Ninth Circuit Says NSA's Bulk Phone Records Collection Was Illegal, Most Likely Unconstitutional

from the suck-it,-Clapper dept

The NSA's bulk phone records collection is dead. It died of exposure. And reform. It was Ed Snowden's first leak back in 2013. A few years later, a reform bill prompted by Snowden's leaks revamped the program, forcing the NSA to tailor its requests for phone records from telcos. The NSA used to collect everything and sort through at its leisure. But once the program eliminated the "bulk" from the NSA's bulk collection, the NSA couldn't figure out how to obtain records without getting more than it was legally allowed to take.

This recent courtroom win may have come a bit too late to matter much. But it's still a big win. In a case involving material support for terrorists by Somali citizens living in the United States, the Ninth Circuit Court of Appeals has arrived at the conclusion that the NSA's bulk phone records collection is/was illegal.

Here's the short summary from the court [PDF]:

We conclude that the government may have violated the Fourth Amendment and did violate the Foreign Intelligence Surveillance Act (“FISA”) when it collected the telephony metadata of millions of Americans, including at least one of the defendants…

And here's what follows that ellipsis, which should be read while accompanied by the saddest trombone:

… but suppression is not warranted on the facts of this case.

Also, the court does not make a declaration one way or the other whether the DOJ ignored its duty to inform accused suspects that FISA-authorized surveillance provided some of the evidence being used against them. The DOJ rarely does this so it's safe to assume it didn't do it here either. But the court says even if the DOJ ignored this requirement, it didn't have much of an effect on the case.

The government argued (as it has countless times) that it could get all the phone records it wanted whenever it wanted because they're just "third-party records." Wrong, says the Ninth Circuit. The Smith v. Maryland decision that created the Third Party Doctrine is over 40 years old. Technology and Fourth Amendment jurisprudence have both evolved since that point. Using a pen register to gather one suspect's phone records is not even the same thing as gathering millions of phone records created by millions of non-suspects.

The distinctions between Smith and this case are legion and most probably constitutionally significant. To begin with, the type of information recorded in Smith was “limited” and of a less “revealing nature” than the telephony metadata at issue here. Carpenter, 138 S. Ct. at 2219. The pen register did not disclose the “identities” of the caller or of the recipient of a call, “nor whether the call was even completed.” Smith, 442 U.S. at 741 (quoting United States v. New York Tel. Co., 434 U.S. 159, 167 (1977)). In contrast, the metadata in this case included “comprehensive communications routing information, including but not limited to session identifying information (e.g., originating and terminating telephone number, International Mobile station Equipment Identity (IMEI) number, International Mobile Subscriber Identity (IMSI) number, etc.), trunk identifier, telephone calling card numbers, and time and duration of call.”

[...]

The information collected here was thus substantially more revealing than the telephone numbers recorded in Smith.

Not only was it more revealing, there was also much, much more of it.

The duration of the collection in this case—and so the amount of information collected—also vastly exceeds that in Smith. While the pen register in Smith was used for a few days at most, here the NSA collected Moalin’s (and millions of other Americans’) telephony metadata on an ongoing, daily basis for years.

The court says the discussion about reasonable expectations of privacy has already occurred. The public has disagreed with the government on this topic for at least seven years.

Society may not have recognized as reasonable Smith’s expectation of privacy in a few days’ worth of dialed numbers but is much more likely to perceive as private several years’ worth of telephony metadata collected on an ongoing, daily basis—as demonstrated by the public outcry following the revelation of the metadata collection program.

Even if the government is right -- that the collection of one person's phone records does not violate the Constitution -- stretching that same theory to cover millions of phone records doesn't work. A single set of records only reveals so much. Millions of records allow analysts to tie multiple people together and make some pretty good assumptions about their private lives -- who they talk to, when they're most active, what businesses, churches, etc. they frequent.

But the Appeals Court does not decide the Fourth Amendment question.

For all these reasons, defendants’ Fourth Amendment argument has considerable force. But we do not come to rest as to whether the discontinued metadata program violated the Fourth Amendment because even if it did, suppression would not be warranted on the facts of this case.

If the government chooses to challenge this decision, the Supreme Court may draw that conclusion. Considering this isn't going to cost it any evidence, the government may let this one ride, even if it does draw the line in the Section 215 sand: the bulk collection violated the law that authorized it.

The government more or less argued the ends justify the means. The statute says all data collected must be "relevant to an authorized investigation." Since this involved an investigation, gathering phone records on millions of non-targets was somehow OK. Wrong, says the Ninth:

[W]e do not accept the government’s justification in this case that “the call detail records at issue here—the records that suggested that a particular U.S.-based telephone number may have been associated with a foreign terrorist— were clearly relevant to a counterterrorism investigation.” That argument depends on an after-the-fact determination of relevance: once the government had collected a massive amount of call records, it was able to find one that was relevant to a counterterrorism investigation. The problem, of course, is that FISA required the government to make a showing of relevance to a particular authorized investigation before collecting the records.

That means the bulk records collection was unlawful.

We hold that the telephony metadata collection program exceeded the scope of Congress’s authorization in section 1861 and therefore violated that section of FISA.

It seems unlikely the government will attempt to restart the program the NSA divested itself of after it became apparent the technical issues of complying with the USA Freedom Act weren't worth the effort. The program was almost always useless. But the requirements added by the reforms meant the NSA had to tailor its record collection, which it found difficult to do after years of just getting everything.

At the end of all of this, it's still a loss for the defendants. No evidence is suppressed and the court's review of the classified record has led it to the conclusion the records obtained through Section 215 had little to add to the case built against the four accused terrorist supporters. The wins belong to the public and longtime critics of the NSA's bulk collection program. And if the collection of phone records is unlawful, any other "third party" records the NSA is still collecting in bulk have been illegally obtained. That might bother the government enough to appeal this part of the decision. But it risks losing everything if it does.

Filed Under: 4th amendment, bulk collection, mass surveillance, nsa

UK Spies Say They're Dropping Bulk Data Collection For Bulk Equipment Interference

from the I-mean,-they'll-still-use-both... dept

UK spies are changing their minds. Rapidly. Sure, bulk data collection is cool. But you know what's really cool? Mass interference with electronic devices.

At the time the Investigatory Powers Bill was passing through Parliament – it was signed into law in 2016 – EI [Electronic Interference] hadn't been used, but it was already seen an alternative to bulk interception.

However, it was expected to be authorised through targeted or targeted thematic warrants; as then-independent reviewer of terrorism David Anderson wrote at the time, "bulk EI is likely to be only sparingly used".

[...]

During the passage of the Investigatory Powers legislation, he said, the government anticipated bulk EI warrants would be "the exception", and "be limited to overseas 'discovery' based EI operations".

But with encryption increasingly commonplace, the spies want the exception to edge towards becoming the rule.

"Used sparingly" is now "used by default." Why? The good old baddie, encryption. A letter [PDF] written by security minister Ben Wallace says encryption is making bulk data collections less useful.

Following a review of current operational and technical realities, GCHQ have revisited the previous position and determined that it will be necessary to conduct a higher proportion of ongoing overseas focused operational activity using the bulk EI regime than was originally envisaged.

The lawfulness depends on the "double lock" process. The government alone can't give GCHQ permission to engage in bulk EI. There's a judge involved now, making this more of a warrant process than a subpoena process, to make a somewhat clumsy analogy. According to this report, bulk EI is still waiting in the wings. If true, it's a good thing because the double-lock process didn't actually go into effect until the end of November.

What bulk EI is remains somewhat of a mystery. But some of what's described in a 2016 report [PDF] containing several hypotheticals sounds like a lot of large-scale intrusion, ranging from Stingray-esque device location to tactics that have been left up to the imagination thus far.

This sounds a bit like the FBI's child porn hunting Network Investigative Technique: serving up malware to collect information on devices and their users.

Intelligence from sources including bulk interception identified a location in Syria used by extremists. However the widespread use of anonymisation and encryption prevented GCHQ from identifying specific individuals and their communications through bulk interception. GCHQ then used EI under an ISA authorisation (under the Bill this would be done using a targeted thematic EI warrant) to identify the users of devices in this location.

This may be a theoretical Stingray deployment:

A group of terrorists are at a training camp in a remote location overseas. The security and intelligence agencies have successfully deployed targeted EI against the devices the group are using and know that they are planning an attack on Western tourists in a major town in the same country, but not when the attack is planned for. One day, all of the existing devices suddenly stop being used. This is probably an indication that the group has acquired new devices and gone to the town to prepare for the attack. It is not known what devices the terrorists are now using. The security and intelligence agencies would use bulk EI techniques to acquire data from devices located in the town in order to try to identify the new devices that are being used by the group.

Whatever bulk electronic interference ends up being when it's actually deployed, GCHQ is sure of one thing: the less it knows about its targets, the more justified it is using it in bulk.

As the cell members can only be identified following considerable target discovery effort, a bulk EI warrant is suitable.

Whatever civil liberties concerns this program raises will probably be dismissed quickly. GCHQ's hypotheticals involve terrorism suspects overseas and child porn site operators -- the least sympathetic targets available. Foreigners are fair game for bulk anything and no one wants to side with child exploiters, even if they technically share the same civil liberties/rights.

The exception is the rule. This is how it works for those who promise the most worrying aspects of surveillance programs will be saved for the edge cases. Sooner or later, the edge cases are just cases, and no one is interested in walking anything back.

Filed Under: bulk collection, electronic interference, investigatory powers, mass surveillance, uk

European Court Of Human Rights: UK Surveillance Revealed By Snowden Violates Human Rights

from the well-of-course-it-does dept

Yet another vindication of Ed Snowden. Soon after some of the documents he leaked as a whistleblower revealed that the UK's GCHQ was conducting mass surveillance, a variety of human rights groups filed complaints with the European Court of Human Rights. It's taken quite some time, but earlier today the court ruled that the surveillance violated human rights, though perhaps in a more limited way than many people had hoped.

At issue were three specific types of surveillance: bulk interception of communications, sharing what was collected with foreign intelligence agencies, and obtaining communications data (metadata) from telcos. The key part of the ruling was to find that the bulk interception of communications violated Article 8 of the Human Rights Act (roughly, but not exactly, analogous to the US 4th Amendment). It was not a complete victory, as the court didn't say that bulk interception by itself violated human rights, but that the lack of oversight over how this was done made the surveillance "inadequate." The court also rejected any claims around GCHQ sharing the data with foreign intelligence agencies.

In short, the court found that bulk interception could fit within a human rights framework if there was better oversight, and that obtaining data from telcos could be acceptable if there were safeguards to protect certain information, such as journalist sources. But the lack of such oversight and safeguards doomed the surveillance activity that Snowden revealed.

Operating a bulk interception scheme was not per se in violation of the Convention and Governments had wide discretion (“a wide margin of appreciation”) in deciding what kind of surveillance scheme was necessary to protect national security. However, the operation of such systems had to meet six basic requirements, as set out in Weber and Saravia v. Germany. The Court rejected a request by the applicants to update the Weber requirements, which they had said was necessary owing to advances in technology.

The Court then noted that there were four stages of an operation under section 8(4): the interception of communications being transmitted across selected Internet bearers; the using of selectors to filter and discard – in near real time – those intercepted communications that had little or no intelligence value; the application of searches to the remaining intercepted communications; and the examination of some or all of the retained material by an analyst.

While the Court was satisfied that the intelligence services of the United Kingdom take their Convention obligations seriously and are not abusing their powers, it found that there was inadequate independent oversight of the selection and search processes involved in the operation, in particular when it came to selecting the Internet bearers for interception and choosing the selectors and search criteria used to filter and select intercepted communications for examination. Furthermore, there were no real safeguards applicable to the selection of related communications data for examination, even though this data could reveal a great deal about a person’s habits and contacts.

Such failings meant section 8(4) did not meet the “quality of law” requirement of the Convention and could not keep any interference to that which was “necessary in a democratic society”. There had therefore been a violation of Article 8 of the Convention.

The court also found that acquiring data from telcos violated Article 8 as well, for similar reasons.

It first rejected a Government argument that the applicants’ application was inadmissible, finding that as investigative journalists their communications could have been targeted by the procedures in question. It then went on to focus on the Convention concept that any interference with rights had to be “in accordance with the law”.

It noted that European Union law required that any regime allowing access to data held by communications service providers had to be limited to the purpose of combating “serious crime”, and that access be subject to prior review by a court or independent administrative body. As the EU legal order is integrated into that of the UK and has primacy where there is a conflict with domestic law, the Government had conceded in a recent domestic case that a very similar scheme introduced by the Investigatory Powers Act 2016 was incompatible with fundamental rights in EU law because it did not include these safeguards. Following this concession, the High Court ordered the Government to amend the relevant provisions of the Act. The Court therefore found that as the Chapter II regime also lacked these safeguards, it was not in accordance with domestic law as interpreted by the domestic authorities in light of EU law. As such, there had been a violation of Article 8.

Both of those elements also ran afoul of Article 10's protection of free expression because journalists' communications had been swept up in the bulk data collection:

In respect of the bulk interception regime, the Court expressed particular concern about the absence of any published safeguards relating both to the circumstances in which confidential journalistic material could be selected intentionally for examination, and to the protection of confidentiality where it had been selected, either intentionally or otherwise, for examination. In view of the potential chilling effect that any perceived interference with the confidentiality of journalists’ communications and, in particular, their sources might have on the freedom of the press, the Court found that the bulk interception regime was also in violation of Article 10.

When it came to requests for data from communications service providers under Chapter II, the Court noted that the relevant safeguards only applied when the purpose of such a request was to uncover the identity of a journalist’s source. They did not apply in every case where there was a request for a journalist’s communications data, or where collateral intrusion was likely. In addition, there were no special provisions restricting access to the purpose of combating “serious crime”. As a consequence, the Court also found a violation of Article 10 in respect of the Chapter II regime.

On the final issue of passing on the info to foreign intelligence agencies, the court didn't find any human rights issues there:

The Court found that the procedure for requesting either the interception or the conveyance of intercept material from foreign intelligence agencies was set out with sufficient clarity in the domestic law and relevant code of practice. In particular, material from foreign agencies could only be searched if all the requirements for searching material obtained by the UK security services were fulfilled. The Court further observed that there was no evidence of any significant shortcomings in the application and operation of the regime, or indeed evidence of any abuse.

It would have been nice if there was more of a blanket recognition of the problems of bulk interception and mass surveillance. Unfortunately the court didn't go that far. But at the very least this has to be seen as a pretty massive vindication of Snowden whistleblowing on the lack of oversight to protect privacy and the lack of safeguards to prevent telcos from sharing information with the government that should have been protected.

Filed Under: bulk collection, echr, ed snowden, european court of human rights, gchq, human rights, mass surveillance, suveillance

Inspector General's Report Notes Section 215 Requests Down Sharply Since 2013

from the but-that's-because-the-government-has-so-many-other-options dept

The Snowden Effect continues. In addition to actual oversight finally being applied to surveillance programs, the breadth and scope of some programs continues to be narrowed. Some of this narrowing has been forced on the NSA by legislation. But some of it also appears to be shame-related. It's no longer as acceptable to harvest vast amounts of data domestically, apparently.

Shane Harris at The Daily Beast notes that the latest Inspector General's report [PDF] details a sharp decline in Section 215 requests since Snowden's debut leak in June 2013.

Between 2012 and 2014, that court approved 561 so-called “business records orders,” but that number dropped from a nine-year high of 212 in 2012 to 170 in 2014, a nearly 20 percent decrease, according to a review by the Justice Department’s inspector general.

The number fell again in 2015 to 142 orders.

If Snowden hadn't dumped the documents, the program would have remained unaltered and, most likely, requests would have continued to rise. Thanks to a forced "conversation" about domestic surveillance, the resulting USA Freedom Act, along with the appointment of an amicus to make FISA court proceedings a tiny bit more adversarial, the government has scaled back its requests for phone metadata and other "third party" records. Having to target first and request second kind of has that effect.

The other effect leading to this decline is also related to the document leaks. The NSA -- and the FBI, which actually makes the requests for data -- found itself an outcast in its own country. Fewer requests are apparently being made because it's no longer socially acceptable to do so.

A Justice Department official attributed the diminishing use of the program to the “stigma attached” to it after Snowden’s leaks.

Then again, this might just be a nice thing to say. The FBI and NSA have several other surveillance programs operating with less oversight and restrictions than the Section 215 program. Although officials claimed the program was essential when defending it against legislative efforts, there was hardly any evidence presented to back this assertion up. Even the OIG report notes as much, stating that FBI agents "could not identify any major case developments" from its business records collections. Even so, the FBI continues to believe the bulk collection of metadata still serves as a valuable "building block" of its investigations, even if it's ultimately an extraneous one.

The report also points out that the FBI routinely uses other processes to obtain these same records -- ones that are faster and don't require a trip to the FISA court. In between redactions, the OIG notes that the FBI opens "parallel investigations" and utilizes things like grand jury subpoenas to compel the production of business records, rather than routing this through the FISA court. Then there's the FBI's use of National Security Letters, which has showed no sign of slowing even when faced with additional public scrutiny.

Shane Harris points out that the Section 702 program, which harvests vast amounts of internet/email communications and data, is far more useful and far more powerful. That's up for renewal next year and it will be interesting to see how James Clapper's office -- and the FBI -- handle any obstacles standing in the way of a no-questions-asked reapproval. The intelligence community seemed willing to let Section 215 take center stage during the push to pass the USA Freedom Act -- a surveillance state scapegoat released to draw attention away from the NSA's more intrusive bulk collections. But the intel community isn't going to be as easily persuaded to dial back a program that targets platforms that facilitate communications on a much wider scale.

Filed Under: bulk collection, ed snowden, mass surveillance, nsa, section 215, surveillance

Yahoo Secretly Built Software To Scan All Emails Under Pressure From NSA Or FBI

from the uh-wait-a-second dept

So Reuters had a big exclusive report this morning about Yahoo creating "custom software to search all of its customers' incoming emails for specific information" at the behest of the NSA or FBI. This was built last year -- which came well after the Snowden disclosures, and after Yahoo had been revealed to have legally challenged earlier NSA dragnet attempts -- and after it had rolled out end-to-end encryption on email.

Apparently, this was a decision made at the top by Marissa Mayer, and pissed off the company's top security guy, Alex Stamos (who is awesome and a big supporter of end-to-end encryption) leading him to leave the company (and move to Facebook, where he is currently).

According to the two former employees, Yahoo Chief Executive Marissa Mayer's decision to obey the directive roiled some senior executives and led to the June 2015 departure of Chief Information Security Officer Alex Stamos, who now holds the top security job at Facebook Inc."Yahoo is a law abiding company, and complies with the laws of the United States," the company said in a brief statement in response to Reuters questions about the demand. Yahoo declined any further comment.

Of course, this comes out less than a week after the NY Times had a big report on how Mayer de-prioritized security, despite having built up a great team of computer security experts called "The Paranoids." But, Mayer apparently downplayed or blocked their efforts, leading many to go elsewhere. And now we find out that Yahoo agreed to create this special software for scanning all emails for certain phrases or keywords. Bizarrely, this new report notes that Mayer gave the task of writing this software not to the security team, but to email engineers, leaving the security team in the dark, until they discovered it, thinking it was malware:

They were also upset that Mayer and Yahoo General Counsel Ron Bell did not involve the company's security team in the process, instead asking Yahoo's email engineers to write a program to siphon off messages containing the character string the spies sought and store them for remote retrieval, according to the sources.

The sources said the program was discovered by Yahoo's security team in May 2015, within weeks of its installation. The security team initially thought hackers had broken in.

When Stamos found out that Mayer had authorized the program, he resigned as chief information security officer and told his subordinates that he had been left out of a decision that hurt users' security, the sources said. Due to a programming flaw, he told them hackers could have accessed the stored emails.

Now, there are still a number of open questions about this: chief among them if others, such as Google, Microsoft, Facebook, and Twitter were similarly compelled to create similar software. This may not be that meaningful, but the article does not say that it was a FISA Court "order" but rather a "directive" that compelled this:

The company complied with a classified U.S. government directive, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI, said two former employees and a third person apprised of the events.

The question then is what secret "directive" does the government have that allows such broad scanning? The most likely (but certainly not the only) possibility is a stretched interpretation of Section 702 of the FISA Amendments Act. That Section is responsible for two known programs for the NSA to collect info: PRISM, which had big tech companies sharing specific information with the NSA, and "upstream" collection in which broadband providers like AT&T would scan all traffic for certain information. Without more detail, it's a little difficult to know what happened here, but it sounds like something in between PRISM and upstream -- in which online service providers were similarly asked to scan all content for certain information.

It seems clear that Yahoo either didn't think it could win a legal fight over this (certainly a possibility), or that it just didn't want to. At the very least, this seems like yet another example of totally secretive rulemaking by the US government on what surveillance capabilities are legal, without any public review or adversarial process designed to make sure that civil liberties are protected. I know that many of the more paranoid folks out there think that the NSA already had deals with the big companies to scan all content, but they weren't supposed to, and as far as we knew they did not as of a few years ago. But if that changed last year, that's a big, big deal, and much more information needs to become public on this.

Filed Under: alex stamos, bulk collection, email, marissa mayer, mass surveillance, nsa, privacy, scanning, section 702
Companies: yahoo

What's The Difference Between 'Mass Surveillance' And 'Bulk Collection'? Does It Matter?

from the words,-words,-words dept

As numerous Techdirt stories make clear, the particular words used to describe something can make a big difference in how it is perceived. For example, intelligence agencies like to avoid the use of the bad-sounding "mass surveillance," with its Orwellian overtones, and prefer to talk about "bulk collection," which can be presented as some kind of cool big data project. No one is more vociferous in insisting that they are not engaged in mass surveillance, but merely bulk collection, than the UK's Home Secretary, Theresa May. She was pushing that line again last week, during a grilling by a UK Parliamentary committee about her proposed Snooper's Charter. As BBC News reported:

She said the security minister, John Hayes, had written to the committee of MPs and peers scrutinising the draft bill to give the reasons why the government did not want to reveal the kinds of data investigators were accessing.

She insisted the practice -- and the sweeping up by the security services of large quantities of internet traffic passing through the UK -- did not amount to "mass surveillance" as civil liberties campaigners claim.

"The UK does not undertake mass surveillance," she told the committee.

Given what we know that GCHQ is already doing, and adding in what the UK government says it wants to do, that seems an absurd thing to say. But Paul Bernal, Lecturer in Information Technology, Intellectual Property and Media Law at the UK's University of East Anglia, thinks that there is more to this than meets the eye:

Precisely what constitutes surveillance is far from agreed. In the context of the internet (and other digital data surveillance) there are, very broadly speaking, three stages: the gathering or collecting of data, the automated analysis of the data (including algorithmic filtering), and then the 'human' examination of the results of that analysis of filtering. This is where the difference lies: privacy advocates and others might argue that the 'surveillance' happens at the first stage -- when the data is gathered or collected -- while Theresa May, [former GCHQ director] David Omand and those who work for them would be more likely to argue that it happens at the third stage -- when human beings are involved.

If surveillance occurs through the act of gathering personal data on a large scale, then clearly what the UK government does (and wants to do more of) is mass surveillance. But if surveillance only takes place once a human operator looks at some of the gathered data, then Theresa May can plausibly argue that what the UK government is engaged in is not mass surveillance, because relatively little personal data is scrutinized in this way. So the question then becomes: at what point is it most appropriate to say that surveillance has occurred? Bernal offers a helpful analogy. What the UK government wants to do with the Snooper's Charter would be like:

installing a camera in every room of every house in the UK, turning that camera on, having the footage recorded and stored for a year -- but having police officers only look at limited amounts of the footage and only when they feel they really need to.

Does the surveillance happen when the cameras are installed? When they’re turned on? When the footage is stored? When it’s filtered? Or when the police officers actually look at it.

Most people would probably find the automated video recording of everything they did in the privacy of their own home intrusive, and clearly a form of surveillance, even if it was unlikely the footage would ever be seen by a human being. And in Europe, the question has already been settled by the courts:

Privacy invasion occurs when the camera is installed and the capability of looking at the footage is enabled. That’s been consistently shown by recent rulings at both the Court of Justice of the European Union and of the European Court of Human Rights. Whether it is called ‘surveillance’ or something else, it invades privacy -- which is a fundamental right. That doesn’t mean that it is automatically wrong -- but that the balancing act between the rights of privacy (and freedom of expression, of assembly and association etc that are protected by that privacy) and the need for 'security' needs to be considered at the gathering stage, and not just at the stage when people look at the data.

That's important, because it is precisely this issue that the courts will have to consider when the inevitable legal challenges are brought against the UK's Snooper's Charter once some version of it becomes law. In the end, whether the Home Secretary thinks what she is doing is mass surveillance or merely bulk collection is irrelevant -- the UK and EU courts will be the ones that decide whether it's allowed.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bulk collection, gchq, investigatory powers bill, mass surveillance, snooper's charter, spying, surveillance, theresa may, uk

'Intelligence Professional' Says NSA Deserves Trust, Power And Its Bulk Phone Metadata Collection Back

from the BLAME-SNOWDEN dept

Tom Wither, author, "intelligence professional," and apparent apologist for the NSA, has written two op-eds in hopes of impressing on Americans the grave dangers that await them in this post-bulk phone metadata collection era. Wither lays the blame for future horrors on NSA whistleblower Edward Snowden. He frames his argument with the recent horror of the Paris attacks.

His first op-ed, written for The Hill, appeared two weeks after the Paris attacks. Titled "Stand with Our Watchers," Wither's piece asks the American public to put aside its concerns about domestic dragnet surveillance and allow the government to autonomously decide what it needs to do to "protect" us.

CIA Director John Brennan recently denounced the ‘hand-wringing’ over intrusive government spying and exposure of intelligence programs. We need organizations like NSA working to find, fix, and help eliminate terrorist threats to our nation’s and our ally’s citizens, and protect critical infrastructure like power, banking, and transportation; and those efforts must be grounded in our constitutional values.

Odd that Wither would bring up "constitutional values," considering most of the objections to the surveillance he declares to be essential are predicated on these same values -- ones that have been apparently ignored because they make terrorist hunting slightly more difficult.

Wither says the NSA (and others) are very conscientious of the limitations the Constitution places on its efforts. And, in many cases, this is true. But the combination of powerful tools and limited oversight has resulted in abuse in the past and likely will again in the future.

Snowden is mentioned in this op-ed, portrayed as a criminal who only revealed the NSA did nothing wrong before being welcomed by our former Cold War foe and praised by terrorist organizations for exposing surveillance methods.

Unmentioned in Wither's op-ed -- which uses fear (the terrorist attacks in Paris) to call for Americans to embrace their intrusive "protectors" -- is the fact that current Public Enemy #1 (encryption) had little to do with the terrorists' communications and, more importantly, that existing surveillance dragnets failed to prevent the attack from happening.

Before wrapping it up with a call for surveillance solidarity, Wither makes the following unbelievable claim.

U.S. intelligence officers of all stripes will be the first to tell you that they want clear, specific legal guidance that keeps pace with technology so that they can do their jobs effectively and within the constitutional framework they swore an oath to defend. I strongly believe that law enforcement professionals also want that kind of guidance – and need it as we learn more and more about law enforcement and IRS use of the ‘STINGRAY’ cell tower simulator and the FBI’s reconnaissance flights over Baltimore during the spring riots.

Intelligence officers may want "clear, specific legal guidance" but they only if it is written in their favor. And while it may be "clear" and "specific" to them, this legal guidance is withheld from the public and, in many cases, even from these agencies' oversight.

And it's abundantly clear very few law enforcement agencies are looking for "legal guidance" on Stingrays. Any information we do have has been torn from the death grip of FBI/local law enforcement agencies by tenacious FOIA requesters and privacy activists. Wither is right: these agencies do need more "guidance." To date, they have deployed parallel construction, dismissed criminal cases and utilized bogus paperwork to protect their secret cell tower spoofers. But legal guidance would mean inconveniences like warrants, restrictions and minimization procedures -- not exactly the sort of things intelligence or law enforcement agencies actively seek out.

Wither's second op-ed -- this one for the Baltimore Sun -- picks up where his last one left off. The Paris attacks are invoked again to argue for increased surveillance... or at least the surveillance we had until just recently. This time Wither is arguing for the return of the NSA's bulk phone metadata collection, because the program isn't "criminal," but "ending it" is.

On Sunday, while you were eating the leftovers from Thanksgiving and watching the afternoon's football games, the National Security Agency stopped acquiring the call data records of millions of Americans.

Lousy, inconsiderate American public, ignorantly watching TV and eating leftovers instead of spending the waning moments of the Section 215 program on their phones, patriotically generating a few last phone records for the NSA to store at its data centers. For shame.

It's not just the public that's to blame. It's also the media. Wither says the intelligence community must become much more transparent about its surveillance programs (good!) but mainly to head off irresponsible journalists (??).

[T]he law and oversight they operate under to constrain their activities within our values and constitutional principles should continue to become more transparent to the general public. Such increased transparency will help to lessen the public's wariness and rush to judgment about what must be inevitably a government conspiracy or illegal activity based on initial news reports.

Wither also takes a parting shot at Snowden, with a paragraph that is as laughably bad as his claim that intelligence agencies are crying out for more legal guidance.

More than two years after Mr. Snowden's leaks, not one NSA employee, affiliate or senior leader has been indicted, tried or convicted with a crime related to violating the FISA. Mr. Snowden, however, has been charged with two felonies under the Espionage Act, and has been praised by members of the Islamic State for teaching them how to avoid U.S. surveillance.

This slam of Snowden might actually mean something if (a) this administration wasn't so focused on prosecuting whistleblowers and (b) the government didn't routinely greet exposed wrongdoing by allowing the perpetrators to resign rather than face charges, or by issuing wrist slaps so light they might as well be pantomime. After all, the national intelligence director (James Clapper) lied to Congress, but still maintains his position at the top of the intelligence heap. And let's not forget there are criminals the government likes and criminals it doesn't, and they see two very different forms of prosecution when hauled into court.

That Snowden is a wanted felon is wholly unsurprising, given two consecutive administrations' stalwart defense of the government's post-9/11 power expansion. But pretending this is somehow indicative of the NSA's inherent "rightness" is cheaply disingenuous.

Filed Under: bulk collection, nsa, surveillance, tom wither

The NSA's Bulk Collection Of Phone Records Ended Saturday. Long Live The Bulk Collection Of Phone Records!

from the a-dragnet-among-dragnets dept

The NSA's frontmouth, the Office of the Director of National Intelligence, is burying news again. Not that it could help it. Normally, the ODNI likes to do its document dumps (most often consisting of documents ordered out of its hands by federal judges presiding over FOIA lawsuits) on Friday afternoons or shortly before a holiday to buy itself some response time before dealing with journalists and Congressional committees.

In this case, it delivered its latest news on Black Friday, while most of America was either out shopping or covering the story of Americans shopping for the local newsjobber. The timing would be suspect if it weren't for the fact that the NSA's bulk phone metadata program ended (at least in this form) at 11:59 PM Saturday night.

On June 2, 2015, Congress passed and the President signed the USA FREEDOM Act of 2015. The Act reauthorized several important national security authorities; banned bulk collection under Section 215 of the USA PATRIOT Act, under the pen register and trap and trace provisions found in Title IV of Foreign Intelligence Surveillance Act (FISA), or pursuant to National Security Letters; adopted the new legal mechanism proposed by the President regarding the targeted production of telephony metadata; made significant modifications to proceedings before the FISC; and built on the U.S. Government’s unprecedented transparency about intelligence activities. With respect to the new mechanism for the targeted production of telephony metadata, to allow sufficient time to implement a new system while at the same time avoiding any lapse in a national security program, the USA FREEDOM Act provided for a 180-day transition period during which the existing NSA bulk telephony metadata program may continue.

The six months are up and so is the NSA's Section 215 collection. While this means phone records will be held where they've always been held (phone companies) and the NSA must now approach providers with FISA court orders, this does not mean the NSA will no longer be collecting phone records in bulk. It just means it won't be doing this under those particular authorities (Section 215, PR/TT provisions, NSLs). It still has plenty of options.

For one, it appears to have access to more records than it used to under Section 215. From the fact sheet:

[T]he overall volume of call detail records subject to query pursuant to court order is greater under USA FREEDOM Act.

This could mean the new method (approaching phone companies directly) may give the NSA access to records it couldn't obtain under Section 215, like additional cell phone records or other communications methods like VOIP. In other words, the requests will be more targeted but capable of obtaining a greater variety of records responsive to the court-approved identifiers.

As I've said before, I suspect the NSA was willing to let Section 215 provide bus traction for the administration's minimal surveillance reform efforts. As long as everyone kept worrying about the bulk phone metadata (subject of multiple lawsuits that are now basically moot as far as the courts are concerned), the NSA would be able to keep its multiple other, more intrusive programs intact. As Marcy Wheeler notes, this program may be dead, but it doesn't mark the end of the NSA's bulk phone records collection.

Just a tiny corner of the phone dragnet will shut down, and the government will continue to collect “telephony metadata records in bulk … including records of both U.S. and non-U.S. persons” under EO 12333. Hypothetically, for every single international call that had been picked up under the Section 215 dragnet and more (at a minimum, because NSA collects phone records overseas with location information), a matching record has been and will continue to be collected overseas, under EO 12333.

They’re still collecting your phone records in bulk, not to mention collecting a great deal of your Internet records in bulk as well.

The DNI himself, James Clapper, threw his weight behind reforming this high-profile but ultimately minimal part of the NSA's dragnet. That should have been indication enough that killing off the Section 215 program wouldn't severely limit the NSA's surveillance options, despite the occasional bit of FUD directed at legislators (or parroted by them).

Filed Under: bulk collection, eo 12333, mass surveillance, metadata, nsa, phone records, section 215

Documents: The Domestic Email Collection Program The NSA 'Killed' In 2011 Was Actually Just Offshored

from the the-underwater-dragnet dept

New documents obtained by Charlie Savage of the New York Times (as the result of a FOIA lawsuit) show that the NSA may have killed off its bulk collection of US persons' emails back in 2011, but it quickly found another way to obtain these -- a way that circumvented restrictions on domestic collections.

While that particular secret program stopped, newly disclosed documents show that the N.S.A. had found a way to create a functional equivalent. The shift has permitted the agency to continue analyzing social links revealed by Americans’ email patterns, but without collecting the data in bulk from American telecommunications companies — and with less oversight by the Foreign Intelligence Surveillance Court.

The new document is an Inspector General's report detailing the NSA's failure to follow the restrictions laid down by FISC Judge John Bates in his October 3, 2011 opinion. Bates felt the collection of US persons' email content in this fashion amounted to an illegal wiretap. This would be the same collection the NSA defended (before it was given more power to collect domestic data without a warrant by the 2008 FISA Amendments Act) in the FISA court by claiming an email address was the same thing as a "facility," because email addresses "facilitate" communications.

So, the reassurances -- offered in response to the Snowden leaks -- that the program had been shut down are essentially meaningless. The NSA halted a particular collection method, but did not halt the collection of domestic emails.

The report explained that there were two other legal ways to get such data. One was the collection of bulk data that had been gathered in other countries, where the N.S.A.’s activities are largely not subject to regulation by the Foreign Intelligence Surveillance Act and oversight by the intelligence court. Because of the way the Internet operates, domestic data is often found on fiber optic cables abroad.

As Marcy Wheeler points out, the killing of one domestic email collection and initiation of another meant some NSA personnel were very busy during the 2011 holiday season.

Given the length of the redacted date (it is one character longer than “9 December 2011”), we can say with some confidence that Keith Alexander approved the end and destruction of the dragnet between November 10 and 30 — during the same period the government was considering appealing Bates’ ruling, close to the day — November 22 — NSA submitted a motion arguing that Section 1809(a)(2)’s wiretapping rules don’t apply to it, and the day, a week later, it told John Bates it could not segregate the pre-October 31 dragnet data from post October 31 dragnet data.

Think how busy a time this already was for the legal and tech people, given the scramble to keep upstream 702 approved! And yet, at precisely the same time, they decided they should nuke the dragnet, and nuke it immediately, before the existing dragnet order expired, creating another headache for the legal and tech people. My apologies to the people who missed Thanksgiving dinner in 2011 dealing with both these headaches at once.

Not only did NSA nuke the dragnet, but they did it quickly. As I said, it appears Alexander approved nuking it November 10 or later. By December 9, it was gone.

As she goes on to detail, the program the Inspector General was looking for was indeed gone. But the collection itself wasn't. As far as the IG could tell, the NSA was mostly in compliance. The IG's report, however, notes its powers to assess the collection, storage and access to email data and content are very limited. As Wheeler puts it, the NSA "ate" its homework before the IG had a chance to assess its compliance.

As to the the intake side,those folks started destroying the dragnet before the IG could come by and check their before status:

"However, S3 had completed its purge before we had the opportunity to observe. As a result we were able to review the [data acquisition database] purge procedures only for reasonableness; we were not able to do the before and after comparisons that we did for the TD systems and databases disclosed to us."

Poof! All gone, before the IG can even come over and take a look at what they actually had.

Importantly, the IG stresses that his team doesn’t have a way of proving the dragnet isn’t hidden somewhere in NSA’s servers.

"It is important to note that we lack the necessary system accesses and technical resources to search NSA’s networks to independently verify that only the disclosed repositories stored PR/TT metadata."

The Inspector General's office appears to have been steered to its conclusion by the NSA, which dumped the data from the places it expected the IG to look ("disclosed repositories") and utilized a new collection method that wasn't subject to FISA court restrictions or nearly as much IG oversight.

So, the NSA's statements about shutting down the email program in 2011 are technically correct. It was shut down. The NSA, however, simply chose to siphon as much domestic data from its overseas collections as possible to ensure it never really had to end its warrantless collection of US persons' emails.

Filed Under: bulk collection, email, internet, mass surveillance, metadata, nsa, surveillance

Senator Cotton Introduces Bill To Extend Unconstitutional NSA Surveillance

from the how-nice-of-him dept

I happen to be in Washington DC this week for some events and meetings -- and it's a... ridiculous week to be here, apparently (of course, that could be true of just about any week here). Earlier this week, we noted the pathological ridiculousness of surveillance state apologists like former NSA top lawyer Stewart Baker arguing that the Paris attacks are evidence for why the NSA should not roll back its Section 215 collection. The 215 collection is, of course, the completely unconstitutional (as declared by both an appeals court and the White House's own civil liberties board) program by which the NSA slurped up basically all phone records, claiming that Section 215 of the PATRIOT Act allowed this.

Of course, the primary sponsor of the PATRIOT Act, Rep. Jim Sensenbrenner, has flat out said that Section 215 was written to prevent that kind of mass surveillance, not to enable it. And so, earlier this year, Congress finally pushed through the USA Freedom Act, which was far from perfect, but still did put an end to the Section 215 collection as it stands (while still leaving open ways for the NSA to effectively get the same data). There was a six-month "transition period" which is about to close, meaning that we're officially mere days away from ending the specific 215 bulk collection.

Or, maybe not. As Baker hinted at, the surveillance state apologists are gleefully exploiting the Paris attacks to try to claw back this very, very minor victory against mass surveillance. Senator Tom Cotton quickly rushed out a bill to "postpone" indefinitely the transition away from the 215 program, because of the Paris attacks.

"The terrorist attacks in Paris last week are a terrible reminder of the threats we face every day. And it made clear that the President’s empty policy of tough talk and little action isn’t working against ISIS. Regrettably, these policy follies also extend to the Intelligence Community, whose hands were tied by the passage of the USA FREEDOM ACT. This legislation, along with President Obama’s unilateral actions to restrict the Intelligence Community’s ability to track terrorist communications, takes us from a constitutional, legal, and proven NSA collection architecture to an untested, hypothetical one that will be less effective. And this transition will occur less than two weeks from today, at a time when our threat level is incredibly high.

"If we take anything from the Paris attacks, it should be that vigilance and safety go hand-in-hand. Now is not the time to sacrifice our national security for political talking points. We should allow the Intelligence Community to do their job and provide them with the tools they need to keep us safe. Passing the Liberty Through Strength Act will empower the NSA to uncover threats against the United States and our allies, help keep terrorists out of the United States, and track down those responsible in the wake of the Paris terrorist attacks."

Almost everything in Cotton's statement is a lie. First of all, the FREEDOM Act hasn't even gone into effect yet, so even if it did "tie the hands" of the intelligence community, it had not done so yet. Second, the program has been declared unconstitutional by multiple courts and the administration's own review board. For him to call it constitutional suggests he has no problem flat out lying. Also the idea that it's "proven"? Need we remind you of two facts? (1) To date, the Section 215 program has never -- not even once -- been shown to have been useful in stopping a terrorist attack. (2) It clearly didn't make a difference in dealing with the Paris attacks (and, again, notably the US has even greater surveillance powers overseas, as do the French). So to claim that this one unconstitutional and proven useless program is necessary is just... weird.

Sensenbrenner was at an event I attended last evening and said that he didn't think Cotton's ridiculous bill had much of a chance, but did note that it was hardly the end of surveillance state apologists from trying to expand unconstitutional surveillance powers. Cotton's is just the first attempt, but expect there to be many more.

Filed Under: bulk collection, nsa, paris attacks, section 215, surveillance, tom cotton