presidentially authorized intelligence collection activities outside FISA, the Government did not identify those lawsuits, nor the preservation orders issued therein, in its Motion for Second Amendment to Primary Order filed in the above- captioned Docket number on February 25, 2014. For the same reasons, the Government did not notify this Court of its receipt of plaintiffs' counsel's February 26, 2014, e-mail. With the benefit of hindsight, the Government recognizes that upon receipt of plaintiffs' counsel's e-mail, it should have made this Court aware of those preservation orders and of the plaintiffs' disagreement as to their scope as relevant to the Court's consideration of the Government's motion and regrets its omission. The Government respectfully submits that in light of this submission, and this Court's Opinion and Order dated March 12, 2014, granting the Government's motion for temporary relief from the destruction requirement in subsection of the Court's Primary Order, no additional corrective action on the part of the Government or this Court is necessary.

It goes on for much longer trying to suggest that this was all just an honest mistake, and how could it have possibly realized that the lawyers for the plaintiffs in those cases might think the issue of preserving their evidence was related to similar questions over preserving evidence of other NSA cases. It insists that it really was just focused on the more recent cases that were filed post-Snowden ("filed after last year's unauthorized public disclosure concerning the collection of telephony metadata pursuant to FISA authority") and hadn't even considered how it related to older cases concerning NSA surveillance.

The Government did not notify the Court of Jewel and Shubert in the Motion because the Government has always understood those matters to challenge certain presidentially authorized intelligence collection activities and not metadata subsequently obtained pursuant to orders issued by this Court under FISA, and because the preservation issues in those cases had been previously addressed before the district court in which those matters are pending. Jewel and Shubert, filed in 2008 and 2007, respectively, challenge particular NSA intelligence activities authorized by President Bush after the September 11, 2001 terrorist attacks without statutory or judicial authorization.

As the DOJ goes on to explain, it assumed the preservation issues in the Jewel and Shubert cases were settled, and therefore irrelevant to the FISA issue (especially since, in its mind, the two sets of cases covered different programs). Thus, the DOJ claims, its emails dissuading the lawyers from raising the issue weren't so much about silencing those lawyers and hiding information from FISC, but were a true misunderstanding, in that it was just letting those lawyers know the issues were unrelated, as well as a desire (no joke) to not bother the FISC with unnecessary distractions.

In particular, the request in its February 28 email that counsel for the Jewel plaintiffs "forebear from filing anything with the FISC, or [the district court], until we have further opportunity to confer" was a good faith attempt to avoid unnecessary motions practice in the event that the issue could be worked out among the parties through the Government's provision of an unclassified explanation concerning its preservation in Jewel and Shubert. Accordingly, the Government did not bring the Jewel plaintiffs' February 25 email to this Court's attention.

Of course, there's still the big question of, between the two FISA court orders, whether or not the DOJ did, in fact, destroy some of the evidence. And, a follow-up correction from the government very strongly suggests that it absolutely did use the opportunity to destroy evidence. The follow-up is a correction to a footnote, in which the DOJ makes it clear that "consistent with the Government's understanding" (which appears to be mistaken) and "prior to" the more recent filing, "the Government complied with this Court's requirements that metadata obtained by the NSA under Section 215 authority be destroyed no later than five years after their collection."

What that almost certainly means is that the NSA destroyed the metadata collected up until 2009, which likely is relevant to the Jewel and Schubert cases, even though the lawyers in those cases had alerted the DOJ of these concerns. For all of the DOJ's "apologies" in the first document, this certainly seems very convenient for the US government. And, as Marcy Wheeler notes, the destroyed evidence may have included "cover almost all of the phone dragnet violations discovered over the course of 2009." Convenient. But the DOJ is really, really sorry about it. Really.

Filed Under: collection, destruction of evidence, doj, fisa court, fisc, jewel, metadata, nsa, preservation, reggie walton, shubert, surveillance
Companies: eff

Obama Still Asking FISA Court To Renew Bulk Phone Collection

from the because dept

After President Obama announced his willingness to really end the bulk collection of phone records under Section 215 of the Patriot Act, Senator Patrick Leahy pointed out that the easiest way to do that was to simply not ask the FISA Court to renew that authority this Friday when it expired. The NY Times editorial board picked up that ball and ran with it, publishing an editorial saying that if the President wants us to believe he's serious about ending bulk phone surveillance he should end the program on Friday.

No such luck.

While plenty of people are still waiting for the actual "legislative package" the administration claims it's putting together to accomplish its plan to end bulk phone record collection (but not other bulk collections), the White House has now released a "fact sheet" about its plans that concludes at the bottom by saying that the President has still asked the DOJ to renew the authority:

Legislation will be needed to implement the President’s proposal. The Administration has been in consultation with congressional leadership and members of the Intelligence and Judiciary Committees on this important issue throughout the last year, and we look forward to continuing to work with Congress to pass a bill that achieves the goals the President has put forward. Given that this legislation will not be in place by March 28 and given the importance of maintaining the capabilities in question, the President has directed DOJ to seek from the FISC a 90-day reauthorization of the existing program, which includes the substantial modifications in effect since February.

There are still numerous questions raised by the President's proposal, and it really seems entirely focused on just one problematic aspect of the NSA's surveillance capabilities. Yes, it's the part that has received the most attention, and yes it's the part that also has been shown to have never actually been useful. But this proposal seems a lot more focused on pre-empting much more comprehensive legislation like the USA Freedom Act. Furthermore, the fact that the President still refuses to just kill off the program while waiting for Congress to act suggests this is all for show. Tossing this on Congress is a great way for the President to pretend to do something while knowing nothing will actually happen.

Filed Under: barack obama, bulk phone records, fisa, fisc, metadata, nsa, section 215, surveillance

Judge Walton Catches The DOJ Withholding Info About NSA Metadata Lawsuits

from the I-may-actually-miss-this-guy-once-he's-gone dept

Another FISC opinion and order has just been released dealing with the NSA's retention of metadata that may be used as evidence in some ongoing lawsuits against the government. The DOJ had originally asked to hold onto the pertinent data past the five-year expiration date because of these pending lawsuits. This request was shot down by FISC judge Reggie Walton, who stated that holding Americans' data past the disposal date put the surveillance programs on shaky Constitutional grounds, while also pointing out that the government's arguments relied on caselaw dealing with the retention of corporate documents, something which clearly wasn't in the same league as data collected on Americans.

Shortly thereafter, a federal court handling two lawsuits (Jewel v. NSA [this is an EFF lawsuit originally filed in 2008], First Unitarian Church v. NSA) centered on NSA domestic surveillance issued a temporary restraining order on the destruction of relevant metadata. This was brought about by the DOJ's announcement that it would begin destroying the relevant data for these two cases based on Walton's February order.

This is where the DOJ starts looking very shady, according to Judge Walton's recounting of the events.

The March 10 Motion further indicated that one of the MDL cases, Virginia Shubert, et al., v. Barack Obama, et al. No. 07-cv-0603 (N .D. Cal.) remains in litigation, and the MDL preservation order remains in effect for that case. Additionally, the March 10 Motion stated that the Jewel case, which was filed in 2008, was designated by the District Court as a related action to the Hepting matter, and that Court entered an evidence preservation order in Jewel, based on the MDL evidence preservation order, which remains in effect. LCL The March 10 Motion noted that the plaintiffs in Jewel and First Unitarian contacted the government on February 26, 2014, regarding the relevance of these preservation orders to the February 25 Motion, and made a "specific request" that the government inform the FISC of their existence.

The plaintiffs asked the government to inform the FISC about their existence so that their data could be retained as well. That never happened. Instead, they were forced to file a Temporary Restraining Order in order to prevent this data destruction. This was granted by the circuit court judge and brought to the FISA Court, where Judge Walton ordered the extended retention of data specifically related to these cases. In its response filing, the DOJ had this to say about the plaintiffs who asked them to speak to the FISA court.

A footnote in the March 13 Response indicated that, "[c]ontrary to their representation . . . [the m]ovants did not make a 'specific request' that the government inform this Court about the preservation orders in Jewel and Shubert."

The DOJ included (as an exhibit) email correspondence between it and the plaintiffs of the lawsuit as support for its claim that no request was made. Upon review by Judge Walton, that assertion was false. Walton gives the government an out by claiming it may have just misperceived which surveillance program was being discussed (Section 215 vs. an "executive authority" program -- Section 501), but even then, he points out that the plaintiffs disagreed with the DOJ's reading of the situation.

From this point on, Walton takes the DOJ to task for deceiving the court (whether deliberately or otherwise).

As the govemment is well aware, it has a heightened duty of candor to the Court in ex parte proceedings. Regardless of the government's perception of the materiality of the preservation orders in Jewel and Shubert to its February 25 Motion, the government was on notice, as of February 26, 2014, that the plaintiffs in Jewel and First Unitarian believed that orders issued by the District Court for the Northem District of California required the preservation of the FISA telephony metadata at issue in the government's February 25 Motion. [E-mail Correspondence at 6-7.] The fact that the plaintiffs had this understanding of those preservation orders -- even if the government had a contrary understanding - was material to the FISC's consideration of the February 25 Motion. The materiality of that fact is evidenced by the Court's statement, based on the information provided by the government in the February 25 Motion, that "there is no indication that any of the plaintiffs have sought discovery of this information or made any effort to have it preserved.

The above might be written off as a failure to communicate, but Walton's next paragraph details even more DOJ malfeasance.

The government, upon learning this information, should have made the FISC aware of the preservation orders and of the plaintiffs' understanding of their scope, regardless of whether the plaintiffs had made a "specific request" that the FISC be so advised. Not only did the government fail to do so, but the E-mail Correspondence suggests that on February 28, 2014, the government sought to dissuade plaintiffs' counsel from immediately raising this issue with the FISC or the Northern District of Califomia.

The next filing entered should be rather informative, based on Walton's demands.

It is FURTHER ORDERED that the government shall make a filing with this Court pursuant to Rule 13(a) of the United States Foreign Intelligence Surveillance Court Rules of Procedure Rules of Procedure") no later than April 2, 2014. As part of this filing, the government shall explain why it failed to notify this Court of the preservation orders in Jewel and Shubert and of the plaintiffs' understanding of the scope of those orders, upon learning that plaintiffs' counsel viewed those orders as applying to the Section 501 telephony metadata at issue in the February 25 Motion.

This latest order from Judge Walton shows that the government wants to destroy data that might be used as evidence. There was some back-and-forth previous to this, but the DOJ probably had a good idea what Judge Walton would say back in February when it showed up to ask to hold on to domestic surveillance records indefinitely, deploying civil litigation guidelines and common law requirements as its only rhetorical weapons. Walton refused and the DOJ went happily off to tell plaintiffs that the FISA court had overridden their existing preservation orders. If the plaintiffs hadn't asked for a temporary restraining order, it might have gotten away with it.

Filed Under: doj, evidence, evidence destruction, fisa court, fisc, jewel v. nsa, metadata, reggie walton
Companies: eff

NSA Decides It Wants To Hold Metadata Indefinitely, Asks FISA Court To Reverse Decision Telling It To Destroy Records

from the we-have-all-the-data,-now-we-have-all-the-time dept

A house set against itself cannot stand gets a win no matter who's dealing the cards. As was noted earlier, the NSA's metadata is currently integral to a series of lawsuits against the government. This fact prompted the DOJ to ask the FISA court to bend the minimization rules and extend the holding period from five years to "whenever."

This was shot down by FISC judge Reggie Walton, who pointed out that the government's argument was faulty on multiple levels. First of all, changing the stipulations of the minimization procedures put the entire metadata collection on shaky constitutional ground, seeing as it's almost entirely composed of data on American citizens not currently the subject of NSA investigations. Secondly, the DOJ cited evidence preservation statutes that applied solely to private corporations, something that clearly doesn't transfer directly to a government database composed of US citizens' "business records."

On March 10th, a contradictory decision was handed down by US District Court judge Jeffrey Wright, who declared the NSA was required to hold onto metadata relevant to ongoing lawsuits. This set up an interesting situation for the NSA, which would now have to decide whether it would rather have data with no expiration date or destroyed data that would never possibly appear in court.

The NSA has now shown its hand. In a motion filed Wednesday, the agency asked the FISA court to reverse its decision on destroying the held metadata. The filing refers to the temporary restraining order entered by Judge Jeffrey Wright which stipulates that the agency must hold onto the data until the cases are resolved. The NSA notes that it now is subject to two contradictory notices and is asking the FISA court to honor the other court's decision.

I'm not exactly sure how the FISA court will respond to this. Walton made it pretty clear that he felt the government's arguments were weak and jeopardized the minimal privacy protections surrounding the bulk records collections. Not only that, but presumably the FISA court's authority supersedes a district court, considering it is the entity charged with directly supervising the collection and handling of the NSA's bulk collections.

Well, no sooner had the ink dried on this post than FISC judge Reggie Walton delivered an opinion agreeing with the District Court's order and will allow the NSA to retain the metadata associated with the two cases listed in Judge Jeffrey Wright's order. Walton's decision to reverse the FISC's opinion hinges on these two specific cases, Jewel v. NSA and First Unitarian Church v. NSA. As he notes, the DOJ's request to hold the data was based on common law rules normally applied to retention of corporate data in civil cases, something entirely unrelated to bulk surveillance metadata. Addiitonally, he points out that none of the plaintiffs in the cases the DOJ listed had requested the data be retained.

The Court concluded that any interests the civil plaintiffs might assert in preserving all of the BR metadata was "unsubstantiated" on that record. The Court further observed that no District Court or Circuit Court of Appeals has entered a preservation order applicable to the BR metadata in question in any of the civil matters cited in the motion. Further, there is no indication that any of the plaintiffs have sought discovery of this information or made any effort to have it preserved, despite it being a matter of public record that BR metadata is routinely destroyed after five years.

Beyond the legal issues is the NSA itself, which probably wouldn't doesn't mind being able to hold onto metadata indefinitely. (Of course, the FISC court limits this metadata to these two specific cases where the plaintiffs have requested the data be held. There's a lot of plaintiffs in one of those cases [First Unitarian Church v. NSA], meaning a whole lot of records will be maintained.) There's always the concern that this evidence will need to be presented in court, but if the past is any indicator, the admission of these records will be fought vigorously by the agency. As for the data the DOJ requested to be held? It will simply vanish into the ether upon expiration, keeping it out of the public eye forever.

Filed Under: bulk collection, doj, fisa court, fisc, metadata, minimization, nsa, storage

New Snowden Docs Reveal How The FISA Court Reinterpreted The Law -- And Its Own Role -- In Total Secrecy

from the and-against-the-public-interest dept

We've been writing about the secretive FISA Court (FISC) for quite some time, though a lot more often in the wake of the Ed Snowden revelations, seeing as it repeatedly approved these programs to spy on everyone. As has been noted in the past, the FISC was never supposed to be interpreting (or re-interpreting) the law. It was really just supposed to be about having judges (in secret) approving or disapproving requests from law enforcement to get warrants to spy on people. This is a perfectly reasonable role for a secret court. But things went seriously awry when it started trying to interpret the law, and to approve sweeping programs that effectively allowed the intelligence community to spy on everyone.

The NY Times has an in-depth look at how FISC reinterpreted both the law and its own role in near total secrecy, in the wake of September 11th. Reporters Charlie Savage and Laura Poitras (one of Snowden's first press contacts) use some previously unrevealed documents, including key FISC rulings, to explain what happened. The article focuses on the so-called "Raw Take" order -- docket 02-431 -- which removed restrictions that had been placed on the intelligence community regarding sharing information about Americans. The ruling came on July 22nd, 2002, while the country was still reeling from the September 11, 2001 attacks.

The Raw Take order appears to have been the first substantial demonstration of the court’s willingness after Sept. 11 to reinterpret the law to expand government powers. N.S.A. officials included it as one of three court rulings on an internal timeline of key developments in surveillance law from 1972 to 2010, deeming it a historic event alongside once-secret 2004 and 2006 rulings on bulk email and call data.

While the 9/11 Commission certainly did later find that a big problem in not uncovering the plot before it took place was the failure of the agencies in the intelligence community to share information with each other, this ruling seems to be a key point in having FISC go beyond merely giving the thumbs up or thumbs down to warrant requests and start interpreting the law, and doing so in a way that secretly (and massively) expanded the power of the intelligence community. From there, it was apparently off to the races, and other expansionist rulings followed:

The newly disclosed documents also refer to a decision by the court called Large Content FISA, a term that has not been publicly revealed before. Several current and former officials, speaking on the condition of anonymity, said Large Content FISA referred to sweeping but short-lived orders issued on Jan. 10, 2007, that authorized the Bush administration to continue its warrantless wiretapping program.

The fact that the FISC is clearly reinterpreting law -- such that a secret law is developed which clearly contradicts the public's (and many politicians') understanding of the law -- is on display:

But the orders are also mentioned in a classified draft of an N.S.A. inspector general report that Mr. Snowden disclosed, which calls them “Foreign Content” and “Domestic Content” orders. The report cites a legal theory that reinterpreted a key word in the original FISA — the “facility” against which the court may authorize spying because a terrorism suspect is using it.

Facilities had meant phone numbers or email addresses, but a judge accepted an argument that they could instead be the gateways connecting the American communications network to the world, because Qaeda militants were probably among the countless people using those switches. Privacy protections would be applied afterward, the report said.

The article also notes that the "Raw Take" report made it easier for the intelligence community to share information on Americans (information it's not really supposed to have, for the most part) with foreign nations:

The Raw Take order, back in 2002, also relaxed limits on sharing private information about Americans with foreign governments. The bar was higher for sharing with outsiders: Raw information was not provided, and even information deemed relevant about a terrorism issue required special approval.

Under procedures described in a 1984 report, only the attorney general could authorize such dissemination. But on Aug. 20, 2002, Attorney General John Ashcroft, citing the recent order, secretly issued new procedures allowing the N.S.A. to provide information to foreign governments without his clearance.

Also, the new documents reveal that despite Keith Alexander and others insisting that only a limited number of specially trained analysts could access the massive data collections, within the NSA it was widely known that the controls were not that strong and violations were likely to occur:

Access within the N.S.A. to raw FISA information was initially limited to its headquarters at Fort Meade, Md. But in 2006, the N.S.A. expanded sharing to specialists at its code-breaking centers in Hawaii, Texas and Georgia. Only those trained would obtain access, but a review demonstrated that wider sharing had already increased risks. A document noted that the agency was mixing two types of FISA information, each subject to different court-imposed rules, along with other records, and “it is possible that there are already FISA violations resulting from the way data has been stored in these databases.”

The sharing of raw information continued to expand after the enactment of the FISA Amendments Act. On Sept. 4, 2008, the court issued a lengthy opinion, which remains secret but was cited in another opinion that has been declassified, approving minimization rules for the new law. A video explaining the new rules to N.S.A. employees noted that “C.I.A. and F.B.I. can have access to unminimized data in many circumstances.”

While the revelations from the past few months had already exposed the basic concept of what was happening (the FISC going way beyond what most people thought it was there for, using pretzel logic to interpret laws into saying things that they clearly didn't say), this new report provides an insightful timeline and a peek into some of the key decisions, and how the NSA used those rulings to massively expand its ability to spy on Americans with near total secrecy.

If Congress is serious about fixing the NSA mess (and by no means do I think it is), one place to start would be to bring the FISC back down to its original mandate, and stop it from reinterpreting the law in secret. America is not supposed to have secret laws, but thanks to the FISC, we do.

Filed Under: ed snowden, fisa, fisa court, fisc, intelligence community, nsa, privacy, raw take, surveillance

District Court Orders NSA To Hold Onto Metadata, Directly Contradicting Recent FISC Disposal Order

from the a-house-divided-against-itself dept

Well, this is interesting. No sooner had FISC judge Reggie Walton shot down the DOJ's request to hold Section 215 metadata indefinitely (supposedly to preserve evidence related to ongoing lawsuits) then another judge has ordered the NSA to preserve this same data as evidence related to two lawsuits the agency is currently engaged in.

U.S. District Court Judge Jeffrey White issued the order Monday afternoon California time in response to requests from plaintiffs in two lawsuits challenging the lawfulness of the NSA surveillance.

"It is undisputed that the Court would be unable to afford effective relief once the records are destroyed, and therefore the harm to Plaintiffs would be irreparable," White wrote in his two-page order. "A temporary restraining order is necessary and appropriate in order to allow the Court to decide whether the evidence should be preserved with the benefit of full briefing and participation by all parties."

As we pointed out earlier, either way this goes, the NSA wins. If it holds onto the data, it gets to play around with the info for long past the 5-year expiration date. If it's told to destroy it (as Reggie Walton instructed), it gets to toss out evidence it had no intention of ever allowing into a public courtroom.

This may set up a showdown of sorts, but it's tough to see how a district court will be able to override the direct order given by the court that directly grants permission to the NSA to collect and store this metadata. The government can appeal either order, so it will be very enlightening to see which one it chooses to dispute. Chances are the appeal will go smoother in district court as Reggie Walton made it crystal clear that extending the expiration date puts the program on unconstitutional footing.

In order to keep from showing its hand, the NSA simply needs to do nothing and let someone else, possibly the administration itself, sort it out. Or it may decide segregating relevant metadata is above its pay grade and appeal the newest decision, allowing it to dispose of evidence it doesn't want to expose.

Briefs are due to be filed in the next few days and the government's arguments should prove to be an entertaining read, especially if it attempts to argue that it should destroy the past-due records, directly contradicting the DOJ's earlier request to retain it.

Filed Under: doj, fisc, jeffrey white, metadata, nsa, reggie walton

FISA Court Shuts Down DOJ's Attempt To Hold Onto Section 215 Metadata Indefinitely

from the not-much-'justice'-over-at-the-DOJ dept

As we recently covered, the DOJ asked the FISA court to extend the disposal deadline of phone metadata from the usual five years to an indefinite period of time, supposedly in order to preserve evidence it might need to present in lawsuits filed against the government. (Not that the DOJ has any intention of ever turning this information over, no longer how long the NSA holds onto it…) Somewhat surprisingly, (outgoing) FISC judge Reggie Walton has turned the DOJ's request down.

The DOJ contended it had a "duty" to preserve evidence -- a duty that supposedly superseded the destruction requirements of the metadata collection. Judge Walton calls the DOJ out for this claim ("the Court rejects this premise"), but more damningly, calls bullshit on the DOJ's citations.

The government cites three cases in support of its position: Inc. v. So, 271.R.D. 13 (S.D.N.Y. 2010), Richard Green (Fine Paintings) v. McClendon, 262 F.R.D. 284 (S.D.N.Y. 2009), and Zubulake v. UBS Warburg LLC, 229 F.R.D. 422 (S.D.N.Y. 2004). Although the destruction of electronic records was an issue in all three cases, R.F.M.A.S. at 40; at 287-88; Zubulake at 434, none of these cases involved a conflict between a litigant's duty to preserve electronic records and a statute or regulation that required their destruction. They merely demonstrate that, when triggered, a civil litigant's duty to preserve relevant evidence includes electronic records and that duty trumps a corporate document destruction policy. The Court has not found any case law supporting the government's broad assertion that its duty to preserve supersedes statutory or regulatory requirements.

So, that's the DOJ's "legal basis" for the indefinite retention of bulk metadata: preservation of evidence statutes governing private entities. It somehow hoped to treat the FISA court as nothing more than a regulatory speed bump rather than the fine line between national security and outright civil liberty abuse. The FISA court points out that what it's asking for is much more significant than it seems to realize. As Walton reminded the NSA in one of his earlier court orders, without the minimization procedures in place, the Section 215 collection would be unconstitutional.

In other words, nearly all of the call detail records collected pertain to communications of non-U.S. persons who are not the subject of an FBI investigation to obtain foreign intelligence information, are communications of US. persons who are not the subject of an FBI investigation to protect against international terrorism or clandestine intelligence activities, and are data that otherwise could not be legally captured in bulk by the government.

These are the same call records the DOJ wants to hold indefinitely, and its only justifications aren't even relevant to the data in question, as Judge Walton points out:

In sharp contrast with the document retention policies of corporations, the restrictions on retention of United States person information embodied in FISA minimization procedures are the means by which Congress has chosen to protect the privacy interests of United States persons when they are impacted by certain forms of intelligence gathering.

Walton points out the danger of granting the DOJ this extension, saying doing so would "significantly increase" the chance of the retained metadata being improperly used or disseminated. There is little doubt the NSA would have enjoyed an indefinite extension on the destruction data, given the "collect it all" proclivities of its various directors. But the DOJ's argument is ultimately empty.

The argument is also highly suspect. As noted in our earlier story, the DOJ made no similar effort to retain data pertaining to a 2008 lawsuit with the EFF -- data which would have been disposed of in 2013. This data likely wouldn't have helped the DOJ, or at the very least, would have resulted in a long legal battle to keep it hidden.

With that in mind (and being naturally cynical), it's tempting to view the DOJ's weak effort to hold onto the data as a deliberate ploy to help it keep this metadata from ever appearing in court. Having this granted would have been a small win for the NSA, which could then hold onto data presumably forever. But old data isn't nearly as useful as fresh data, as the NSA knows. The bigger win would be the disposal of data related to lawsuits. The FISA court shooting down this request means that, if the NSA/DOJ buy enough time, the metadata will never appear in court.

The government seems to be dealing itself a lot of winning hands in the ongoing NSA debacle, leaving the surveilled public damned with both do's and don'ts.

[Also worth a read is Marcy Wheeler's coverage of this decision over at Emptywheel, where she points out that this is possibly the first time the FISA court has actually attempted to establish a limit on what the government finds "relevant" to its War on Terror.]

Filed Under: doj, fisa, fisc, metadata, section 215