Another Batch Of FISA Court Docs Confirms The NSA Frequently Abuses Its Collection Powers

from the violating-the-law-on-the-regular dept

More evidence of the NSA's abuse of its surveillance powers has surfaced, thanks to a FOIA lawsuit by the EFF. To date, the EFF has secured 73 FISC opinions as the result of this lawsuit and is still fighting for the release of six opinions the government has chosen to withhold entirely.

One of the opinions released to the EFF shows the NSA's frequent assertions about proper minimization, careful deployment of surveillance techniques, and supposedly robust oversight are mostly false. The NSA abuses its powers and withholds evidence of its abuses from the FISA court, undermining the system of checks and balances meant to keep the agency in line.

The opinion [PDF] embedded below is just one of several recently acquired by the EFF, but it still shows plenty of surveillance power abuse by the agency. Aaron Mackey of the EFF summarizes the contents of the order:

The opinion, the date of which is redacted, orders the deletion of materials the NSA collected without court authorization. The opinion recounts how after the court learned that the NSA had exceeded an earlier issued surveillance order—resulting in surveillance it was not authorized to conduct—the government argued that it had not actually engaged in unauthorized surveillance. Instead, the government argued that it had only violated “minimization procedures,” which are restrictions on the use of the material, not the collection of it.

Judge Hogan, who served on the FISC from 2009-16 and was its chief judge from 2014-16, expressed frustration both with the government’s argument and with its lack of candor, as the court believed officials had previously acknowledged that the surveillance was unauthorized. The opinion then describes how the surveillance failed to comply with several provisions of the Foreign Intelligence Surveillance Act (FISA) in collecting the intelligence.

Much of the opinion is redacted, leaving only sentence fragments for readers to parse. But even these fragments manage to produce a decent depiction of apparently long-running program abuses by the NSA. What the court called "unauthorized electronic surveillance," the government claimed was only a violation of minimization procedures. Even if the court was willing to cede this argument to the government (and it wasn't), the court goes on to point out that the NSA had done nothing to address this violation of minimization procedures.

The government has undertaken, but not completed, a process to identify and destroy [redacted], such that the effects of having acquired [redacted] have not been completely eradicated.

A little further on, the court makes it clear repairing minimization procedures does not excuse prior unauthorized collections, nor would it make similar collections legal in the future.

It has been understood from the inception of FISA that minimization procedures could include limitations on what communications may be acquired from surveillance directed at an otherwise authorized facility. When the government disregards such a limitation, thereby acquiring communications in excess of what the order authorizes, those acquisitions constitute unauthorized electronic surveillance…

And it appears the NSA again withheld info from the court, preventing it from doing its job properly.

[T]he Court was deprived of an adequate understanding of the facts known to NSA and, even if the government were correct that acquisition [redacted] was authorized, a clear and express record of that authorization is lacking.

This is only one of several FISA court documents discussing unauthorized collections. The stockpile of FOIAed documents indicates the government has rarely used its collections programs correctly. The history of the NSA's interactions with the FISA court is littered with references to over-collection and agency obfuscation. This is more of the same from an agency that claims to be precisely and thoroughly controlled by external and internal oversight. The FISA court documents don't align with the NSA's narrative. Instead, they show an agency willing to ignore the law and mislead the court to engage in surveillance its oversight has never authorized.

Filed Under: abuses, fisa court, fisc, foia, nsa, surveillance
Companies: eff

New DOJ Boss Says He Hasn't Read DOJ Investigations Into Abusive Policing, Calls Them 'Anecdotal'

from the DOJ-v.-American-Public dept

New Attorney General Jeff Sessions has just sent another message about the future of US law enforcement: there will be no policing of the police during the Trump Years. In his first on-the-record briefing, Sessions flat-out stated the DOJ's many civil rights investigations of local police departments mean nothing.

[Sessions] said he had not read the Obama Justice Department's scathing reports on unconstitutional policing practices in Ferguson, Mo., or in Chicago, reasoning that he found the summaries "pretty anecdotal."

Nothing is more useless than deliberately ignored facts. Summing up multi-year investigations as "anecdotal" goes far beyond willful ignorance into dangerously-smug territory. At least when FBI director James Comey said he hadn't bothered reading the CIA Torture Report, he had the excuse that the info included did not directly reference his area of control.

Sessions doesn't have this excuse. But his focus isn't on what's wrong with America's law enforcement. He's only interested in what's wrong with Americans. He wants tougher sentencing and tougher laws. He's looking at moving forward with federal prosecutions targeting legal marijuana sales. He wants to ease restrictions on asset forfeiture. He has shown no concern about the policed, only for the police.

Sessions also called police officers cowards during his briefing.

Sessions said police officers in Chicago were arresting people less frequently, which he speculated may be out of fear their interactions could be recorded and spread on the internet.

"The officer feared for his observation." That's the jist of this statement by Sessions. He may think this is a perfectly acceptable reason for Chicago PD officers to not do the job they're paid to do, but only a coward would shy away from doing their job because it might be witnessed by others. What a bunch of shit.

But back to the "anecdotal" shrug off of the DOJ Civil Rights Division's work. Here's some of the stuff Sessions has the audacity to call "anecdotal."

From the DOJ investigation of the Ferguson PD:

We spent, collectively, approximately 100 person-days onsite in Ferguson. We participated in ride-alongs with on-duty officers, reviewed over 35,000 pages of police records as well as thousands of emails and other electronic materials provided by the police department. Enlisting the assistance of statistical experts, we analyzed FPD’s data on stops, searches, citations, and arrests, as well as data collected by the municipal court. We observed four separate sessions of Ferguson Municipal Court, interviewing dozens of people charged with local offenses, and we reviewed third-party studies regarding municipal court practices in Ferguson and St. Louis County more broadly. As in all of our investigations, we sought to engage the local community, conducting hundreds of in-person and telephone interviews of individuals who reside in Ferguson or who have had interactions with the police department. We contacted ten neighborhood associations and met with each group that responded to us, as well as several other community groups and advocacy organizations. Throughout the investigation, we relied on two police chiefs who accompanied us to Ferguson and who themselves interviewed City and police officials, spoke with community members, and reviewed FPD policies and incident reports.

Also "anecdotal:" (from the Chicago investigation)

First, we reviewed thousands of pages of documents provided to us by CPD, IPRA, and the City, including policies, procedures, training plans, Department orders and memos, internal and external reports, and more. We also obtained access to the City’s entire misconduct complaint database and data from all reports filled out following officers’ use of force. From there, we reviewed a randomized, representative sample of force reports and investigative files for incidents that occurred between January 2011 and April 2016, as well as additional incident reports and investigations. Overall, we reviewed over 170 officer-involved shooting investigations, and documents related to over 425 incidents of less-lethal force.

We also spent extensive time in Chicago—over 300 person-days—meeting with community members and City officials, and interviewing current and former CPD officers and IPRA investigators. In addition to speaking with the Superintendent and other CPD leadership, we met with the command staff of several specialized units, divisions, and departments. We toured CPD’s training facilities and observed training programs. We also visited each of Chicago’s 22 police districts, where we addressed roll call, spoke with command staff and officers, and conducted over 60 ride-alongs with officers. We met several times with Chicago’s officer union, Lodge No. 7 of the Fraternal Order of Police, as well as the sergeants’, lieutenants’, and captains’ unions. All told, we heard from over 340 individual CPD members, and 23 members of IPRA’s staff.

Our findings were also significantly informed by our conversations with members of the Chicago community. We met with over ninety community organizations, including non-profits, advocacy and legal organizations, and faith-based groups focused on a wide range of issues. We participated in several community forums in different neighborhoods throughout Chicago where we heard directly from the family members of individuals who were killed by CPD officers and others who shared their insights and experiences. We also met with several local researchers, academics, and lawyers who have studied CPD extensively for decades. Most importantly, however, we heard directly from individuals who live and work throughout the City about their interactions with CPD officers. Overall, we talked to approximately a thousand community members. We received nearly 600 phone calls, emails, and letters from individuals who were eager to provide their experiences and insights.

The DOJ Civil Rights Division won't be given this long of an investigative leash under Sessions. The Trump Administration is already planning to cut this division's budget, and the man at the top of the organizational chart is just going to dismiss the findings without even reading them. Sessions says he's "not sure" if he'll pursue a consent agreement with the Chicago PD, which strongly suggests he won't. He seems more concerned about the criminal activity in the city and fails to see how unconstitutional and abusive policing may be making it worse.

Police accountability is off the table for the next four years minimum. Whoever inherits this mess will have to make up a lot of lost ground. Under this administration, law enforcement officers will be untouchable, as least at the federal level. The groundwork has begun on Police State, USA.

Filed Under: abuses, chicago, chicago pd, civil rights, doj, jeff sessions

DOJ Still Won't Admit If It Took Any Action Against NSA Analysts Spying On 'Love Interests'

from the guess-what-that-means dept

In September 2013, in response to a question from Senator Chuck Grassley, the NSA revealed the 12 known cases it had on record over the past decade or so of intentional abuses of the NSA surveillance data, by individuals spying on people they clearly shouldn't have been spying on. Many of these examples were classified as "LOVEINT" (a play on the traditional SIGINT -- for signals intelligence) for people who looked up the private information of those in whom they had a romantic interest. Of course, as we've noted, many of these cases were only discovered after the people self-reported the violation -- and some of that happened years later, suggesting many such abuses go undiscovered.

The released report included examples like the following:

In 2011, before an upcoming reinvestigation polygraph, the subject reported that in 2004, "out of curiosity," he performed a SIGINT query of his home telephone number and the telephone number of his girlfriend, a foreign national. The SIGINT system prevented the query on the home number because it was made on a US person. The subject viewed the metadata returned by the query on his girlfriend's telephone.

And:

In 2005, during a pre-retirement reinvestigation polygraph and interview, the subject reported that, in 2003, he tasked SIGINT collection of the telephone number of his foreign-national girlfriend without an authorized purpose for approximately one month to determine whether she was "involved with any [local] government officials or other activities that might get [him] in trouble."

And:

In 2004, upon her return from a foreign site, the subject reported to NSA Security that, in 2004, she tasked a foreign telephone number she had discovered in her husband's cellular telephone because she suspected that her husband had been unfaithful. The tasking resulted in voice collection of her husband.

And:

In 2003, the appropriate OIG was notified that an employee had possibly violated USSID 18. A female foreign national employed by the U.S. government, with whom the subject was having sexual relations, told another government employee that she suspected that the subject was listening to her telephone calls. The other employee reported the incident.

The investigation determined that, from approximately 1998 to 2003, the employee tasked nine telephone numbers of female foreign nationals, without a valid foreign intelligence purpose, and listened to collected phone conversations while assigned to foreign locations. The subject conducted call chaining on one of the numbers and tasked the resultant numbers. He also incidentally collected the communications of a U.S. person on two occasions.

There are more like that as well. Grassley then asked the DOJ, and specifically Attorney General Eric Holder, if the DOJ took any action against these individuals who clearly broke the law in their surveillance activities. The DOJ ignored the request entirely. In January of 2014 (more than a year ago), Grassley asked Holder again during a hearing when he would receive the answer to his question, and Holder again promised he would "do that soon" and that he would provide a "fulsome response to indicate how those cases were dealt with by the Justice Department."

Well, more than a year has gone by and guess whether or not Holder fulfilled that promise? If you guessed no, you'd be right. Grassley has now sent a new letter asking just when he can actually expect an answer, and suggesting it ought to happen soon.

Recently, however, the NSA released heavily redacted quarterly and annual reports by the NSA to the President's Intelligence Oversight Board ("IOB") that also provide information about these instances of intentional and willful misconduct, as well as other violations by NSA employees, from 2001 to 2013. In its December 23, 2014 press release, NSA asserted that "in the very few cases that involved the intentional misuse of a signals intelligence system, a thorough investigation is completed, the results are reported to the IOB and the Department of Justice as required, and appropriate disciplinary or administrative action is taken." The NSA even referenced its public letter to me that discussed the twelve instances of intentional abuse by NSA employees that led me to write to you back in October 2013.

Respectfully. given the date of my original request, your prior commitment to respond "soon," and the recent release of information by the NSA that expressly relies upon the Department of Justice's further review of these matters, I believe it is appropriate that you respond to my original request without delay.

Anyone want to guess how the DOJ is likely to respond?

Filed Under: abuses, chuck grassley, doj, loveint, nsa, surveillance

DOJ Still Can't Do Math: Terrorist Statistics Inflated, Double Counted And Badly Organized

from the $5-billion-can't-buy-you-a-usable-database-these-days dept

Of all the unsurprising news of inflated numbers and double-counting contained in the Office of Inspector General's (OIG) audit of the DOJ's reported terrorism statistics, this sentence from the introduction of the report is the least surprising -- and by extension, the most damning.

Department resources devoted to preventing terrorism and promoting the nation’s security have increased from approximately $737 million in fiscal year (FY) 2001 to approximately $5.26 billion in FY 2012, an increase of 614 percent.

Despite the exponentially-increased budget and the fact that the EOUSA (which provides terrorism numbers to the DOJ) has had more than six years to get its case tracking system under control, the audit finds there has been little to no improvement. In fact, there's evidence the EOUSA (Executive Office for United States Attorneys) may be getting worse.

We found that although EOUSA revised its procedures for gathering, classifying, and reporting terrorism-related statistics based on the recommendations from our 2007 audit, EOUSA's implementation of the revised procedures was not effective to ensure that terrorism-related statistics were reported accurately. Specifically, we found that EOUSA inaccurately reported all 11 statistics we reviewed during this follow-up audit. Most of these 11 statistics were inaccurately reported by significant margins…

The continued inaccurate reporting by significant margins indicates that EOUSA needs to strengthen its implementation of controls for gathering, verifying, and reporting terrorism-related statistics.

Great, except that it's had since 2007 to improve and simply hasn't. The OIG's report shows that the EOUSA has trouble performing even the most basic of tasks, like updating numbers annually or attaching supporting documentation for the numbers in its reporting.

Because the log and corresponding support were not previously maintained as required, EOUSA had difficulty providing us accurate lists for 5 of the 11 statistics selected for testing. An official of the Data Analysis Staff told us that, as the result of an oversight, the FY 2010 U.S. Attorneys' Annual Statistical Report was not recorded in the FY 2011 log. The official subsequently showed us that this oversight was corrected by updating the FY 2011 log to reflect the FY 2010 U.S. Attorneys' Annual Statistical Report.

The official believed that the schedules listed in the annual report were the support for the reported statistics. However, the schedules in the annual reports only show the numbers reported for each statistic, but do not show necessary supporting details such as case numbers, defendant names, and disposition dates.

Further complicating the matter is the fact that the EOUSA entered case info into the NLIONS (National Legal Information Office Network System) in a completely arbitrary manner, which resulted in inaccurate case counts.

[A]n EOUSA official told us that while the defendant filed an appeal on June 23, 2007, the appeal was not entered into LIONS by the applicable USAO until January 22, 2009, and therefore the appeal was counted as filed in FY 2009. For the other eight cases, the official explained that these were the first appeals filed in FY 2009 for these cases.

When asked how this explanation was consistent with the NLIONS business rules, which state that an appeal should only be counted if it is the first appeal filed in the case, the official told us that a new methodology was used to count the appeals by which EOUSA had selected the defendant with the best disposition, first filing date, latest close date, and the highest participant identification or defendant number.

However, we noted that in a case with multiple defendants there is no guarantee that these criteria will be sufficient for EOUSA to identify a single defendant - for example, the defendant with the "best disposition" may not have the "first filing date." Therefore, this methodology appears likely to produce arbitrary results and therefore does not appear sufficient to us. Moreover, the official had no documented procedures to show the methodology had been changed from that described in the NLIONS business rules.

This isn't the only way the EOUSA screwed with/screwed up the NLIONS database. It also decided that the "smartest" way to track closed cases was by the date it was entered in the system.

We discussed these discrepancies with an EOUSA official who said that EOUSA's terminated statistics are based on the date that USAO personnel enter the disposition into LIONS instead of the date when the case was actually terminated. The official told us that the system disposition date is used for reporting purposes because this date cannot be changed, whereas the actual termination date can be changed in the system, and therefore using the system disposition date improves the accuracy of the reported statistic.

While relying on a static, unchangeable date might protect the integrity of the data, the delays between case closure and entry in the system completely undermines the data's accuracy, especially in terms of determining annual budget outlays.

[W]e found that the time lag between the date the 13 cases were actually terminated and the date the terminations were entered into the system by the USAOs ranged from 10 to 483 days, and averaged 266 days with a median of 314 days...

Because of this discrepancy (which is putting it nicely), the OIG expanded its spot check to cover all 258 cases listed as terminated in 2010.

As a result, we concluded that EOUSA overstated by 32, or 14 percent, the reported number of cases actually terminated during FY 2010. We consider this amount of deviation to be significant. The time lag between the date these 32 cases were actually terminated and the date the cases were entered into the system by the USAOs ranged from 1 to 706 days, and averaged 201 days with a median of 176 days.

That's just this one instance dealing with these specific cases. More examples are scattered throughout the report. Looking at pending cases, the OIG cross-referenced NLIONS with PACER and uncovered some truly lengthy delays.

PACER showed that one case was disposed of on June 25, 2008, but the USAO did not enter the disposition into LIONS until May 2, 2011, which was 1,041 days after the district court terminated the case.

PACER showed that one case was disposed of on December 19, 2007, but the USAO did not enter the disposition into LIONS until February 11, 2011, which was 1,150 days after the district court terminated the case.

PACER showed one case involving six defendants was disposed of on August 6, 2007, but as of February 1, 2013, the USAO had not entered a disposition for any of the six defendants into LIONS, and therefore the case was still shown as pending in LIONS.

When auditing the numbers provided for suspects charged under the National Security Infrastructure statute, the system lag ran right off the charts.

Three defendants' cases were filed in FY 2008, 1 case was filed in FY 2001, and 2 cases were filed in FY 2000. For each of these cases, USAO personnel entered case data into LIONS during FY 2009. Data entry delays ranged from 323 to 3,391 days and averaged 1,848 days with a median of 1,743 days.

This lack of timely data entry not only skewed annual numbers but has also resulted in double counting. In addition, a dozen or so cases were found to have been miscoded as "terrorist-related," including those covering such non-terrorist activities like animal fighting, narcotics possession and bank robbery.

As the OIG states early in the report, the accuracy of these numbers is crucial to making "informed operational and budgetary decisions." Unfortunately, it appears a truly informed decision hasn't been made for nearly the entire lifetime of the DOJ's War on Terror. If a report in 2007 found similar problems and nothing's changed over the past six years, it's safe to assume the problem runs all the back to the initial post-9/11 response.

Thirteen straight years of running a crooked game using ever-increasing amounts of taxpayer funds. In the private sector, this sort of thing would put someone out of business, if not at the receiving end of a class action suit or fraud charges. But here in our government, it's just one of those things -- the endless cycle of audits and corrective actions, neither of which have propelled the EOUSA to anything approaching excellence, much less mediocrity.

Filed Under: abuses, audits, doj, oig, terrorism

The ACLU Would Like To Remind You That The NSA Isn't The Only Three-Letter Agency Abusing The Rights Of Americans

from the the-NSA-gets-all-the-'glory'-while-the-FBI-has-all-the-fun dept

The ACLU would like to remind Americans that, while the NSA has been truly awful, it hasn't completely cornered the market on overreaching surveillance programs and civil liberty trampling. As it points out, the initial leak from Ed Snowden dealt with a bulk phone records court order that was issued jointly for the NSA AND the FBI.

The FBI may seem like a silent partner these days, but it too has its own history of excesses, abuses and overreach.

Since 9/11, the FBI has once again transformed itself into a domestic intelligence agency with the unprecedented power to peer into the lives of ordinary Americans and secretly amass data about people not suspected of any wrongdoing. Through laws passed by Congress, such as the PATRIOT Act, as well as revisions to internal investigative guidelines meant to curb the abuses of the past, the FBI now has the authority to investigate and collect information on Americans without any evidence that they've committed a crime.

With so much power, the result was predictable.

Over the last 12 years, FBI agents have abused the new powers they were given to unfairly target immigrants, racial and religious minorities, and political dissidents for surveillance, infiltration, investigation, and disruption. Specifically, the ACLU has uncovered and documented persistent abuses, including warrantless wiretapping, racial and religious profiling, biased counterterrorism training materials, politically motivated investigations, abusive detention and interrogation practices, and misuse of the No-Fly List to recruit informants.

There's a ton of info in the ACLU's report, and while most of it isn't new, it's still a very thorough breakdown of systemic abuse in the investigative agency. Unlike the NSA, the FBI doesn't necessarily have to take a hands-off approach to Americans or their data. If anything, the FBI is a bigger threat to American citizens and their civil liberties because its domain is primarily the US.

The FBI and NSA are nearly indistinguishable in terms of post-9/11 behavior, as the paper's introduction points out.

[M]odern technological innovations have significantly increased the threat to American liberty by giving today’s FBI the capability to collect, store, and analyze data about millions of innocent Americans. The excessive secrecy with which it cloaks these domestic intelligence gathering operations has crippled constitutional oversight mechanisms. Courts have been reticent tochallenge government secrecy demands and, despite years of debate in Congress regarding the proper scope of domestic surveillance, it took unauthorized leaks by a whistleblower to finally reveal the government’s secret interpretations of these laws and the Orwellian scope of its domestic surveillance programs.

There is evidence the FBI’s increased intelligence collection powers have harmed, rather than aided, its terrorism prevention efforts by overwhelming agents with a flood of irrelevant data and false alarms. Former FBI Director William Webster evaluated the FBI’s investigation of Maj. Nadal Hasan prior to the Ft. Hood shooting and cited the “relentless” workload resulting from a “data explosion” within the FBI as an impediment to proper intelligence analysis.

Lack of oversight? Excessive secrecy? Too much data? The FBI has all the same bad traits as its security counterpart.

Here's some more from the report.

In 2008, the US Attorney General granted the FBI permission to utilize investigations called "assessments" which required no predicate and granted the agency power to conduct these as though they were actual investigations and use all the tools normally available. The FBI was only too happy to take the AG up on his offer.

In a two-year period from 2009 to 2011, the FBI opened over 82,000 “assessments” of individuals or organizations, less than 3,500 of which discovered information justifying further investigation.

Beyond these 82,000 fishing expeditions, the FBI also misused National Security Letters in order to bypass the very minimal restrictions its data collection efforts were subjected to.

A 2007 Inspector General audit revealed that from 2003 through 2005 the FBI issued over 140,000 National Security Letters —secret demands for certain account information from telecommunications companies, financial institutions, and credit agencies that require no judicial approval — almost half of which targeted Americans.

The FBI's abuse of the NSLs goes even further than the fact that the agency nearly continuously wrote itself blank surveillance checks for three straight years. The ACLU notes that the agency so thoroughly abused the program that it truly had no idea how many letters had been issued. An audit of the program also found that 60% of the audited files had no supporting documentation and that 22% contained at least one unreported legal violation.

A second audit report in 2008 failed to find any signs of improvement, but it did uncover signs of an agency trying to cover its tracks.

High-ranking FBI officials improperly issued eleven “blanket National Security Letters” in 2006 seeking data on 3,860 telephone numbers, in an effort to hide that the data had been illegally collected with “exigent letters."

"Exigent letters" being only one of the means the FBI used to illegally acquire data. The report goes on to mention the infamous Post-It notes and other collection methods… like reading over a telco employee's shoulder.

It's all in this report. The spying on journalists. The racial profiling. The investigations of activist groups. The ACLU even makes a note of a report that shows the spirit of J. Edgar still lives on in certain agents.

In a document that reads as if it were written during the Hoover era, an FBI agent describes the peace group Catholic Worker as having “semi-communistic ideology.”

Post-9/11, the agency became unstoppable, even considering the excesses of the Hoover era.

During the FBI’s relentless investigation of the 2001 anthrax attacks, for instance, The New York Times reported that several people falling under suspicion lost jobs, were placed on watch lists, had citizenship and visa applications denied, and personal relationships destroyed. The FBI publicly hounded bioterrorism researcher Steven Hatfill for over a year, following him so closely with up to eight FBI surveillance cars that one of them once ran over his foot. FBI officials later acknowledged Hatfill was completely innocent, and the Justice Department paid him $4.6 million in damages.

The FBI then turned its sights on another researcher, Bruce Ivins, who suffered a mental breakdown and committed suicide.

The FBI, like the NSA, is also very proud of its haystacks and haystack-building programs.

An FBI budget request for fiscal year 2008 said the FBI had amassed databases containing 1.5 billion records, and two members of Congress described documents predicting the FBI would have 6 billion records by 2012, which they said would represent “20 separate ‘records’ for each man, woman and child in the United States.”

And despite all of this data, terrorists continued to slip through the FBI (and NSA's) grasp. The House Homeland Security Committee pointed out shortly after the Boston Bombing that Tamerlan Tsarnaev was the sixth terrorist attack by a "person previously known to the FBI or CIA."

And as the FBI seeks out new sources of data to add to the billions of records it's already drowning in, it's continuing to lie and obfuscate in order to grab more and hold onto it longer.

A tax fraud prosecution in Arizona revealed that the FBI has been failing to inform judges about the particularly invasive nature of “Stingray” devices when it seeks to obtain court orders for location information…

The ACLU of Northern California obtained Justice Department documents showing the FBI has been obtaining pen register orders—which authorize the government to obtain telephone numbers called from and received by a particular mobile device based on a relevance determination—to obtain location data using IMSI catchers, without telling the magistrate judges that this invasive technology would be used.

As was stated earlier, much of what's included here has been uncovered before, but the ACLU's comprehensive report leaves no stone unturned (and no footnote unlinked) in its takedown of an agency whose actions over the last decade have become increasingly abusive.

The FBI doesn't deserve to be let off the hook simply because the national debate on civil liberties and safety is mainly focused on the NSA's actions. It has proven to be just as careless in regards to respecting the rights of Americans and just as bold in its overreach.

Filed Under: abuses, civil liberties, domestic surveillance, exigent letters, fbi, national security letters, nsa, surveillance
Companies: aclu

The Abuses That Nearly Led To The Bulk Metadata Program Being Shut Down Aren't Considered 'Abuses' By The NSA

from the rules-are-for-the-nobodies dept

The set of minimization rules the NSA was supposed to apply to its bulk records collections was issued in 2006. As was noted here earlier, the FISA court laid down a number of limitations and restrictions in this document -- which the agency nearly immediately began violating.

The rules applying to bulk record searches is dated May 24, 2006. A footnote in Judge Walton's furious court order detailing the numerous violations indicates that the NSA began including domestic non-RAS (reasonable and articulable suspicion) numbers on its Alert List shortly thereafter. An NSA report to the FISC dated August 18, 2006 made this statement:

[R]ather than conducting daily queries of the RAS-approved foreign telephone identifier that originally contacted the domestic number, the domestic numbers were included in the alert list as, "merely a quicker and more efficient way of achieving the same result…"

While the end point may seem indistinguishable, the methods aren't and the NSA was forbidden from running searches using non-RAS domestic numbers. This points to the general tendency of the NSA and FBI to opt for the fastest route, rather than the constitutional route.

The Alert List utilized by the NSA contained a sizable number of domestic identifiers. At one point, this list of identifiers grew to nearly 30,000 numbers. Factor in the NSA's two/three-hop (depending on who you ask… and when) contact chaining, and an Alert List search could easily net the entire set of domestic numbers grabbed by the bulk records requisition.

The agency's defense of its abuse boiled down to two arguments, neither of which impressed Judge Walton.

The first claim was that the non-compliance "resulted from a belief by some personnel within the NSA that… [the] Court's restrictions… applied only to "archived data." Walton shot back that this claim "strained credulity," adding that he found it hard to imagine why the court would allow the "critical" RAS requirement to hinge on whether the data had been archived or not. He nailed the lid shut on the argument with this sentence.

Indeed, to the extent that the NSA makes the decision about where to store the incoming BR [bulk records] data and when archiving occurs, such an illogical interpretation of the Court's Orders renders compliance with the RAS requirement merely optional.

The NSA buttressed its first claim with a second one that blamed its immediate oversight, rather than the less-specific "some personnel."

The NSA also suggests that the NSA OGC's [Office of General Counsel] approval of procedures allowing the use of non-RAS-approved identifiers on the alert list to query BR metadata not yet in the NSA's "archive" was not surprising, since the procedures were similar to those used in connection with other NSA SIGINT collection activities.

Walton tore that argument down as well, stating the lack of compliance wasn't simply a "terminological misunderstanding," but a willing decision by the agency to treat all collections uniformly despite there being specific, court-ordered procedures in place to handle incoming BR data.

Further compounding the abuses of the BR data was the NSA's obfuscation of the alert process it (mis)used to search incoming collections. Walton notes that the agency "repeatedly submitted inaccurate descriptions of the alert process." The NSA, in turn, blamed these misrepresentations on a failure by "those familiar with the program" to correct inaccuracies in a report prepared by the managing attorney of the NSA's Office of the General Counsel.

Walton responded to this by pointing out two reasons why the NSA should simply be accused of lying. One, the general counsel who prepared the draft asked for recipients to "make sure" everything contained in the report was true before he sent it to the court. Secondly, Walton footnotes a transcription of proceedings before FISC judge Malcolm Howard where a redacted representative of the NSA affirms that the report is "true and accurate to the best of his knowledge or belief."

The last excuse given by the NSA for its abuse of the BR metadata is perhaps the most damning.

Finally, the NSA reports that "from a technical standpoint, there was no single person who had a complete technical understanding of the BR FISA system architecture."

This is astounding. The NSA openly admits it had no one qualified to deal with tons of metadata, much of which included details on American citizens, and yet it continued to operate the program, expand its Alert List and forge ahead using its own set of rules. At no time did it attempt to seek clarification from the court and at no time did it rein in its collection or querying efforts out of concern it might be violating the privacy of American citizens.

Instead, it did the opposite. It sought permission from the court to expand the number of analysts authorized to access the BR data. And "mistakes" continued to be made. The NSA ensured the court in it would be training the new analysts, but reports continued to filter back detailing more failures.

Despite this training, however, the NSA subsequently determined that 31 NSA analysts had queried the BR metadata during a five day period in April 2008 "without being aware they were doing so."

…[F]rom May 2006 until February 18, 2009, the NSA continues to uncover examples of systemic noncompliance.

The uncomfortable truth of the matter is that the FISC judges have to rely on the NSA's narrative of how the programs are being used in order to determine whether requests can be approved. The NSA had a very nice setup, but it couldn't even keep that together. Three years of abuses almost led to the entire bulk records program being shut down by Judge Walton. He wraps up his court order with several damning paragraphs that call out the agency for its extended malfeasance.

It has finally come to light that the FISC's authorizations of this vast collection program have been premised on a flawed depiction of how the NSA uses BR metadata. This misperception… existed from the inception of its authorized collection in May 2006, buttressed by repeated inaccurate statements made in the government's submissions, despite a government-devised and Court-mandated oversight regime.

The minimization procedures… have been so frequently and systemically violated that it can fairly be said that this critical element of the overall BR regime has never functioned effectively.

[Nearly all of the call detail records collected pertain to communications of non-US persons who are not the subject of an FBI investigation… [or] are communications of US persons who are not the subject of an FBI investigation… and are data that otherwise could not be legally captured in bulk by the government.

After running down the abuses, Walton again points out how the NSA's actions have effectively turned every layer of "oversight" into a joke.

[T]he Court must rely heavily on the government to monitor this program to ensure that it continues to be justified… and that it is implemented in a manner that protects the privacy interests of US persons as required by applicable minimization procedures. To approve such a program, the Court must have every confidence that the government is doing its utmost to ensure that those responsible for implementation fully comply with the Court's orders.

The Court no longer has such confidence.

Five years later, however, the program continues. Walton's order severely limited the NSA until it got a handle on the bulk records program. Walton allowed the collections to continue but forced the NSA to run search requests through the FISC on a "case-by-case" basis.

But were these cases "abuse?" The NSA's stance has been (up until recently) that no abuse has occurred. Some NSA officials probably still believe that nothing that happened between 2006 and 2009 constitutes "abuse," at least not according to any definition it uses.

As the leaks began to filter out into the media, the NSA's defenders have stressed repeatedly that the agency has not abused the rights of Americans, or carried out illegal programs. When evidence surfaced that thousands of incidents of abuse occurred every year, it turned supporters and insiders like Sen. Feinstein ("...the committee has never identified an instance in which the NSA has intentionally abused its authority to conduct surveillance for inappropriate purposes...") and NSA Director of Compliance John Delong ("These are not willful violations, they are not malicious, these are not people trying to break the law.") into liars, or at the very least, dispensers of half-truths.

The defenders of the agency hedge in order to give thousands of apparent abuses the appearance of slight, inadvertent violations. Defending itself from accusations of abuse is about the only place the NSA seems interested in deploying any form of minimization. Feinstein hedges by stating the "committee" has never identified abusive instances (which have to be "intentional" -- an apparently subjective term). Well, considering the committee's role as the premier NSA apologist, it's hardly surprising it's never "identified" any abuse. It's really not interested in looking for any.

Delong hedges as well, using "willful" and "malicious" to make the NSA's convenient "misunderstanding" of the minimization guidelines (which, for a legal document, are surprisingly clear) appear to be privacy-violating errors rather than instances of abuse.

But the NSA does abuse its power and it does violate the privacy of Americans. Just because the analyst doesn't sit down at the desk and start searching for an ex-girlfriend's data (oh wait...), doesn't mean what happened for three straight years under Alexander's watch any less abusive.

Operating a system you don't understand to harvest data on Americans indiscriminately is a form of abuse. Attempting to get away with treating a very specifically regulated program as indistinguishable from other NSA programs not subject to strict limitations is a form of abuse. It's an abuse of the power granted by the Court. It's abuse of the rights of American citizens. But it's never considered abuse by the abusers -- who rationalize everything away as a typo or a misinterpretation or improper training or anything but what it actually is.

Filed Under: abuses, fisc, metadata, nsa, nsa surveillance, patriot act, section 215

What Convinced Obama To Change His Position On NSA Surveillance?

from the because-it-sure-was-a-mess dept

Since details of the NSA's surveillance programs started coming to light in early June -- and President Obama's been forced to publicly answer for its activities -- the president has repeatedly reminded us that he came into office with a "healthy skepticism about these programs." But, after careful evaluation, he determined "that on, you know, net, it was worth doing."

Some of these programs I had been critical of when I was in the Senate. When I looked through specifically what was being done, my determination was that the two programs in particular that had been at issue, 215 and 702, offered valuable intelligence that helps us protect the American people and they're worth preserving. (From his August 9th Press Conference.)

It's a rhetorical strategy intended to win his critics' trust by demonstrating that he understands our concerns because he used to share them. The message he wants us to take away is: if we had been in his shoes and saw the evidence he saw when he got into office, we would have signed off on these programs too.

Well, this week we got a glimpse of some of the evidence he saw when he assumed office -- at least in connection to the NSA's collection of U.S. phone call records -- and, it begs the question, what exactly changed his mind about the NSA's domestic surveillance programs? What did the President see that led him to the conclusion that everything he had previously said on the topic was wrong because allowing the NSA to collect everyone's phone call records really is a constitutionally-supported, great idea?

Because, according to the documents the ODNI released this week, when President Obama took office, the NSA's "telephony metadata" program wasn't getting stellar reviews. In fact, we now know that days prior to Obama’s inauguration, the NSA reported that it had repeatedly violated the court-ordered rules limiting its use of the data it was collecting.  A little over a month later, a judge on the Foreign Intelligence Surveillance Court found that, "Since January 15 [five days before Obama's inauguration] it has finally come to light that the FISC's authorizations of this vast collection program have been premised on a flawed depiction of how the NSA uses" the phone call data.

Not only had the Intelligence Community been misrepresenting its program to the court, the judge, Reggie B. Walton, went on to write

The minimization procedures proposed by the government in each successive application and approved and adopted as binding by the orders of the FISC have been so frequently and systemically violated that it can fairly be said that this critical element of the overall BR regime has never functioned effectively.

And,

To approve such a program, the Court must have every confidence that the government is doing its utmost to ensure that those responsible for implementation fully comply with the Court's orders. The Court no longer has such confidence.

The judge also implied that -- other than hypothetical examples of how this data might provide intelligence of "immense value to the government" -- the government had yet to provide the court with concrete evidence that the program was actually providing that value.

This program has been ongoing for nearly three years. The time has come for the government to describe to the Court how, based on the information collected and analyzed during that time, the value of the program to the nation's security justifies the continued collection and retention of massive quantities of U.S. person information.

Again, Judge Walton reached these conclusions based on evidence that was available to him at the very same time that I imagine President Obama and his team were evaluating these programs. Plus, I'm assuming the president considered Judge Walton's opinion in his evaluation, right?

So, what exactly convinced President Obama that this was "worth doing?" Because as the president explained last month, the prospect that something could happen isn't the same as actual evidence that it has or ever will.

Jennifer Hoelzer is a long-time Congressional staffer with tremendous expertise on national security issues. This story is cross-posted from from her site, with permission, but you should check out her site for more insightful analysis of national security issues.

Filed Under: abuses, barack obama, fisc, keith alexander, nsa, nsa surveillance, section 215, section 702

Ed Snowden Covered His Tracks Well; How Many Other NSA Staffers Did The Same?

from the gone-baby-gone dept

As we've seen, the NSA's story on "abuses" keeps changing. First there were no abuses at all, then there were a whole lot of abuses (but all unintentional) and now we know that there also were a bunch of intentional abuses. But here's the thing: these are only the abuses that the NSA caught. And, even then it's sketchy. As Marcy Wheeler has detailed, many of the "unintentional abuses" look like they were merely classified that way, when, in reality, they may have been intentional. Thanks to the magic of the NSA's special dictionary, they redefine abuses that exceed legal authority but are "performing the mission that the NSA wants them to perform" not as "abuses" but as "mistakes."

Either way, that only counts the abuses and "mistakes" that the NSA's audits discover. As we pointed out, it appears the NSA still has no idea what Ed Snowden took, which calls into question how good these so-called "audits" are. The latest reports coming out reveal that Snowden carefully bypassed or deleted the logs concerning his downloading actions:

The U.S. government's efforts to determine which highly classified materials leaker Edward Snowden took from the National Security Agency have been frustrated by Snowden's sophisticated efforts to cover his digital trail by deleting or bypassing electronic logs, government officials told The Associated Press. Such logs would have showed what information Snowden viewed or downloaded.

The government's forensic investigation is wrestling with Snowden's apparent ability to defeat safeguards established to monitor and deter people looking at information without proper permission, said the officials, who spoke on condition of anonymity because they weren't authorized to discuss the sensitive developments publicly.

Remember when Snowden claimed that, from his desk, he could run searches on anyone, and various NSA defenders like Rep. Mike Rogers scoffed at the idea and called him a liar? They claimed that any such searches would turn up in the audits. But, of course, if you can delete the log files, then those audits are meaningless.

And, if Snowden could do it, it's very, very likely that he's not the only one employed by the NSA or contracting for the NSA who knows how to cover their digital trail. And that leads to a very obvious question: sure, the NSA knows about thousands of unintentional violations and a bunch of intentional violations -- but what about all the violations it has no idea about because someone was able to bypass or delete the log files? Given that NSA employees almost certainly know that searches are audited, you'd have to imagine that nearly everyone who decided to willfully violate the law to, say, spy on a love interest (hello: LOVINT) or, perhaps, a personal enemy, would also seek ways to do so without leaving an incriminating log file. Snowden's efforts show that's possible -- meaning that it's likely others knew that as well.

And, given that it appears that top NSA brass may have been taken by surprise by this rather basic revelation (no audits are perfect, and smart folks like ones the NSA employs often know how to get around such things), it seems quite likely that the number of intentional NSA violations is much, much, much higher than is being reported, in part because the NSA itself still hasn't been able to figure out what happened.

Filed Under: abuses, audits, ed snowden, keith alexander, log files, nsa, nsa surveillance, violations

NSA Admits: Okay, Okay, There Have Been A Bunch Of Intentional Abuses, Including Spying On Love Interests

from the and-we're-just-now-telling-congress dept

So, this week, we wrote about the NSA quietly admitting that there had been intentional abuses of its surveillance infrastructure, despite earlier claims by NSA boss Keith Alexander and various folks in Congress that there had been absolutely no "intentional" abuses. Late on Friday (of course) the NSA finally put out an official statement admitting to an average of one intentional abuser per year over the past ten years. The AP is reporting that at least one of the abuses involved an NSA employee spying on a former spouse. Meanwhile, the Wall Street Journal suggests that spying on love interests happens somewhat more often:

The practice isn’t frequent — one official estimated a handful of cases in the last decade — but it’s common enough to garner its own spycraft label: LOVEINT.

A handful is still significantly more than once. And it's a lot more than the "zero" times we'd been told about repeatedly by defenders of the program.

While the NSA says it takes these abuses seriously, there's no indication that the analyst was fired.

Much more troubling is that it appears that the NSA only told its oversight committee in the Senate about all of this a few days ago:

The Senate Intelligence Committee was briefed this week on the willful violations by the NSA's inspector general's office, as first reported by Bloomberg.

"The committee has learned that in isolated cases over the past decade, a very small number of NSA personnel have violated NSA procedures — in roughly one case per year," Sen. Dianne Feinstein, the California Democrat who chairs the committee, said in a statement Friday.

Of course, this is the same Dianne Feinstein who, exactly a week ago, said the following:

As I have said previously, the committee has never identified an instance in which the NSA has intentionally abused its authority to conduct surveillance for inappropriate purposes.

Yeah. Because apparently the NSA chose not to tell the committee until a few days later, despite it happening for years.

And, of course, they release this all on a Friday night, hoping that it'll avoid the news cycle...

In the meantime, the NSA just made Senator Feinstein look like a complete fool. She's been its strongest defender in Congress for years, and has stood up for it time and time again, despite all of this questionable activity. Then, last week, it lets her tell lies about it without telling her beforehand that there had been such abuses. At this point, it's abundantly clear that Feinstein's "oversight" of the NSA is a joke. She's either incompetent or lying. Either way, it appears that the NSA is running circles around her, and isn't subject to any real Congressional oversight. At some point, you'd think that maybe she'd stop defending it and actually start doing her job when it comes to oversight. You'd think the fact that it let her make a complete fool of herself by claiming there had been no intentional abuses should make Feinstein realize that the NSA situation is out of control. But, tragically, this seems unlikely. Even her statement seems to want to minimize the seriousness of the fact that she -- the person in charge of oversight -- was completely kept in the dark about very serious intentional abuses. Senator Feinstein just got hung out to dry by the NSA. You'd think she'd stop going to bat for it and its lies.

Either way, we've now gone from General Keith Alexander and Feinstein claiming "no abuses," to them saying no "intentional" abuses, to this latest admission of plenty of intentional abuses, including spying on lovers. Perhaps, instead of lying, it's time for the NSA to come clean and to get some real oversight.

Filed Under: abuses, dianne feinstein, intentional abuses, keith alexander, lying, nsa, nsa surveillance, violations

More Confirmation: NSA Analysts Willfully Abused Surveillance Powers

from the another-day,-another-claim-falls dept

On Monday, we pointed out that (1) it was ridiculous for NSA defenders to argue that the thousands of violations were no problem because they weren't "willful" and (2) that there was an admission by the NSA that there had been "a couple" of willful violations by NSA staff in the past few years. Five days later, Bloomberg appears to have discovered the same quotes we saw on Monday, noting that there had been willful violations:

Some National Security Agency analysts deliberately ignored restrictions on their authority to spy on Americans multiple times in the past decade, contradicting Obama administration officials’ and lawmakers’ statements that no willful violations occurred.

“Over the past decade, very rare instances of willful violations of NSA’s authorities have been found,” the NSA said in a statement to Bloomberg News. “NSA takes very seriously allegations of misconduct, and cooperates fully with any investigations -- responding as appropriate. NSA has zero tolerance for willful violations of the agency’s authorities.”

As far as I can tell, this is the identical quote that we saw from John DeLong of the NSA on Monday. Either way, it's good that the press is finally realizing that, yes, the NSA has admitted to multiple willful violations.

Filed Under: abuses, nsa, nsa surveillance, violations, willfully abused