Senator Wyden's 702 Reform Bill Would Limit Backdoor Searches, Permanently Kill 'About' Collection

from the incidental-permadeath dept

As promised, Ron Wyden (along with Rand Paul) has delivered an antidote to the Senate Intelligence Committee's completely terrible Section 702 "reform" bill. That bill, authored by Sen. Burr, would extend the NSA's 702 powers until 2025 while allowing US law enforcement to use collected intelligence for normal law enforcement purposes. It also would have turned the NSA's "about" collection back on, provided no one opposed it with directly-targeted legislation. This program's ability to "inadvertently" sweep up US persons' communications was so concerning the NSA voluntarily shut it off. (It asked to have it turned back on less than two months later, however.)

Charlie Savage of the New York Times has published the latest draft of the Wyden reform bill, titled the USA RIGHTS Act of 2017. (His annotated version of the bill can be found here.) Wyden's bill [PDF] makes several significant changes, including codification of the NSA's voluntary "about" collection shut down.

Beyond preventing the NSA from resuming a collection it has abused since inception, the bill also shortens the extension period to 2021, ensuring the next debate over Section 702 collections isn't put off for nearly a decade. (The Burr bill extended the sunset to 2025. The House Subcommittee's lukewarm reform bill set it at 2023.)

It also would attempt to close the "backdoor search" loophole that allows US government agencies to obtain domestic communications without a warrant. Wyden's bill adds a warrant requirement for these searches -- including those with a national security purpose. This serves two purposes. First, it brings the collection of domestic communications via NSA surveillance back in line with the Fourth Amendment. Additionally, it provides for better accountability by ensuring any database searches leave a paper trail. It also bans the acquisition of content "known to be entirely domestic."

The bill also provides for better notification of prosecutors' use of Section 702-derived evidence. It limits the use of Section 702 surveillance to national security cases, with one exception: direct approval from the Attorney General. The new notification requirements will attempt to circumvent parallel construction by preventing the government from withholding notification if there is any other conceivable way it could have obtained the same evidence (inevitable discovery, normal law enforcement surveillance methods, etc.).

It also adds further reporting requirements, including mandatory production of numbers Wyden has been seeking for years: incidentally-collected US persons' communications. It would also require the FBI to turn over the number of US persons queries it performs using NSA-collected intel.

There are other good aspects to the bill -- stuff normally not discussed during surveillance authority sunsetting. The bill would divest the power currently held by Chief Justice John Roberts. Chief justices have controlled FISA court judge selection for most of the last 30 years, resulting in a long stream of conservative picks, many of them former government prosecutors. This bill would allow all 13 circuits to nominate judges for FISC posts, which should help prevent future FISA judge picks from being so closely aligned with the Chief Justice's views.

Finally, the bill also provides for additional Privacy and Civil Liberties Oversight Board input. The PCLOB is all but dead, but if it's revived, it would have access to Intelligence Community whistleblower complaints.

This is the best reform bill we've seen offered yet. But the clock continues to tick down to 702's renewal. Chances are, Sen. Burr's control of the Senate Intelligence Committee isn't going to do much to ensure this bill moves forward intact, if it moves forward at all. Between Burr and Sen. Feinstein, the oversight committee has been internally limited in terms of actual oversight. Wyden's presence on the committee is the wild card, but entrenched powers continue to limit his effectiveness. Hopefully, some of this bill will replace the worthless, toothless "reforms" proposed by Sen. Burr and continue to nudge the Intelligence Community towards compliance with a number of Constitutional amendments.

Filed Under: about collection, backdoor searches, nsa, rand paul, reform, ron wyden, section 702, surveillance

Senator Burr Pitches 702 'Reform' That Would Give NSA Back Its Most Abused Collection Program

from the word-is-pretty-much-meaningless dept

The Senate Intelligence Committee has released its Section 702 reauthorization bill [PDF]. Rather than fix anything, it makes pretty much everything worse. This is largely due to Sen. Burr's influence, who probably felt he had to bring something to the debate, but couldn't bear to part completely with his "clean, forever reauthorization" dreams.

Senator Burr is somehow claiming this is a "reform" bill. Marcy Wheeler has written an excellent post describing all the ways in which it isn't, especially the tail end of the bill which pretends to limit US law enforcement access to NSA collections.

It does so in Section 5, in what is cynically called “End Use Restriction,” but which is in reality a vast expansion of the uses to which Section 702 data may be used (affirmatively codifying, effectively, a move the IC made in 2015). It permits the use of 702 data in a criminal proceeding for any criminal proceeding that “Affects, involves, or is related to” the national security of the United States (which will include proceedings used to flip informants on top of whatever terrorism, proliferation, or espionage and hacking crimes that would more directly fall under national security) or involves,

Death

Kidnapping

Serious bodily injury

Specified offense against a minor

Incapacitation or destruction of critical infrastructure (critical infrastructure can include even campgrounds!)

Cybersecurity, including violations of CFAA

Transnational crime, including transnational narcotics trafficking

Human trafficking (which, especially dissociated from transnational crime, is often used as a ploy to prosecute prostitution; the government also includes assisting undocumented migration to be human trafficking)

So, just the "serious" crimes. This is how agencies like the FBI are using 702 collections already. All Burr's bill would do is codify the use of foreign-facing national security agency to collect and retain communications related to domestic criminal activity -- some of it potentially rather minor.

Beyond that, the bill looks to give the NSA back its "about" program. This is the program the NSA abandoned after pushback from the FISA court and (perhaps) as a way to dodge uncomfortable questions about the continued collection of domestic communications. This was a voluntary move by the NSA and it was already asking to have its collection back a couple of months later.

Burr's 702 bill would hand the NSA back its program with a 30-day waiting period during which the House or Senate could introduce a bill forbidding the reinstatement of the program. Should no bill be introduced within the notice period, the NSA could pick up where it left off and go back to abusing a collection program it has never not abused since its inception.

It also allows the NSA to make "emergency" claims about its "about" program to bypass legislative attempts to block it. This wouldn't automatically nullify legislative efforts to end the about collection permanently, but it would allow the NSA to continue collecting while the issue is being debated.

So, it's basically what one would expect from one of top hardline supporters of the NSA. Good thing Burr is one of the top men in the "oversight" committee. He's willing to give the NSA what it wants -- along with the stuff it gave up -- and for more years than the House Judiciary Committee's tepid reform option. Burr's bill would push the next renewal fight off until 2025, two years more than the 2023 sunset in the House bill. Fortunately, there may be a third option in play soon. Ron Wyden has announced he's preparing a 702 bill and is pushing the Senate Intelligence Committee to make renewal hearings public.

Filed Under: about collection, fisa, fisa amendments act, mass surveillance, nsa, richard burr, section 702, senate intelligence committee, surveillance

NSA Continues To Dodge 'Incidental Collection' Question, Wants Its 'About' Surveillance Program Back

from the petition-to-return-status-to-quo dept

It's been six years since Senator Ron Wyden first asked the Director of National Intelligence how many Americans' communications are being swept up "incidentally" in the NSA's Section 702 surveillance net. Six years later, he still doesn't have an answer.

Section 702 is up for reauthorization at the end of the year and there's still no information coming from the ODNI [Office of the Director of National Intelligence]. A group of Congressional reps is hoping to pry this info loose before the reauth, but the DNI's been able to hold Wyden off for six years, so…

A U.S. congressional committee on Friday asked the Trump administration to disclose an estimate of the number of Americans whose digital communications are incidentally collected under foreign surveillance programs, according to a letter seen by Reuters.

Such an estimate is "crucial as we contemplate reauthorization," of parts of the Foreign Intelligence Surveillance Act that are due to expire at the end of the year, House Judiciary Committee Chairman Bob Goodlatte, a Republican, and John Conyers, the panel's top Democrat, wrote in a letter addressed to Director of National Intelligence Dan Coats.

The new wrinkle here is going above the head of the DNI and straight to the President. Not that this is any more likely to force a number out of the NSA. The president is all for a clean reauthorization and troubling numbers about "incidental" domestic surveillance will only make that more difficult.

In fact, the DNI's top lawyer just finished telling a Senate committee it won't be turning in its long-overdue homework.

The intelligence community will not produce that number, acting General Counsel for the Director of National Intelligence Bradley Brooker told the Senate Judiciary Committee on Tuesday. Producing the number would take too much time and effort and potentially violate Americans’ privacy in the process, Brooker said, echoing comments DNI Dan Coats made earlier this month. The resulting number might also not be very accurate, he said.

So, that's where this stands now. The DNI promised to pull something together as the previous president headed out the door, but appears to have abandoned its minimal stab at minimal transparency now that the guy up top isn't nearly as interested in curbing the NSA's powers.

Speaking of which, the ODNI is asking to have the "about" collection put back into play, just weeks after the NSA "voluntarily" gave it up.

The panel of intelligence leaders also urged Judiciary Committee members not to restrict so-called “about collection,” in which intelligence agencies collect information from people who are not intelligence targets but mention those targets in emails and text messages.

This would appear to be aimed at Senator Dianne Feinstein's call to codify the end of the "about" collection, which would prevent the NSA from re-implementing it down the road. We haven't even gotten down the road and IC leaders are already trying to rollback the NSA's rollback.

We'll see if this latest move by Congress has any effect. Six years of Ron Wyden (and others) hammering this same question hasn't moved us much closer to seeing how much purely domestic surveillance the NSA engages in. In recent dodges by the new DNI, Dan Coats (in response to Wyden's questions) suggests the NSA is doing far more domestic dabbling than has been disclosed by everyone but the DNI (leaked documents, FOIA'ed court opinions, etc.) These are answers the public needs to have, but they're especially essential to those who will be handling the Section 702 reauthorization. Failure to produce these numbers or answer questions directly should weigh against the sort of reauth the DNI is seeking.

Filed Under: 702, about collection, admiral mike rogers, dan coats, nsa, odni, seciton 702, surveillance

Basically All Big Tech Companies Deny Scanning Communications For NSA Like Yahoo Is Doing

from the getting-more-interesting dept

So, the big story yesterday was clearly the report that Yahoo had secretly agreed to scan all email accounts for a certain character string as sent to them by the NSA (or possibly the FBI). There has been lots of parsing of the Reuters report (and every little word can make a difference), but there are still lots of really big questions about what is actually going on. One big one, of course, is whether or not other tech companies received and/or complied with similar demands. So it seems worth nothing that they've basically all issued pretty direct and strenuous denials to doing anything like what Yahoo has been accused of doing.

Twitter initially gave a "federal law prohibits us from answering your question" answer -- and a reference to Twitter's well documented lawsuit against the US government over its desire to reveal more details about government requests for info. However, it later clarified that it too was not doing what Yahoo was doing and had never received such a request. Microsoft's response was interesting in that it says it's not doing what Yahoo is, but refused to say if it had ever received a demand to do so. Google said it had never received such a request and would refuse to comply if it had. Facebook has also denied receiving such a request, and, like Google, says it would fight against complying. This still leaves lots of unanswered questions about why Yahoo gave in. Again, historically, Yahoo had been known to fight against these kinds of requests, which makes you wonder what exactly was going on here.

Former GCHQ infosecurity guy Matt Tait has one of the more more interesting threads about this news, arguing (in some ways) that it's both less and more than everyone is making it out to be. His basic argument is that this is an expansion of the PRISM program to include "about" targets. This has been discussed in the past, but under PRISM, the NSA could give tech companies "selectors" in the form of specific addresses and the companies were compelled to hand over emails "to" or "from" them -- but according to the PCLOB's report on the Section 702 program it did not include anyone emailing "about" the selector. Upstream collections (i.e., tapping the backbones from folks like AT&T) did include "about" selectors (and this information also flowed into other areas, enabling so called backdoor searches. And, as I speculated yesterday, Tait says that this latest news appears to be Yahoo now agreeing to use "about" selectors on its emails, which means that it's still part of PRISM, with a massive expansion.

Tait then notes that if James Clapper wants to clear this up, he should state publicly whether or not "about" collection is a part of PRISM. And if that's the case, he should also explain when and why PRISM was expanded to include this. But, of course, Clapper and the Intelligence Community tend not to want to explain very much of anything, leaving lots of people in the dark.

And, frankly, that's stupid. The Intelligence Community thinks that this keeps "bad guys" on edge, not knowing what's safe and what's not. But that's dumb. They mostly know to use more encrypted/secret means of communication when they need to. Instead, what you end up with is keeping the public on edge and not trusting services. I can almost guarantee that one of the early comments on this post will be some of you insisting that all the companies denying doing this are flat out lying. I don't agree with that, because the companies don't have a history of outright lying on things like this, but the way the NSA and other parts of the US government have repeatedly tried to pressure them and gag them, it's much tougher to take anything at face value any more. And that's not good for anyone.

Filed Under: about collection, about selectors, mass surveillance, nsa, prism, section 702, upstream
Companies: facebook, google, microsoft, twitter, yahoo