Judge Kavanaugh, Dragnet Fan From Way Back, Shoots Down Section 215 Rehearing With Extraneous Surveillance Boosterism

from the NSA!-NSA!-NSA!-NSA!-[performs-'Wave'-by-himself] dept

Once upon a time, a DC district court judge found the NSA's bulk phone metadata collection to be a violation of the Fourth Amendment. Wailing, gnashing of teeth and a round of appeals ensued.

Nearly two years later, this judge (Richard Leon) reiterated his position after the appeals court overturned his decision. Judge Leon again issued an injunction preventing the NSA from collecting the phone records of two of the plaintiffs. This too was almost immediately stayed following the government's swift appeal.

One of the plaintiffs not included in Leon's injunction was Larry Klayman. Klayman petitioned the appeals court for an en banc rehearing of its decision to stay Leon's order. The court has turned him down. But rather than simply turn Klayman down with a single paragraph noting the denial of his request, Judge Brett Kavanaugh took it upon himself to pen a full-throated defense of the NSA's bulk metadata collection.

I vote to deny plaintiffs’ emergency petition for rehearing en banc. I do so because, in my view, the Government’s metadata collection program is entirely consistent with the Fourth Amendment. Therefore, plaintiffs cannot show a likelihood of success on the merits of their claim, and this Court was right to stay the District Court’s injunction against the Government’s program.

The Government’s collection of telephony metadata from a third party such as a telecommunications service provider is not considered a search under the Fourth Amendment, at least under the Supreme Court’s decision in Smith v. Maryland, 442 U.S. 735 (1979). That precedent remains binding on lower courts in our hierarchical system of absolute vertical stare decisis.

Even if the bulk collection of telephony metadata constitutes a search, cf. United States v. Jones, 132 S. Ct. 945, 954-57 (2012) (Sotomayor, J., concurring), the Fourth Amendment does not bar all searches and seizures. It bars only unreasonable searches and seizures. And the Government’s metadata collection program readily qualifies as reasonable under the Supreme Court’s case law. The Fourth Amendment allows governmental searches and seizures without individualized suspicion when the Government demonstrates a sufficient “special need” – that is, a need beyond the normal need for law enforcement – that outweighs the intrusion on individual liberty. [...] The Government’s program for bulk collection of telephony metadata serves a critically important special need – preventing terrorist attacks on the United States. See THE 9/11 COMMISSION REPORT (2004). In my view, that critical national security need outweighs the impact on privacy occasioned by this program. The Government’s program does not capture the content of communications, but rather the time and duration of calls, and the numbers called. In short, the Government’s program fits comfortably within the Supreme Court precedents applying the special needs doctrine.

Kavanaugh makes these assertions about "special needs" and claims the government's metadata program is instrumental in preventing terrorist attacks, despite no intelligence official ever having presented evidence that supports this assertion.

While it isn't unusual to see judges align themselves with the government's "special needs" in cases where counterterrorism efforts are implicated, it's a bit strange to see a judge step up, unbidden, to tell a plaintiff that, in no uncertain terms, as long as he's wearing the robe, no one's going to be questioning the constitutionality of the NSA's national security efforts.

But why would Kavanaugh feel so compelled to defend dragnet surveillance efforts, especially one that's becoming much less of a dragnet in the near future? Marcy Wheeler has the answer:

Kavanaugh, of course, served as a White House lawyer and as Staff Secretary during the period when George Bush kept self-authorizing such a dragnet.

[...]

[A]s people cite from this language in the future, they should remember that of all the judges who reviewed this decision, only Kavanaugh had this kind of personal tie to the dragnet. And only Kavanaugh saw fit to weigh in.

Klayman, along with other plaintiffs and Judge Richard Leon, have questioned the asserted "cuteness" of Kavanaugh's baby. And Kavanaugh apparently is not about to let that slide. So, we get an en banc denial with several paragraphs of Kavanaugh's surveillance state boosterism needlessly attached.

Filed Under: 215, 4th amendment, brett kavanaugh, bulk data, dc, larry klayman, nsa, surveillance, third party doctrine

Did Apple Keep Or Remove Its Warrant Canary Concerning PATRIOT Act Requests?

from the unclear dept

Last fall, we wrote about how Apple has placed a warrant canary in its first ever Transparency Report, noting:

Apple has never received an order under Section 215 of the USA Patriot Act. We would expect to challenge such an order if served on us.

In case you haven't been keeping track, the Section 215 orders are so called "business records" requests. It's the basis for the orders to Verizon demanding metadata on all calls. It's not the whole PRISM program, which details more specific requests for content and metadata. A "warrant canary" is pretty much exactly what it sounds like. Since these requests come with gag orders, you can get out in front of them by saying ahead of time that you haven't received one. Then, if it disappears, people have reason to believe that you did get such a request and just can't talk about it anymore.

Jeff John Roberts, over at GigaOm, has noticed that updates to Apple's Transparency Reports didn't appear to have that same warrant canary, leading to speculation that perhaps Apple had received just such a Section 215 order. However, it's not clear if that's true. Christopher Soghoian has pointed out that the transparency reports do include some similar language:

To date, Apple has not received any orders for bulk data.

And, contrary to Roberts' reporting, Section 215 is not the basis for PRISM, which we already knew Apple is a part of, but rather for bulk data collection of "business records." So if it hasn't received "any orders for bulk data," then it still seems likely that it hasn't received a 215 order, but it's not entirely clear. As Soghoian notes: "There is a lesson to be learned here: once you post a warrant canary, it needs to stay in the same place and use the same language."

Of course, it's possible that Apple is actually signalling something different here. Perhaps it truly has not received a 215 order, but it did get pressured from the DOJ not to use the original warrant canary language. That would explain the change in wording, though would still raise some serious questions about the legality of such a demand from the DOJ.

Filed Under: bulk data, patriot act, warrant canary
Companies: apple

Unnamed Phone Company Challenges NSA's Bulk Records Collection; FISC Says It's Perfectly Legal

from the of-course-they-would dept

Late on Friday, the FISA Court unclassified a few documents, including a ruling on an until now secret attempt by a telco to challenge the latest FISC order demanding that the telco hand over metadata on all phone records under Section 215 of the Patriot Act. The telco's name is redacted, but it relied entirely on Judge Richard Leon's ruling from December, which found the bulk collection of phone records unconstitutional. Basically, the telco appears to have received the renewed Section 215 bulk collection order from FISC in January, and then challenged it on the basis of Judge Leon's ruling. The FISC shoots down that challenge, rejecting Judge Leon's reasoning, and insisting that bulk collection of phone records is perfectly legal and constitutional.

Turning now to the merits of the Fourth Amendment issue, this Court finds Judge Leon's analysis in Klayman to be unpersuasive and concludes that it provides no basis for vacating or modifying the Secondary Order issued [REDACTED] January 3, 2014....

FISC, of course, immediately highlights the infamous Smith v. Maryland case that all defenders of bulk collection point to (and which Judge Leon said did not apply here, given the very different circumstances). But, FISC still argues it applies claiming that the differences are "indistinguishable."

The information [REDACTED] produces to NSA as part of the telephony metadata program is indistinguishable in nature from the information at issue in Smith and its progeny. It includes dialed and incoming telephone numbers and other numbers pertaining to the placing or routing of calls, as well as the date, time and duration of the calls.

That seems disingenuous at best. You need to be willfully distorting the facts to argue that Smith and the bulk data collection programs are "indistinguishable" from one another. Smith involved information on a single person. The bulk collection covers everyone. In fact, Judge Leon himself went through a rather detailed explanation of what "distinguishes" the Smith case from the bulk collection, including the fact that while people may expect phone companies to occasionally provide information to law enforcement on suspects, they do not reasonably expect the telcos to do that on everything from every person.

FISC Judge Rosemary Collyer admits that Judge Leon explained why the two situations are wholly different, but simply disagrees on every distinguishing factor.

This Court respectfully disagrees with Judge Leon's reasons for deviating from Smith. To begin with, Judge Leon focused largely on what happens (and what could happen) to the telephony metadata after it has been acquired by NSA -- e.g., how long the metadata could be retained and how the Government could analyze it using sophisticated technology. Smith and the Supreme Court's other decisions applying the third-party disclosure principle make clear that this focus is misplaced in assessing whether the production of telephony metadata constitutes a search under the Fourth Amendment.

Smith reaffirmed that the third-party disclosure principle -- i.e., the rule that "a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties" ... applies regardless of the disclosing person's assumptions or expectations with respect to what will be done with the information following its disclosure.

From there, Judge Collyer goes on to restate the rather expansive view that, under the third party doctrine, basically you have absolutely no 4th Amendment rights whatsoever to anything held by a third party. There's also this fun tidbit, in which the ruling dismisses the "everyone's content" vs. "just one target's content"

The aggregated scope of the collection and the overall size of NSA's database are immaterial in assessing whether any person's reasonable expectation of privacy has been violated such that a search under the Fourth Amendment has occurred. To the extent that the quantity of the metadata collected by NSA is relevant, it is relevant only on a user-by-user basis. The pertinent question is whether a particular user has a reasonable expectation of privacy in the telephony metadata associated with her or her own calls. For purposes of determining whether a search under the Fourth Amendment has occurred, it is irrelevant that other users' information is also being collected and that the aggregate amount acquired is very large.

Basically, even though there is a very big distinguishing factor between collecting one targeted person's info and everyone's info, the FISA Court insists that this factor can be ignored, because you have to look at it in terms of each person's individual situation. That seems like a highly questionable analysis, and a very dangerous "cheat" to hide from the biggest factor that makes the 215 bulk collection orders so different from the situation in Smith.

Even more troubling, is that the FISC seems to argue that phone metadata probably isn't that revealing anyway -- which is clearly bogus. It points to the case that Smith mainly relied upon, the Miller case involving bank records, and argues that phone metadata and bank records are basically the same:

It is far from clear to this Court that even years' worth of non-content call detail records would reveal more of the details about a telephone user's personal life than several months' worth of the same person's bank records. Indeed, bank records are likely to provide the Government directly with detailed information about a customer's personal life -- e.g., the names of the persons with whom the customer has had financial dealings, the sources of his income, the amounts of money he has spent and on what forms of goods and services, the charities and political organizations that he supports -- that the call detail records simply do not, by themselves, provide.

I find it equally questionable that bank record information isn't considered private, but even if we grant that premise, the rest of the argument makes little sense. In fact, much of the above information may not actually be supplied by bank records, and a person can often use cash to leave no such record. While both records may be quite revealing (beyond what I think the 4th Amendment should allow), given the choice, I'd argue that my phone records are a hell of a lot more revealing and private than my bank records.

FISC also rejects the idea that the Supreme Court's decision in the Jones case (arguing that GPS tracking may go too far) changes the analysis here. Judge Collyer points out that the rulings that Judge Leon relies on were concurring opinions, but not, technically part of the majority ruling (he basically lumped together Justice Alito and Justice Sotomayor's rulings, despite each taking slightly different approaches).

In the end, the FISC rejects the attempt by the unnamed telco, and basically says that Judge Leon's ruling is wrong. Kudos to the nameless telco for actually challenging the Section 215 order. Hopefully we'll find out soon which telco actually made a move to protect its users' privacy.

Filed Under: 4th amendment, bulk data, bulk records collection, fisa court, fisc, larry klayman, metadata, patriot act, richard leon, rosemary collyer, section 215

NSA Memo Shows Unlimited Access To Bulk Records Unnecessary To Keep US Safe From Terrorists

from the but,-of-course,-the-program-must-not-be-restricted-in-any-way dept

The DNI's recent document dump has sprung loose an April 2009 "notification memorandum" from the NSA, which provides updates on its "end-to-end" reviews of both the Section 215 (phone metadata) and the Section 402 (email metadata) bulk records collections. As was noted in earlier posts, both programs were suspended by the FISA court because of the NSA's routine abuse FISA Act limitations.

The declassified document is addressed to the Senate Select Committee on Intelligence (SSCI). There's no indication this information was also disseminated to the House Intelligence Committee, but perhaps that will surface in the future. The memo spends a few introductory paragraphs detailing the efforts the NSA has made to clean up its act before delving into more interesting details -- including the limitations placed on the Section 215 collection by the Judge Walton, as well as a new problem it uncovered during its 60-day "end-to-end" reviews.

Here are the rules the NSA was forced to comply with under Walton's court order.

Since the March 5, 2009 FISA Court order, the Court's approval has been required for each selector before it is tasked for BR FISA metadata analysis. On Mar 21 NSA resumed manual access to BR FISA metadata, allowing chaining [redacted] of FISA Court-approved selectors associated with [redacted] following multiple operational and technical reviews to ensure compliance.

This explains ODNI counsel Robert Litt's hesitancy to store metadata at a "neutral site." To do so would mean returning to 2009's restrictions -- which were brought on by the agency's own malfeasance. Utilizing a neutral site would likely mean the FISA court would be approving selectors rather than granting permission for rolling, 90-day collections of all phone records.

Also of note is how few court-approved selectors there were at that point.

A limited number of NSA analysts are now performing manual queries against 209 FISA Court-approved high-priority selectors daily…

Once again, hauling in millions of phone records seems like overkill. Since the agency has had (serious) trouble with adhering to the RAS (reasonable articulable suspicion) requirement, it would make more sense to return to this limitation if the Section 215 program is to remain running. With two bulk data programs suspended or significantly altered between 2009-2010, the US still somehow managed to avoid being overrun with terrorist attacks. If the program can't be eliminated, at the very least, it should return to this more minimal standard -- seeking court approval for RAS-compliant selectors and searching offsite, rather than simply amassing millions of non-relevant phone records.

Further down, more incidents of data abuse/misuse are detailed, this time at the hands of other agencies which were given access to the metadata collections

[Redacted; presumably includes a start date] NSA and DIA entered into a pilot program which allowed the DlA's Joint Intelligence Task Force - Combating Terrorism (JITF-CT) access to counterterrorism-related SIGINT information, including SIGINT collected pursuant to the Foreign Intelligence Surveillance Court's (FISC) [redacted] . Access to this FISA data was controlled and was limited to JITF-CT who had undergone training on the application of NSA minimization procedures to the FISA data and who were subject to NSA oversight of their activities. Moreover, these personnel were required to coordinate with NSA regarding dissemination of the information outside of JITF-CT.

The NSA made these Task Force members "employees" in order to grant them the privileges needed to access the metadata collection in its unminimized form. While conducting a review of its systems in 2008, the NSA found that one database (name redacted in memo) "lacked sufficient controls." The database was shut down and resurrected with "correct" controls implemented. Unfortunately, it was this "uncontrolled" database that its new honorary employees had access to. The NSA revoked Task Force members' access to the databases but was unable to determine explicitly whether any sort of unauthorized access had occurred.

Instead of presenting a possible worst-case scenario, the agency memo delivers this powerful statement of (misplaced) faith.

[A sentence and half worth of redacted text] there is no way to determine whether, in fact, JITF-CT analysts accessed it without authorization. However, even if such access occurred, the analysts were trained in routine minimization procedures and were required to coordinate with NSA regarding dissemination of information outside JITF-CT…

Of course. Because the training and minimization procedures have always prevented actual NSA employees from abusing the bulk records collections.

This isn't the only case of problematic shared access. Another agency is discussed in a heavily-redacted paragraph. This unnamed agency was given access to unminimized X-KEYSCORE SIGINT data. Among the other unredacted sentences is one stating that this access is "predicated" on the principle that "collaboration is essential" to prevent terrorist attacks. Whichever agency is not being named here doesn't seem to have held up its end of the bargain, which resulted in the (perhaps temporary) suspension of its access to the data.

On review of this access NSA is considering whether allowing this [redacted] access to unminimized SIGINT collection fully complies with NSA procedures.

Whether or not that access has been returned is still open for debate considering the agency's name has been hidden away under the black and turquoise [!?] ink. What isn't open to debate is the fact that the NSA continues to struggle with handling its data collections responsibly. As more documents are pried loose thanks to the ACLU and EFF's efforts, I'm sure we'll see even more evidence that the agency isn't nearly as careful as its defenders assert it is.

Filed Under: bulk data, fisa court, fisc, metadata, nsa, section 215, terrorists

Supreme Court Refuses To Hear Case About NSA Surveillance That Attempted To Jump The Line

from the wait-your-turn dept

This isn't a huge surprise, but the Supreme Court has declined (without comment) to hear a case brought by EPIC concerning the NSA's bulk metadata collection program. This isn't a huge surprise -- as EPIC was clearly trying to jump the line to get the case heard directly by the Supreme Court, rather than first going through the district and appeals courts. This was a massive longshot, at best. It doesn't mean that the Supreme Court won't eventually take on the issue, but it's likely to be many years before it has a chance to directly address the question of whether or not the NSA is actually allowed to collect metadata on all phone calls under the FISA Court's questionable interpretation of Section 215 of the PATRIOT Act.

Given that the Roberts Supreme Court seems to go out of its way to avoid actually answering the difficult questions, preferring to write very narrowly focused decisions that leave people with more questions than answers, it seems like even when the program makes it up to the Supreme Court, it may take quite some time to figure out what it actually means for these surveillance programs.

All that said, the one area where I could see the Supreme Court potentially taking a more immediate interest is in the somewhat related question of who has standing to challenge this surveillance, since in the last such case, the US government lied to the Supreme Court and the Justices relied on that very lie in making their decision. Given that, one would hope that the Supreme Court might take a more active immediate interest in the issue, but, again, it'll likely wait for other cases to boil up. It's not like the privacy and 4th Amendment rights of every single person in the US are at stake. Oh, wait...

Filed Under: bulk data, nsa, nsa surveillance, patriot act, section 215, supreme court
Companies: epic