Obama Plans Cosmetic Surveillance Changes After All, Will Set Up Pretend Fight Over NSLs

from the theatrical-reforms dept

Leaks coming out of the Obama administration suggest that the President is preparing mostly cosmetic changes to the intelligence community, following the recommendations from the intelligence task force -- which were much stronger than many expected. The reports suggest things like putting a public advocate to represent the public's views in certain cases before the FISC. This has been talked about for a while, and was the main concession plenty of people had been expecting anyway. That's hardly anything big.

The article talks about two other potential reforms. The first is shifting the holding of phone call metadata from the NSA to the phone companies, allowing the NSA to still search through it after getting a court order. While this may be a marginal improvement, it still has tremendous problems. It will almost certainly come with some sort of data retention law -- something that the feds have wanted for ages, and which civil liberties activists have been fighting against for years. Companies shouldn't be required to hang on to data they don't need, especially if getting rid of it can better protect their users' privacy. Furthermore, while not letting the NSA hang onto the data is a good thing, there is a reasonable concern that if the telcos are hanging onto the data themselves, that they, too, might do bad things with it, with little to no oversight.

However, most of the article from the LA Times focuses on National Security Letter (NSL) reform. We've written about those for years. NSLs are the way that the FBI can demand information from companies without any judicial review at all and, even more insane, with a complete gag order that prevents the recipient from telling anyone (including, at times, your lawyer). The FBI has an incredibly long history of "serious misuse" of NSLs, and has shown little to no interest in fixing the process. Nearly a year ago, a court actually ruled them unconstitutional, but there's an ongoing appeals process that will take quite a bit of time.

However, as the article notes, the DOJ/FBI and other surveillance maximalists are all horrified by the idea that Obama might actually require judicial approval of NSLs, for all but "emergency" situations. What this sounds like is that the President may suggest something along those lines, there will be a well coordinated press attack from surveillance hawks freaking out about the danger this puts us all in... and then he'll back down on that one point. And we'll be left with... basically nothing, but the President will go around insisting that he reformed the intelligence community, while everything more or less stays the same.

Filed Under: barack obama, fisa court, fisc, national security letters, nsa, nsl, public advocate, reform, surveillance

Feds Agree To Release Redacted Interpretation Of PATRIOT Act That A Month Ago It Said Could Not Be Revealed

from the ch-ch-changes dept

A month ago, we wrote about how the DOJ had told the FISA Court (FISC) that even though the court had said that its own rulings, which secretly interpreted the PATRIOT Act to allow for the bulk collection of certain information under Section 215 of the act, should be declassified in the wake of all the Snowden revelations, the DOJ had determined that it didn't want to release the ruling. Let's repeat the details here: (1) FISA Court issues secret ruling that totally reinterprets Section 215 of the PATRIOT Act in a manner that appears to be quite different than any plain language reading. (2) Snowden leaks a bunch of documents that reveal the existence of certain bulk data collection which has everyone up in arms. (3) FISA Court itself says that more information is a good thing for debate, and that it would like to release the ruling in question, asking the DOJ to do some redactions as necessary. (4) The DOJ says, well, given the choice, we'd just as soon redact the whole damn thing. (5) The FISA Court says, "Come again? You need to explain that some more."

Then, late on Friday, when the DOJ had to give its more detailed explanations, it suddenly reversed its position. It now says that it will drop its objection to the ruling being published, though there will be redactions. The DOJ claims that its initial reaction wasn't just to hide the full ruling, but that there's an ongoing investigation that it involves:

In its latest filing, the Justice Department explained the reason for its initial reluctance to have the opinion published: It relates to the subject of an FBI counterterrorism investigation. Some information in the opinion could tip off the subject or his associates, the Justice Department said.

"However, upon review and as a discretionary matter," the government said, it decided to drop its objection to the court publishing parts of the opinion, as long as they're not classified and don't jeopardize the investigation.

Of course, this suggests that their initial response, trying to block the release of any part of the decision was the typical kneejerk reaction of government officials to "well, keep this secret."

Filed Under: doj, fisa court, fisc, patriot act, secret interpretation, section 215

Surprise: White House's Intelligence Review Task Force Suggestions Much More Than Just Cosmetic

from the wasn't-expecting-that dept

Given the earlier reports suggesting that the "independent" task force set up to review the NSA's activities had come back with a list of suggestions for changes that were mostly cosmetic, rather than substantive, it was a bit of a surprise to see the White House come out today to say that those earlier reports were incorrect and that they were releasing the report in full today (way ahead of schedule). And, now the report is out. After giving it a single read (300+ pages), it is a lot more substantial than many of us expected -- so much so that even the NSA's biggest apologists are "shocked" at how "awkward" it must be for the White House to claim to set up an independent task force, and then have it come back with recommendations that are quite different than what the White House itself has been proposing. It's as if the NSA's apologists assumed this was long in the bag, and that the task force itself was always a joke. Turns out that's not the case.

That's not to say this is perfect. There are significant areas where it seems the recommendations could and should go much further. But it does argue for reining in significant amounts of surveillance, providing much greater oversight, protecting non-US persons' privacy as well as US persons, and a variety of other very real changes. It also (as Judge Leon did on Monday) says that there's no real evidence the bulk collection of metadata was useful in any real way... but, oddly, then allows the program to continue, but in a different manner: having the telcos retain the data in case it's later needed (along with relevant court approvals) rather than just keeping the whole database to troll through. There are all sorts of problems with mandatory data retention as well, but we'll talk about that eventually.

It recommends putting significant restrictions on the ability of the FISA court to force companies to disclose private information, and also includes restrictions on the regularly abused "national security letters" process, which the FBI frequently uses to get information without a warrant. It supports much greater transparency about the programs, including allowing companies to reveal details of the number of requests they received for information. And, as mentioned above, they don't just stop at protecting the privacy of US persons, but non-US as well, including that any spying on non-US persons needs to have a direct national security purpose, and cannot be based on political or religious views alone. It also recommends against revealing information about non-US persons, such as the reported plans to leak the porn viewing habits of certain non-terrorists with views with which the American government disagreed.

The report clearly notes the drift by the NSA away from its core mission of national security, and suggests that various actions need to get back to having a specific national security reason. It also argues for splitting up parts of the NSA by designating the NSA itself as only covering foreign intelligence, moving its "Information Assurance Directorate" and (as we'd discussed last week) finally separating US Cyber Command from the NSA (something the White House has apparently already rejected). The report highlights the need for greater privacy assurances, including reconstituting the Civil Liberties Oversight Board into the Civil Liberties and Privacy Protection Board -- and granting it much more power for oversight, while also placing a Special Assistant to the President for Privacy in the executive branch. As many had expected, it also recommends making the FISA court a more adversarial process (something the White House has suggested it may be open to).

The report also recommends that the NSA be blocked from trying to undermine or weaken encryption standards, and actually says that the White House should support greater use of encryption across the board.

There are recommendations to better lock down information within the intelligence community to prevent another Snowden from walking off with documents... but also more avenues for whistleblowers, including having them go to that newly constituted privacy board.

It's final recommendation is one that's most telling, and one of the issues that's most confused me throughout this process. It suggests that the government start actually doing a "cost-benefit" analysis of the various security efforts it engages in. As we've noted, the incredible thing about the revealed programs is that they provided very little benefit, but the costs were astounding, both in managing the programs themselves, but, more importantly, in the impact economically and diplomatically of having those programs revealed.

Now, this report is just a set of proposals, which the White House can reject. In fact, it's likely that many will be rejected or ignored. But, to actually have this review board -- which many expected to be nothing more than yet another rubber stamp -- issue something this detailed, comprehensive... and which really does recommend some very real changes, is a pleasant surprise.

Your move, Mr. President.

Filed Under: bulk metadata collection, fisa court, fisc, intelligence, nsa, nsa surveillance, review, section 215, surveillance, task force

Feds To FISC: Of Course We Don't Have To Share Our Full Legal Filings With Companies Suing Us Over NSA Transparency

from the because dept

As you may recall, in the ongoing lawsuit by various tech companies against the government, in which they're seeking to reveal some rather basic details about how many surveillance data requests they get and how many users are impacted, much of the feds' brief was redacted... even to the tech companies. The companies argued, quite reasonably, that it was crazy to make them fight a legal battle in which the DOJ could make arguments that the companies themselves couldn't see or respond to. They asked the FISA Court to either let them see the arguments or to remove them from the case.

The DOJ has now filed its response, which basically says "we've revealed enough."

The Government's public brief meets and exceeds the requirements of Rule 7(j). The rule clearly provides that submissions to the Court "which may include classified information" will be reviewed by the Court "ex parte and in camera" and that adversarial parties will receive only "an unclassified or redacted version" which "clearly articulate[s] the government's legal arguments." Rule of Procedure 7(j). Not only does the Government's public brief "clearly articulate the government's legal arguments," the legal arguments are fully disclosed. The redacted information contains no additional legal arguments, no case citations, and no discussion of statutory or other law.

Of course, that raises other questions. If the redacted portions (which are fairly large) don't raise legal arguments, then what are they doing?

The government also argues that the executive branch gets the right to determine what to redact and the court should defer to the government on such things:

... this Court does not independently review Executive Branch classification decisions.... Executive Branch classification decisions are entitled to "the utmost deference"... and that such deference is especially appropriate where the Executive Branch bases its classification decision, as here, on a review of all pertinent information, including whether disclosure of the data in the manner proposed by the companies would risk filling out the mosaic of information available to our adversaries in their efforts to assess and avoid our surveillance capabilities.

And so we're back to the "mosaic theory," in which the feds argue they can redact stuff out of a fear that a bunch of random info can be put together by bad people to figure out more than the feds want to reveal. But... that makes no sense here. The companies are asking at this point that their own lawyers be able to see the arguments, not necessarily that the details be made public. The court could easily seal the filings from the public while letting the companies' lawyers see it.

Filed Under: doj, first amendment, fisa, fisc, redacted, transparency
Companies: apple, facebook, google, linkedin, microsoft, yahoo

US 'Intelligence' Boss Reveals 'Redacted' Date In The URL Of The File

from the or-in-the-other-version-of-the-document-you-already-released dept

We've written a few times about the latest document dump by James Clapper and the Office of the Director of National Intelligence this week, in which they declassified a large pile of documents (after being told to by the courts -- though they don't mention that part). But, one of the odder parts was that the dates were redacted on certain legal filings, such as the FISA Court order by judge Reggie Walton smacking the NSA around a bit for not complying with the law. Here's the end of that document with the date redacted: Eagle-eyed Marcy Wheeler, however, has noticed two things. First, the absolute geniuses at the Office of the Director of National Intelligence left the date of the ruling in the URL of the file. You can mouseover to see it, or just know that it's: http://www.dni.gov/files/documents/1118/CLEANED101. Order and Supplemental Order (6-22-09)-sealed.pdf. See that in there? That pretty clearly indicates this is Walton's order from June 22nd, 2009. Good job, team redaction!

Oh, and it gets even stupider.

It turns out that this same document was already declassified in an earlier data dump... with totally different redactions. Both files are embedded below.

From that, you can see that the redactions (in both) seem rather arbitrary (especially redacting the dates). In many cases, it's difficult to understand why any of these points were redacted in either document. For example, in the original declassification, the following is redacted, but is available in the new release:

The Court further ordered that it would allow NSA, for a period of 20 days, to continue to share the unminimized results of authorized queries of the PR/TT metadata with NSA analysts other than the limited number of analysts authorized to access such metadata, but that such sharing was not to continue beyond the 20-day period unless the government first satisfied the Court, by written submission, that such sharing is necessary and appropriate on an ongoing basis.

Either way, it says quite a lot (none of it good) about our "intelligence" professionals when they offer up a document with a redacted date (makes no sense in the first place), which is easily revealed by the very URL (wtf?) that the intelligence officials chose, and which is further undermined by the fact that the same document had already been declassified with totally different redactions (and which reveals the date). And we're supposed to believe these folks are smart enough to not screw up with all the data they're collecting on everyone?

Filed Under: dates, fisa court, fisc, intelligence community, james clapper, nsa, odni, redactions, surveillance, urls

FISA Court Tells The DOJ That It Needs To Explain Why It's Ignoring Order To Declassify Surveillance Opinion

from the can't-just-say-no dept

Yesterday, we wrote about the DOJ responding to a FISA Court order that it declassify a FISA Court ruling on the interpretation of Section 215 of the PATRIOT Act (related to the bulk collection of metadata), in which the DOJ effectively told the court that it wasn't going to obey. This was the extent of the DOJ's reasoning:

After careful review of the Opinion by senior intelligence officials and the U.S. Department of Justice, the Executive Branch has determined that the Opinion should be withheld in full and a public version of the Opinion cannot be provided

Basically, yes you told us to declassify it, but we've decided that we won't. Now, of course, the FISA Court itself is well aware what's in that particular February ruling, and since it ordered it to be declassified, it doesn't seem to think there's a major reason to keep it secret. So, it took all of a day for the FISA Court to order the DOJ to at least explain itself better:

The government has provided no explanation of this conclusion.

Accordingly, it is hereby ORDERED that, no later than December 20, 2013, the government shall submit a detailed explanation of its conclusion that the Opinion is classified in full and cannot be made public, even in a redacted form.

Of course, in keeping with FISC tradition, this is a pretty tame response to the DOJ basically giving a giant middle finger to the FISC's earlier order. And, again, the FISC knows darn well what's in the ruling that the DOJ refuses to make public, because it's the FISC's own ruling. So they seem to think that there's good reason to declassify it. Hopefully, the FISC will actually, for once, stand up to the DOJ, but I'm not holding my breath.

Filed Under: bulk collection, declassification, doj, fisa court, fisc, metadata, nsa, patriot act, section 215, surveillance

With Repeated Reports Of Long-Term NSA Abuses, Does Anyone Actually Believe NSA Is Following The Law Today?

from the simple-question dept

Throughout this process of discussing the NSA's surveillance efforts, thanks to Ed Snowden and his whistleblowing, defenders have continued to insist (1) that the NSA isn't abusing its powers and (2) that there's tremendous oversight of the NSA's activities, mainly by FISC. Yet, with this week's declassification of a second FISC ruling in which a judge detailed major, long-term abuses by the NSA, with no consequences, does anyone actually believe the NSA has stopped abusing its powers to violate everyone's privacy?

As a reminder, back in September it was revealed that FISC judge Reggie Walton was pretty angry about abuses by the NSA:

The minimization procedures… have been so frequently and systemically violated that it can fairly be said that this critical element of the overall BR regime has never functioned effectively.

Then there was Judge John Bates' ruling just revealed this week:

...the government acknowledges that NSA exceeded the scope of authorized acquisition continuously during the more than [redacted] years of acquisition under these orders.

These are different violations. And, yet, in both cases, they seemed to indicate rather systematic abuses by the NSA, and very little concern on the part of the NSA to get it right. After all, these problems appeared to go on for years, and were either unreported or not clearly reported to the FISC, which could do little about it.

And that raises a key question, pointed out by Steve Vladeck -- Given these two relatively recent rulings, detailing systematic, widespread and long-term abuses by the NSA in violation of the law, how can any NSA defender claim with a straight face that the NSA is now in compliance?

There may well be explanations for each of the compliance incidents documented in the Walton and Bates opinions; that’s not the point. Instead, the larger message that comes through these newly disclosed opinions is the pervasiveness of compliance incidents, and the extent to which careful supervision by the FISA Court, while apparently able to produce some accountability in response to such incidents (as in the opinions released yesterday), simply does not seem to have mooted these concerns. That is to say, with every new FISA Court opinion responding to new compliance incidents, it becomes that much harder to trust that compliance concerns are ancient history.

Of course, when there's no real "cost" for being non-compliant, why would the NSA care that much about being compliant?

Filed Under: compliance, fisa court, fisc, nsa

NSA Memo Shows Unlimited Access To Bulk Records Unnecessary To Keep US Safe From Terrorists

from the but,-of-course,-the-program-must-not-be-restricted-in-any-way dept

The DNI's recent document dump has sprung loose an April 2009 "notification memorandum" from the NSA, which provides updates on its "end-to-end" reviews of both the Section 215 (phone metadata) and the Section 402 (email metadata) bulk records collections. As was noted in earlier posts, both programs were suspended by the FISA court because of the NSA's routine abuse FISA Act limitations.

The declassified document is addressed to the Senate Select Committee on Intelligence (SSCI). There's no indication this information was also disseminated to the House Intelligence Committee, but perhaps that will surface in the future. The memo spends a few introductory paragraphs detailing the efforts the NSA has made to clean up its act before delving into more interesting details -- including the limitations placed on the Section 215 collection by the Judge Walton, as well as a new problem it uncovered during its 60-day "end-to-end" reviews.

Here are the rules the NSA was forced to comply with under Walton's court order.

Since the March 5, 2009 FISA Court order, the Court's approval has been required for each selector before it is tasked for BR FISA metadata analysis. On Mar 21 NSA resumed manual access to BR FISA metadata, allowing chaining [redacted] of FISA Court-approved selectors associated with [redacted] following multiple operational and technical reviews to ensure compliance.

This explains ODNI counsel Robert Litt's hesitancy to store metadata at a "neutral site." To do so would mean returning to 2009's restrictions -- which were brought on by the agency's own malfeasance. Utilizing a neutral site would likely mean the FISA court would be approving selectors rather than granting permission for rolling, 90-day collections of all phone records.

Also of note is how few court-approved selectors there were at that point.

A limited number of NSA analysts are now performing manual queries against 209 FISA Court-approved high-priority selectors daily…

Once again, hauling in millions of phone records seems like overkill. Since the agency has had (serious) trouble with adhering to the RAS (reasonable articulable suspicion) requirement, it would make more sense to return to this limitation if the Section 215 program is to remain running. With two bulk data programs suspended or significantly altered between 2009-2010, the US still somehow managed to avoid being overrun with terrorist attacks. If the program can't be eliminated, at the very least, it should return to this more minimal standard -- seeking court approval for RAS-compliant selectors and searching offsite, rather than simply amassing millions of non-relevant phone records.

Further down, more incidents of data abuse/misuse are detailed, this time at the hands of other agencies which were given access to the metadata collections

[Redacted; presumably includes a start date] NSA and DIA entered into a pilot program which allowed the DlA's Joint Intelligence Task Force - Combating Terrorism (JITF-CT) access to counterterrorism-related SIGINT information, including SIGINT collected pursuant to the Foreign Intelligence Surveillance Court's (FISC) [redacted] . Access to this FISA data was controlled and was limited to JITF-CT who had undergone training on the application of NSA minimization procedures to the FISA data and who were subject to NSA oversight of their activities. Moreover, these personnel were required to coordinate with NSA regarding dissemination of the information outside of JITF-CT.

The NSA made these Task Force members "employees" in order to grant them the privileges needed to access the metadata collection in its unminimized form. While conducting a review of its systems in 2008, the NSA found that one database (name redacted in memo) "lacked sufficient controls." The database was shut down and resurrected with "correct" controls implemented. Unfortunately, it was this "uncontrolled" database that its new honorary employees had access to. The NSA revoked Task Force members' access to the databases but was unable to determine explicitly whether any sort of unauthorized access had occurred.

Instead of presenting a possible worst-case scenario, the agency memo delivers this powerful statement of (misplaced) faith.

[A sentence and half worth of redacted text] there is no way to determine whether, in fact, JITF-CT analysts accessed it without authorization. However, even if such access occurred, the analysts were trained in routine minimization procedures and were required to coordinate with NSA regarding dissemination of information outside JITF-CT…

Of course. Because the training and minimization procedures have always prevented actual NSA employees from abusing the bulk records collections.

This isn't the only case of problematic shared access. Another agency is discussed in a heavily-redacted paragraph. This unnamed agency was given access to unminimized X-KEYSCORE SIGINT data. Among the other unredacted sentences is one stating that this access is "predicated" on the principle that "collaboration is essential" to prevent terrorist attacks. Whichever agency is not being named here doesn't seem to have held up its end of the bargain, which resulted in the (perhaps temporary) suspension of its access to the data.

On review of this access NSA is considering whether allowing this [redacted] access to unminimized SIGINT collection fully complies with NSA procedures.

Whether or not that access has been returned is still open for debate considering the agency's name has been hidden away under the black and turquoise [!?] ink. What isn't open to debate is the fact that the NSA continues to struggle with handling its data collections responsibly. As more documents are pried loose thanks to the ACLU and EFF's efforts, I'm sure we'll see even more evidence that the agency isn't nearly as careful as its defenders assert it is.

Filed Under: bulk data, fisa court, fisc, metadata, nsa, section 215, terrorists

Feds: Even Though We've Been Ordered To Reveal Secret Interpretation Of The PATRIOT Act, We're Not Going To Do That

from the secret-laws! dept

You may recall that, back in early September, the FISA Court (FISC) agreed that its various rulings that secretly interpreted Section 215 of the PATRIOT Act to mean something entirely different than any plain language reading of the law implies should be declassified. Here's what the court said at the time:

The unauthorized disclosure in June 2013 of a Section 215 order, and government statements in response to that disclosure, have engendered considerable public interest and debate about Section 215. Publication of FISC opinions relating to this provision would contribute to an informed debate. Congressional amici emphasize the value of public information and debate in representing their constituents and discharging their legislative responsibilities. Publication would also assure citizens of the integrity of this Court's proceedings.

In addition, publication with only limited redactions may now be feasible, given the extent of the government's recent public disclosures about how Section 215 is implemented. Indeed, the government advises that a declassification review process is already underway.

In view of these circumstances, and as an exercise of discretion, the Court has determined that it is appropriate to take steps toward publication of any Section 215 Opinions that are not subject to the ongoing FOIA litigation, without reaching the merits of the asserted right of public access under the First Amendment.

It then instructed the DOJ to figure out what to redact, so it could be declassified and released. Except... the DOJ instead fought that order, and while it did find some documents that meet the criteria -- namely a ruling from February of this year -- the DOJ is now telling the FISA Court that despite the order, it would really prefer to keep that interpretation of the law a complete secret. Actually, it goes further than that. It doesn't ask for permission to keep it secret, it just says that it cannot reveal the interpretation.

After careful review of the Opinion by senior intelligence officials and the U.S. Department of Justice, the Executive Branch has determined that the Opinion should be withheld in full and a public version of the Opinion cannot be provided.

Got that? This secret court interpretation of a law that we all live under, which the court itself has ordered to be revealed, is unlikely to be revealed because the intelligence community really, really doesn't want it revealed. Again, this is not about so-called "sources and methods." This is entirely about understanding how a US court interprets a US law. But that interpretation is secret, meaning that the law itself is secret, and apparently the executive branch of the federal government is going to fight to keep it that way.

Filed Under: bulk collection, doj, fisa court, fisc, metadata, patriot act, section 215, surveillance

Declassified Opinion Shows The NSA Exploited Pen Register Statutes To Collect Internet Metadata On Millions Of Americans

from the the-box-has-no-edges... dept

The Office of the Director of National Intelligence has just released a very large set of declassified documents, covering a variety of topics. (Just a friendly reminder: these documents are being released because of a court order, not because the ODNI loves transparency, no matter how it's phrased at I CON THE RECORD.) Of particular interest is one that appears to be the original court opinion that gave the NSA permission to collect bulk internet metadata on Americans, better known as the Stellar Wind program, which ran for a decade before being shut down in 2011.

Orin Kerr, writing for (watch your step) the Lawfare blog, breaks down the questionable arguments the government presented and the leaps the presiding judge (Colleen Kollar-Kotelly) made to grant this request.

To begin with, the government presents this collection as nothing more than a modern-day pen register. As Kerr explains, the privacy bar for pen registers is set incredibly low.

The federal pen register authorities use a mere certification standard. Under the national security version of the pen register statute, the FISC is required to approve an application for pen register surveillance whenever the Attorney General (or an attorney he designates) certifies under oath “that the information likely to be obtained” from the monitoring “is relevant to an ongoing investigation to protect against international terrorism or clandestine intelligence activities,” 50 U.S.C. 1842(c)(2). As long as the government has issued its certification, and the judge concludes that the government’s application falls within the statute, “the judge shall enter an ex parte order.” 50 U.S.C. 1842(d)(1). The government doesn’t have to say why it thinks the standard has been satisfied; it just certifies under oath that it does. And the judge has no authority to look behind the government’s assertion to see if its factual basis is strong, weak, or completely absurd. See generally In re Application of the United States, 846 F.Supp. 1555 (M.D. Fla. 1994). The judge’s only role is making sure the government checked the box and made the required certification under oath.

There's a reason why the bar is set so low. It's inherently limited.

The pen register authority permits monitoring of a suspect’s non-content metadata unprotected by the Fourth Amendment for a window of time, investigative steps outside the Fourth Amendment than are akin to tailing a suspect in public or obtaining a mail cover to monitor the outside of their mail.

So, all a judge is looking for is a box ticked by a US Attorney. If that's present, then the pen register collection can proceed. But this is a surveillance method that is targeted at one particular suspect. It's not used to collect data on multiple persons at one time. Certainly multiple pen registers can be obtained in order to collect multiple sets of metadata, but each request is singular. Or was, until the NSA decided to extrapolate the singular pen register into a bulk collections program.

[I]t wanted an order forcing a provider to record and disclose Internet metadata in real time on an ongoing basis for potentially tens of millions of customers, all with a single order obtained with no judicial review based on a mere certification by the Attorney General.

The government took this low bar and convinced a judge that there was technically no difference between collecting metadata on ONE person and collecting metadata on millions. It wasn't just the government doing the rhetorical legwork. Kerr points out that the presiding judge ignored several statutory clues within the pen register law that indicated it was never meant to be used for bulk, untargeted collections.

The statute authorizes the judge to issue an order requiring the installation of “a” pen register to monitor “the person who is the subject of the investigation.” 50 U.S.C. 1842(d)(1)-(2). This is written in the singular, suggesting that each pen register requires a subject.

Furthermore, she buys into the government's arguments that the ends justify the means.

She then concludes that the bulk collection is reasonable in a Fourth Amendment sense — not that the Fourth Amendment applies, as this is just metadata, but rather in the policy sense that the program represents a sensible balance between security and privacy along the lines of that required under Fourth Amendment reasonableness precedents. The application is thus granted because, all things considered, the program does seem to be a pretty good way to find terrorists. See pages 49-54.

This argument has been used more than once by the government to defend the NSA's collections. The government extrapolates from the fact that if something isn't a violation of civil liberties for one person (i.e., bulk records collections) than it's not a violation when the program collects records on millions. The courts have backed this up: rights do not spring into existence ex nihilo.

The government used this argument to address Basaaly Moalin's claims that records obtained under the Section 215 program violated his constitutional rights. In the most basic terms, it claimed that if an intelligence (or law enforcement) agency can surveil one person without violating their Fourth Amendment rights (using bulk records, etc.), it can do it to everyone. (Perversely, it then spins around and claims this is why no one has standing to sue the government over these untargeted collections.)

So, the expansion of the previously targeted pen register program into a bulk internet metadata collection relied on the same basic argument. Even if the statute is written in a way that specifies singular targeting, the government would argue that the statute is equally applicable to collecting data on millions of people -- all of it needing no more authority than a signature of a United States Attorney.

All things considered, it's rather surprising the Stellar Wind program was shut down. The NSA certainly has shown no desire to eliminate a program, even if it produces large amounts of nearly-useless data. More than likely, the program was just supplanted by a better dragnet. Right about the time Stellar Wind shut down, a rules change to the Section 702 collections program gave the NSA "permission" (via a new loophole) to target Americans directly.

Also of note: while there's no date on this document (redacted, of course), the internal citations [Lamie V. United States Trustee, 124 S. Ct. 1023, 1030 (2004), p. 7; Engine Mfrs. Ass'n v. South Coast Air Quality Mqmt. Dist., 124 S. Ct. 1756, 1761 (2004), p. 14] suggest this opinion was the end result of another post facto search for permission by the NSA. The program supposedly began in 2001, but the court doesn't actually address the collection until 2004, at the earliest. This may be the point that the NSA first sought to collect metadata on Americans, with all previous collections being foreign only — but without further documentation (and factoring in the agency's tendency to collect first, seek approval later), there's no way to tell if the NSA was collecting internet metadata without even the barest minimum of legal approval previous to this opinion.

Filed Under: colleen kollar-kotelly, email, fisa court, fisc, internet, metadata, pen register