FISA Court Agrees To Changes That Limit NSA's Ability To Query Phone Records

from the it's-something dept

While we were mostly disappointed by President Obama's speech concerning his plans for reforming surveillance efforts, there were a few significant suggestions, with the most major one being a limit from being able to explore "3 hops" down to "2 hops." That might not sound that big, but it is a pretty big limitation when you dig into the math. Furthermore, he said that there should be a court reviewing each request to query the phone records database. He left open a pretty big loophole, saying that this judicial review could be skipped in a "true emergency," but it's still something.

In response, the Justice Department actually went to the FISA Court and filed a motion to revise the current order approving the telephone records collection (under Section 215 of the PATRIOT Act, sometimes called the "bulk metadata" program), to change it to put in place these restrictions. The FISA Court has now approved that request, and will release a (possibly redacted) version of the order within the next week and a half or so.

This is a small change, but it is still a meaningful change that creates both more oversight and greater limits on how this data can be used. It's a small step in the right direction.

Filed Under: bulk metadata, fisa, fisc, james clapper, nsa, phone records, section 215, surveillance, three hops, two hops

NSA/FBI Got Access To Content Of Around 40,000 Yahoo/Google User Accounts In First Six Months Of 2013

from the it's-a-lot dept

Last week, we noted that the DOJ and various internet companies had settled their legal fight, which concerned whether or not those companies could reveal the details of how many FISA Court requests they were receiving -- both in terms of how many requests they get and how many accounts are impacted. While Apple immediately released their information, showing very few users impacted, the real interest is in Google, Yahoo and to a lesser extent Facebook. Both Google and Yahoo have put out blog posts updating their transparency report numbers. It appears that both Yahoo and Google decided to go with "option 1" in the settlement, which lets them reports NSLs and FISA orders separately, but in bands of 0-999. The big question with both of them, really, was just how many "customer accounts affected" there would be, and both presented numbers (in slightly different formats). Google showed a historical listing: Yahoo just shows the most recent: If you remember, by choosing Option 1, the companies could actually show "customer accounts affected" -- if they had chosen option 2, they could only show targeted customers, leaving out others who were affected as well. But here we see that the number of accounts affected is much larger than the number of requests (though certainly much more limited than some assumed). That is, these requests (which make up a large part of the PRISM program) impact thousands of users, but not millions or "all" as some have claimed. There may very well be other NSA surveillance programs that get data from many more users, but not the FISA orders/PRISM.

Concerning the Google data, you can see that there's been a pretty big increase in the number of users impacted over the past few years, peaking at the end of 2012, but that drop in the beginning of 2013 may be just seasonal. Meanwhile, it's interesting to see that a much larger number of Yahoo accounts have been impacted. Of course, for all we know, there could have been one FISA order to Google and three to Yahoo and then the number of accounts impacted would be around 10,000 per order. But, without more granularity, it's impossible to tell.

What does seem clear is that there are about 40,000 accounts on Yahoo or Google to which the NSA/FBI and others in the intelligence community have access.

Update: Facebook and Microsoft have updated their info as well and it's more of the same:

Microsoft, a major surveillance partner for the US government, received fewer than 1,000 orders from the Fisa court for communications content during the same period, related to between 15,000 and 15,999 “accounts or individual identifiers”.

The company, which owns the internet video calling service Skype, also disclosed that it received fewer than 1,000 orders for metadata – which reveals communications patterns rather than individual message content – related to fewer than 1,000 accounts or identifiers.

[....] Facebook disclosed that during the first half of 2013, it turned over content data from between 5000 and 5999 accounts – a rise of about 1000 from the previous six month period – and customer metadata associated with up to 999 accounts.

Filed Under: accounts, content, fbi, fisa, fisa orders, fisc, nsa, prism, surveillance, transparency report
Companies: google, yahoo

Feds To FISC: Of Course We Don't Have To Share Our Full Legal Filings With Companies Suing Us Over NSA Transparency

from the because dept

As you may recall, in the ongoing lawsuit by various tech companies against the government, in which they're seeking to reveal some rather basic details about how many surveillance data requests they get and how many users are impacted, much of the feds' brief was redacted... even to the tech companies. The companies argued, quite reasonably, that it was crazy to make them fight a legal battle in which the DOJ could make arguments that the companies themselves couldn't see or respond to. They asked the FISA Court to either let them see the arguments or to remove them from the case.

The DOJ has now filed its response, which basically says "we've revealed enough."

The Government's public brief meets and exceeds the requirements of Rule 7(j). The rule clearly provides that submissions to the Court "which may include classified information" will be reviewed by the Court "ex parte and in camera" and that adversarial parties will receive only "an unclassified or redacted version" which "clearly articulate[s] the government's legal arguments." Rule of Procedure 7(j). Not only does the Government's public brief "clearly articulate the government's legal arguments," the legal arguments are fully disclosed. The redacted information contains no additional legal arguments, no case citations, and no discussion of statutory or other law.

Of course, that raises other questions. If the redacted portions (which are fairly large) don't raise legal arguments, then what are they doing?

The government also argues that the executive branch gets the right to determine what to redact and the court should defer to the government on such things:

... this Court does not independently review Executive Branch classification decisions.... Executive Branch classification decisions are entitled to "the utmost deference"... and that such deference is especially appropriate where the Executive Branch bases its classification decision, as here, on a review of all pertinent information, including whether disclosure of the data in the manner proposed by the companies would risk filling out the mosaic of information available to our adversaries in their efforts to assess and avoid our surveillance capabilities.

And so we're back to the "mosaic theory," in which the feds argue they can redact stuff out of a fear that a bunch of random info can be put together by bad people to figure out more than the feds want to reveal. But... that makes no sense here. The companies are asking at this point that their own lawyers be able to see the arguments, not necessarily that the details be made public. The court could easily seal the filings from the public while letting the companies' lawyers see it.

Filed Under: doj, first amendment, fisa, fisc, redacted, transparency
Companies: apple, facebook, google, linkedin, microsoft, yahoo

US Gov't Appears To Have Misled The Supreme Court About How The NSA Spied On Americans

from the whoa dept

We've written a few times now about the fact that US Solicitor General Donald Verrilli pretty clearly made false statements to the Supreme Court in a key case concerning NSA warrantless wiretapping. The case, Clapper v. Amnesty International, mainly focused on who had standing to challenge warrantless wiretaps performed by the NSA. The government argued that since there was no evidence that Amnesty International was spied on, it had no standing. The false statement involved the claim that the government would have to inform defendants in cases where warrantless wiretaps were used that that's how the info was gathered. Except the government didn't do that.

It turns out that might not have been the only misrepresentation from Verrilli -- and this next one may be even bigger, involving misleading the Supreme Court on a loophole that allowed the NSA to spy on tens of thousands of Americans.

As was noted earlier this year, upon realizing what happened, Verrilli was apparently furious, and the DOJ has now changed its policy to match with what Verrilli said -- they now will notify defendants, but it's clear that they never did so before.

But Senators Mark Udall, Ron Wyden and Martin Heinrich have sent Verrilli a letter urging him to "set the record straight" with the Supreme Court... but not just on that issue of disclosing. Rather they highlight somewhere else they think he did not paint the correct picture:

In Clapper v. Amnesty, the majority opinion characterizes as “highly speculative” the plaintiffs’ fear that “the Government will decide to target the communications of non-U.S. persons with whom they communicate,” and states that the “respondents’ theory necessarily rests on their assertion that the Government will target other individuals – namely their foreign contacts.” These and other statements in the opinion indicate the Court’s view that the only way the plaintiffs’ communications could be intercepted under the FAA is if those communications are to or from a foreign intelligence target.

Yet with the disclosure and declassification in recent months of relevant documents regarding Section 702, the role of ‘about’ collection under the FAA is now public, although not widely understood. In addition to authorizing the collection of communications to and from foreign, overseas targets, the FISA Amendments Act also has been secretly interpreted to authorize the collection of communications that are merely about a targeted overseas foreigner.

This form of collection allows the government – through the “upstream” collection under Section 702 – to collect any communication whose content includes an identifier, such as an email address, associated with an overseas foreigner who may be a foreign intelligence target. But according to the FISA Court’s October 2011 opinion, the ‘about’ collection likely results in the acquisition of “tens of thousands” of wholly domestic communications every year. In other words, tens of thousands of emails between law-abiding Americans are likely being collected – even though these Americans are not actually communicating directly with a foreign intelligence or terrorism target. As FAA collection was intended to target persons “reasonably believed to be located outside the United States,” and targeting procedures were intended to “prevent the intentional acquisition of any communication as to which the sender and all intended recipients are known at the time of acquisition to be located in the United States,” the FISA Court in its October 2011 opinion called this expanded FAA collection a circumvention of the “spirit” of the law and a “cause of concern for the Court.”

Just to hammer this point home, they're saying that despite everyone, including the Supreme Court, clearly reading the law to say that Section 702 of the FAA is supposed to be limited to surveillance on foreign targets, it actually also allows surveillance on communications about foreign targets -- and that likely includes tons of communications of Americans. And these communications were believed not to be available under this program, including by the Supreme Court.

The Senators ask Verrilli if he clearly informed the Supreme Court of this at any point, and if not, suggest that he correct the record.

We believe that a formal notification to the Supreme Court of the government’s misrepresentations in the case — both relating to its notice policy and relating to its practice of ‘about’ collection under Section 702 of the FISA Amendments Act — would be an important step in correcting the public record and would be in the interests of the public as well as of the Administration and the Supreme Court.

This seems rather important -- and a point that not many reporters have covered (which also might explain why the Senators are raising it, and noting that the revelation "is not widely understood.") This is a way of alerting people to the simple fact that the NSA has interpreted Section 702 to mean it can collect any communication deemed to be "about" a target, even if the communication is not from or to that target.

Filed Under: donald verrilli, faa, fisa, fisa amendments act, james clapper, mark udall, martin heinrich, nsa, ron wyden, section 702, solicitor general, supreme court, target
Companies: amnesty international

Former NSA Lawer Stewart Baker: FISA Minimization Policies Are To Blame For 9/11 Attacks

from the next-up:-opinion-blogs-to-blame-for-9/11-attacks! dept

Stewart Baker, former DHS official and NSA counsel, has plenty of blame to spread around for the 9/11 attacks. None of it seems to lay at the feet of the terrorists who performed the attacks, however. He's entertained various theories over the past few months as he's defended the actions of the NSA, TSA and various other government agencies.

Most egregiously, Baker claimed civil liberties activists were to blame for the 9/11 attacks because their concern over warrantless wiretap programs somehow made the FISA court so defensive it wouldn't let the FBI pursue terrorists it knew were currently in the country.

Baker expounds on this further in his post criticizing the NSA-targeting Leahy-Sensenbrenner bill, making the argument that FISA minimization policies prevented the FBI from tracking down terrorists located in the US.

The Leahy-Sensenbrenner USA FREEDOM Act puts the Foreign Intelligence Surveillance (FIS) court in charge of shaping, overseeing, and enforcing minimization guidelines in connection with section 215, pen/trap orders, and section 702, largely taking the Attorney General out of the process of writing minimization guidelines. I’m appalled, because the FIS court has taken control of minimization before, with disastrous consequences; it built a “wall” between intelligence and law enforcement without any legal basis for doing so, and enforced the wall so aggressively that the FBI couldn’t use its best counterterrorism assets to track down the hijackers in late August and early September 2001. In a very real sense, it was the FIS court’s legal error combined with a self-righteous use of its contempt power that thwarted the country’s last, best chance to stop the attacks.

Baker is one of the only people out there who have taken the FISA court to task for being "too restrictive." According to Baker, this is because its reaction to early "rubber stamp" criticism was to swing the other way and utilize its contempt power to limit the reach of intelligence agencies.

It's hard to argue with the rubber stamp perception, considering the court has approved nearly every request that has crossed its desk. The court may argue that several requests are sent back for major changes before finally being approved, but the end result is still the same: large-scale collections of untargeted, domestic data are still being OK'ed. Not only that, but expansions of programs have been granted even as FISA judges detail large amounts of agency wrongdoing within those same opinions.

But going back to Baker's opening statement, the FISA court didn't erect a minimization "wall" that prevented data from being shared between agencies. And even if it had, the breakdown that led to a domestically-located terrorist eluding multiple US agencies would not have been affected by looser minimization standards.

The ACLU's Michael German thoroughly dissected the intelligence failures preceding the 9/11 attacks using widely-available information from the 9/11 Commission's report. Baker's supposedly hamstrung agencies are nowhere to be found.

It turns out that the NSA was intercepting calls to the al Qaeda safe house in Yemen as early as 1999, and both the FBI and CIA knew Mihdhar was an al Qaeda operative long before the 9/11 attacks.

The safe house was discovered during the FBI’s investigation into the 1998 bombings of two U.S. embassies in East Africa, and had been monitored by the NSA and CIA ever since. The inspector general’s report couldn’t be clearer that the intercepts were being broadly shared:

“The NSA’s reporting about these communications was sent, among other places, to FBI Headquarters, the FBI’s Washington and New York Field Offices, and the CIA’s CTC. At the FBI, this information appeared in the daily threat update to the Director on January 4, 2000.”

Here we see multiple agencies broadly sharing information on a known terrorist. Not only that, but the intercepted phone calls were to a known terrorist group, meaning the call data on those would be subject to very little, if any, minimization procedures and could be tipped to the FBI without stripping identifying info. At this point, three agencies knew about the calls to an al Qaeda safehouse.

What happened next had nothing to do with minimization procedures. The agencies involved knew Mihdhar was communicating with terrorist entities outside the US, so the governor was off, so to speak. Unfortunately, the CIA decided to do nothing with the additional information it had.

The CIA, however, failed to place Mihdhar on a watch list or “notify the FBI when it learned Mihdhar possessed a valid U.S. visa,” according to the 9/11 Commission report. The inspector general’s report revealed that five FBI officials assigned to the CIA Counterterrorism Center viewed CIA cables indicating Mihdhar had a U.S. visa. A week after the Kuala Lumpur meeting, Mihdhar and Hazmi flew into Los Angeles International Airport and entered the United States without a problem.

So, we have an agency failing to put a potentially dangerous person on a watch list and we have the FBI itself, the agency Baker claims was cut out of the loop by FISA court meddling, failing to do anything with the information it had pulled from CIA cables -- information Baker is apparently claiming it had no access to.

Then we have the NSA itself collecting even more data and doing nothing with it.

After their entrance, the NSA would intercept at least six calls from the al Qaida safe house in Yemen to the United States, according to the Los Angeles Times.

Even if the NSA was prevented by FISA court interference from tipping these calls to the FBI (which is doubtful, considering they were contacts with a terrorist entity), it still had the info in its possession and didn't act on it.

There are many levels of failure at play here, but protecting the data of American citizens isn't one of them. Baker's interest in placing the blame for the 9/11 attacks on the NSA's critics has gone past unseemly. At this point, he sounds like a one-man echo chamber. The entities he despises the most (EFF, ACLU, etc.) are somehow the villains in every scenario, whether it's a national tragedy or the TSA's invasive pre-flight security theater, even when every argument he makes fails to produce any evidence towards his conclusions.

Filed Under: 9/11, fisa, minimization, privacy, stewart baker

Senate Intelligence Committee Rejects A Bunch Of Attempts To Amend Dianne Feinstein's Fake NSA Reform Bill

from the but-of-course dept

The Senate Intelligence Committee apparently just voted on Dianne Feinstein's fake NSA reform bill, which actually legalizes all of the illegal spying and adds a few new ways for the government to spy on everyone. Some of the members of the committee tried to add some amendments which would have made the bill do at least a few minor useful things, but it sounds like all of those were rejected. Incredibly, even though the NSA has been indicating pretty strongly that it's fine if the data it collects can only be held for three years, rather than the five it currently uses, an amendment limiting such data collection to three years was rejected. Even Dianne Feinstein supported that amendment, but increasingly disappointing Senator Angus King (like so many politicians, he seemed promising... until he got into office) voted with the Republicans on the Committee who all wanted to keep the surveillance backups for five years. As for other amendments, here's how Politico summarized them:

Another 7-8 casualty in the intel panel mark-up was a provision to ban the bulk collection of cell-site information that can show where a caller is physically located at the time of making or receiving a call. The NSA has acknowledged running experiments to handle such data, but says it isn’t collecting it now. Most panel Democrats supported the geolocation data ban, and most Republicans opposed it, but some crossed the lines. Feinstein and Sen. Barbara Mikulski (D-Md.), whose state is home to the NSA, voted against the ban. Sen. Susan Collins (R-Maine) voted for it.

The third proposed reform to fall 7-8 was an amendment by Sen. Ron Wyden (D-Ore.) to require that any Foreign Intelligence Surveillance Court decision finding a violation of the Constitution be made public. Again, most Democrats supported the proposal, while most Republicans opposed it. This time, Feinstein and Sen. Jay Rockefeller (D-W.V.) bucked their Democratic colleagues. Collins joined with six Democrats in favor of the transparency mandate.

The overall bill passed out of committee 11-4, with Senators Wyden, Udall, Heinrich and Coburn voting against it. As the Politico article notes, Coburn voting against it is a bit of a surprise, since he's been seen as an NSA supporter. In fact, the article suggests he voted against it because he thinks it puts too many restrictions on the NSA, which is crazy since it puts fewer restrictions than they have today. Specifically, Coburn doesn't want any limits on how long the NSA can keep your data, which is downright nutty.

Filed Under: amendments, dianne feinstein, fisa, fisa improvements act, mark udall, nsa, ron wyden, surveillance, tom coburn

DOJ Refuses To Let Tech Companies See Legal Arguments It's Making Against Them

from the isn't-that-convenient dept

The ongoing legal fight, in which a bunch of US tech and internet companies -- namely Google, Facebook, Microsoft, Yahoo and LinkedIn -- are suing the US government, claiming a First Amendment right to publish some details on the number of requests they get from the NSA under Section 702 of the FISA Amendments Act, as well as the number of users impacted by those requests, is getting ever weirder. The government had filed its response back at the end of September. And, you might notice, large portions of it are totally redacted. For example, here is page 13 of the document (though, numbered page 8):
At least they didn't redact the page number Of course, stuff gets filed under seal all the time, and it's not particularly uncommon to see redacted passages in legal documents -- especially (obviously) when it has to do with matters of national security. But, here's what's different. Normally the opposing parties in the case are allowed to see the details of what's redacted. Here, the DOJ is simply refusing to let the tech companies see its own argument. In response, the companies have filed a pretty direct and somewhat angry motion, asking the FISA court to either let them see the arguments, or to strike the redacted portions from the DOJ's motion. Basically, the DOJ is saying that it can make legal arguments that only the court can see, but which the tech companies suing it cannot see. That goes against every basic concept of due process.

The government has submitted a response and supporting declaration for ex parte, in camera review. It has given the providers only a heavily redacted version of its submissions, and it has rejected all requests for greater access.

Unless the government reconsiders its refusal to accommodate the providers' legitimate need to understand the basis for the government's response, the providers respectfully request that this Court strike the redacted portions of the government's brief and supporting declaration. The redacted version of the government's submissions does not comply with Foreign Intelligence Surveillance Court Rule 7(j) because it does not "clearly articulate the government's legal arguments," as the rule requires. If the government's interpretation of the rule were correct, the rule would violate both the First Amendment and the Due Process Clause. To avoid that result, the Court should construe the rule to require fuller disclosure to the providers.

Allowing the government to file an ex parte brief in this case will cripple the providers' ability to reply to the government's arguments and is likely to result in a disposition of the providers' First Amendment claims based on information that the providers will never see. The providers do not dispute that in some cases it may be appropriate for this Court to consider ex parte filings. In this case, however, such a course is neither justified nor constitutional. The providers already know the core information that the government seeks to protect in this litigation--the number of FISC orders or FAA directives to which they have been subject, if any. At issue here is only the secondary question whether the providers may be told the reason why the government seeks to keep that information a secret. The government has not argued that sharing those reasons with the providers or their counsel would endanger national security. Accordingly, unless the government allows the providers' counsel to access its response, the Court should strike the redacted portions of the response.

The whole thing is really quite incredible. Our government is so focused on the secrecy of its secret laws and secret demands that it won't even tell the companies fighting the secrecy the secret reasons it's telling the court it has to keep stuff secret? How is that possibly consistent with basic due process under the law?

Filed Under: due process, faa, fisa, fisa amendments act, fisa court, fisc, free speech, gag order, nsa, redactions, section 702
Companies: facebook, google, linkedin, microsoft, yahoo

Feinstein Releases Fake NSA Reform Bill, Actually Tries To Legalize Illegal NSA Bulk Data Collection

from the don't-buy-the-lies dept

Despite Dianne Feinstein's supposed "conversion" earlier this week about the NSA being out of control with its spying, and the associated performance of NSA folks claiming that they were screwed, it's quickly become apparent that this was all pure theater to make people think that real reform might be coming. Feinstein claimed she was shocked about this and called for a full investigation... and yet, just two days later, she held a markup of her planned "reform" bill for the collection of intelligence by the NSA (and held the markup in secret -- because nothing says "let's increase transparency of the NSA" like keeping the debates and votes secret). That bill was moved out of committee today by a vote of 11 to 4, leading Feinstein to release the bill with a bunch of misleading claptrap designed to make people think it's real reform. It even confused some folks who know this stuff into thinking, after a quick first pass, that it "banned" the bulk data collection. And you might think that's the case because her description says:

• Prohibits the collection of bulk communication records under Section 215 of the USA PATRIOT Act except under specific procedures and restrictions set forth in the bill;
• Establishes criminal penalties of up to 10 years in prison for intentional unauthorized access to data acquired under the Foreign Intelligence Surveillance Act (FISA) by the United States;
• Prohibits the bulk collection of the content of communications under Section 215 of the USA PATRIOT Act;

Reading that, you might think it actually banned the bulk data collection that's been reported on, but it does not. That "except under specific procedures and restrictions set forth in the bill" just takes the highly questionable reasoning of the FISA Court in approving the bulk data collection and makes that the "exception." In other words, it does exactly the opposite of what Feinstein claims. Rather than banning bulk data collection, it legalizes it. That third point on the "content" is just a red herring -- the same red herring that Feinstein and others have been waving about wildly for months, pretending people are upset about the collection of actual recordings, rather than the collection of metadata. She's wrong. People are upset about the collection of metadata, which this legalizes.

Even more ridiculous, the focus (both in the marketing and the bill itself) on collection of content "under Section 215" is another red herring, since it appears that much of that collection actually happens under other programs anyway. So this doesn't change a damn thing.

Other supposed "changes" in the bill -- including limiting who can perform queries on the data, how many "hops" they can analyze and how long they can retain the data, all match with current practice and don't change a thing. Even though James Clapper and Keith Alexander more or less seemed to concede at yesterday's House hearing that they'd be okay with cutting back on the data retention from five to three years, this bill keeps it at five. There are a few other minor changes, but this bill is almost entirely as expected, simply codifying the status quo, even though Feinstein has insisted that it was legal all along. The one minor "concession" which many had expected -- having a third party at the FISA Court who could fight for civil liberties -- is watered down. Rather than an actual adversarial setup, with this person representing civil liberties, it's set up as an appointed "amicus cureia" or "friend of the court," where they basically just advise the court on the issue.

This bill is a farce, and made even more farcical by the misleading way in which Feinstein has presented it, pretending it bans bulk data collection when it actually legalizes it.

Filed Under: bulk data collection, dianne feinstein, fisa, fisa court, fisa improvements act, fisc, lies, nsa, nsa surveillance, section 215

As Expected, USA Freedom Act Aims To Stop Worst NSA Abuses

from the a-step-in-the-right-direction dept

As was expected, a new bill to curb the NSA's excesses was introduced in both houses of Congress this morning, with very strong backing in both houses and on both sides of the aisle (in terms of having both powerful sponsors, and lots and lots of co-sponsors). The bill is not perfect, and it is not the final answer to all the NSA's activities, but it's a big step in the right direction -- stopping dragnet surveillance, reforming the way the FISA court works and adding some more transparency (we described many of the details in our post last week, and the bill matches what was expected). It has a decent chance of passing, but getting anything through Congress can be a chore these days. We'll be following what happens with this bill closely. You can see the full bill below or the quick two pager describing the details.

Filed Under: bulk collection, dragnet collection, fisa, fisa court, fisc, james sensensbrenner, nsa, nsa surveillance, pat leahy, usa freedom

Latest Declassified NSA Records Show NSA Believes It Can Spy On Everyone's Location Based On Existing Approvals

from the of-course-it-does dept

James Clapper has declassified another batch of documents on the NSA activities. We'll probably write about a few of them, but let's start with one that's getting a lot of initial attention: the document that discusses the "test" of collecting location info from the telcos based on where your mobile phone was. The short version? Do you know where you were on April 26, 2010? Because the NSA probably does. It had already been revealed that the NSA had run "a test" of obtaining location info from the telcos. This document, which is a memo from the NSA to the Senate Intelligence Committee is just explaining some of the details, with this being the key one:

In regards to the mobility testing effort, NSA consulted with DOJ before implementing this testing effort. Based upon our description of the proposed mobility data (cell site location information) testing plans, DOJ advised in February 2010 that obtaining the data for the described testing purposes was permissable based upon the current language of the Court's BR FISA order requiring the production of 'all call detail records.' It is our understanding that DOJ also orally advised the FISC, via its staff, that we had obtained a limited set of test data sampling of cellular mobility data (cell site location information) pursuant to the Court-authorized program and that we were exploring the possibility of acquiring such mobility under the BR FISA program in the near future based upon the authority currently granted by the Court.

The key takeaway here: the NSA believes that the current FISA approval of dragnet collection of metadata on every phone call includes permission to track location data as well, even though it doesn't currently do so. The "BR FISA order" means "business records" which is what Section 215 of the PATRIOT Act is sometimes called. The fact that the NSA didn't seem to think it was necessary to check with the FISA Court before running this test, just to make sure it was actually allowed is rather telling.

Separately, can anyone explain why the redacted portions of this document are redacted? It makes no sense. They redact the number of location records that were obtained. I can't see how that number could possibly need to remain classified once the existence of such a test was declassified. The only reason I can think of to keep that classified is to avoid embarrassment over the large number of people whose location info was scooped up. Similarly, they redact the name of the lawyer who wrote the memo. Again, the only reason I can think to do this is to protect him from embarrassment and public mocking. Such a public mocking might seem unfair, but I don't see how it fits in with a reasonable classification category.

Filed Under: business records, fisa, fisc, location data, nsa, nsa surveillance, patriot act, section 215