DOJ Headed By William Barr Asked To Explain Warrantless Bulk Data Collection William Barr Authorized 27 Years Ago When He Was The Head Of The DOJ

from the DOJ's-timeline-has-become-a-flat-circle dept

More than a quarter-century ago, then-Attorney General William Barr gave the DEA something it shouldn't have had and something it certainly hadn't earned. The War on Drugs was a forever war and it demanded an expansion of the government's powers. AG Barr OK'ed it: the warrantless bulk collection of multiple third party records, including call records, banking information, and the tracking of purchases.

Twenty-seven years after the fact, the DOJ's Inspector General released its review of these programs, finding they had been crafted and deployed with no underlying legal basis. Some of these programs are defunct. Others have been codified into quasi-legitimacy by War on Terror-related government power expansions.

Twenty-seven years later, William Barr is Attorney General once again. And he's likely just as interested in expanding law enforcement surveillance programs (without worrying too much about how legal they are) as he was three decades ago. He has shown no love for the public nor their rights since he took office, making it crystal clear that neither the administration he works for nor the law enforcement agencies he oversees should be questioned by other branches of the government, much less the public they're supposed to be serving.

More questions are on the way, though. Senator Ron Wyden and Senator Pat Leahy want some answers from the DOJ about Barr's past legal misadventures and what he's doing now to address the findings of the long-delayed Inspector General's report.

“Mr. Barr’s authorization of this sweeping surveillance program without requiring, at minimum, an appropriate legal analysis, was not consistent with his oath to support and defend the Constitution and it likely amounted to professional misconduct,” Wyden and Leahy wrote. “Attorney General Barr knew, or should have known, that neither statutory law nor federal case law permitted the DEA to sweep up, in bulk, billions of records of Americans’ telephone communications. We write to ask that you open an investigation into the authorization of this recently-disclosed illegal, bulk surveillance program that collected billions of records of Americans’ telephone calls without conducting any legal analysis of the program.”

The program Barr authorized ran for more than 20 years, finally being mothballed in 2013 following the Snowden leak exposing the NSA's bulk phone records collection. The collection continued past that point, but was modified significantly, at least according to the DOJ's public statements. The Senators want specifics. Their letter [PDF] asks for details about the long-running program Barr summoned into existence for President Bush the First.

1. During the two decades in which the DEA operated Program A, did any telecommunications companies ever raise questions about its legality, refuse to comply with a DEA subpoena for bulk data, or seek judicial review?

2. According to the OIG report, the DEA transitioned in 2013 from collecting bulk records under Program A to requesting records about specific targets. What legal analysis, if any, did DOJ and DEA engage in before beginning this reconfigured surveillance program? If no legal analysis was conducted, why not?

3. Under target-specific data collection operations, DEA officials must now provide "reasonable articulable suspicion" that the target is involved in drug activity.

a. What safeguards are in place to ensure the target is actually involved in drug activity?

b. What constitutes involvement in drug activity?

c. If someone is targeted under this program, and it is later revealed there was no nexus to drug activity, what happens to the data that the DEA collected, and is the person ever notified that data about them was obtained by the government?

d. What actions will be taken to ensure this program will not be abused in a similar manner to the programs discussed in the OIG report?

The Senators also want to know what the DOJ is doing to prevent this sort of thing from happening again. They're also asking the DOJ if it's following through with the recommended overhaul of its parallel construction practices as well as the internal legal process authorizing new bulk records collection programs.

Considering Barr's running the place again, it seems unlikely answers are forthcoming, and -- if and when answers do eventually arrive -- they will be forthcoming. The new AG has made it clear the administration doesn't need to answer to anyone, not even other branches of the government that are supposed to ensure one branch doesn't grab too much power for itself.

The DOJ doesn't like talking about its screw-ups or its secrets or its ridiculous belief that Drug Wars are good and easy to win. AG Barr's position at the head of the department only buttresses these positions. I wish Wyden and Leahy all the luck in the world, but something tells me the clock will run out on this administration before the DOJ's willing to talk about a twenty-seven-year-old, potentially illegal surveillance program.

Filed Under: 4th amendment, bulk data collection, dea, doj, surveillance, warrantless surveillance, william barr

Oversight Report Says DEA Ran Multiple Bulk Data Collection Programs With Zero Legal Clearance

from the can't-have-your-rules-interfering-with-our-drug-war,-man dept

The NSA isn't the only collector of bulk phone records. The NSA may not even be doing this anymore, but for a long time, it was not only the NSA's bread-and-butter, but the DEA's as well.

The DEA has run multiple bulk records collections for more than 20 years, given the green light by our current Attorney General, William Barr, who also ran the DOJ back in 1992. These not only targeted calls placed to "drug nexus" countries, but purchase records as well. "Nexus" is a slippery word -- one the NSA takes advantage of as well. US law enforcement considers almost anywhere in or out of the country to be a "drug nexus," which gives it the suspicion it needs to pull over drivers on interstate highways or rifle through their belongings at airports looking for drugs cash.

Using this flimsy connective tissue and a bunch of subpoenas, the DEA approached private companies and demanded vast amounts of third party records. Some of these details were exposed when the DEA's "Hemisphere" documents were published. Six years after Ed Snowden let the world know the NSA was collecting phone records in bulk, the Inspector General of the DOJ has finally released a report [PDF] on the DEA's bulk collections.

According to the IG report, the DEA ran three bulk collection programs. Program A collected bulk telephone records on calls from the US to "drug nexus" countries. These were obtained with "non-target-specific" subpoenas directly from the service provider. Like the NSA, the DEA wanted metadata about these calls, like date, time, and duration.

Program B did pretty much the same thing: non-targeted subpoenas were handed to "selected vendors" to gather data on purchases, which were then cross-referenced with the DEA's bulk records database to (finally!) identify targets to investigate. (What purchases? According to Charlie Savage of the New York Times, the DEA is tracking purchases of money counting machines. This is probably information the DEA didn't want the public to have, but a redaction failure caught by Savage exposed the intent of this collection program.)

That instruction, it said, “was intended to protect the program’s sources and methods; criminals would obtain money counters by other means if they knew that the D.E.A. collected this data.”

Program C resembled the modified Section 215 program -- the one that appears to never have gotten off the ground following the USA Freedom Act reforms. Non-targeted subpoenas were handed to telcos, which then searched their own databases to find connections that might be of interest to the DEA, handing it only the results of these restricted searches, rather than dumping everything into the DEA's data stores.

There's a similar thread holding all of these programs together: they weren't strictly legal.

Our review found that the DEA (and the Department with respect to Program A, Collection 1) failed to conduct a comprehensive legal analysis of the DEA's use of its administrative subpoena authority to collect or exploit bulk data before initiating or participating in any of the three programs. We found this failure troubling with respect to Program A, Collection 1 and Program B because these programs involved a uniquely expansive use of Section 876(a) authority to collect data in bulk without making a prior finding that the records were, in the language of that statutory provision enabling DEA's subpoena authority, "relevant or material" to any specific defined investigation.

Several published court decisions have clearly suggested potential challenges to the validity of the DEA's use of its statutory subpoena power in this expansive, non-targeted manner. We also found the absence of a robust legal review troubling because the DEA utilized the bulk data collected by means of Program A, Collection 1 and Program B subpoenas on an unknown number of occasions in support of investigations by non-DEA federal agencies that had no apparent connection to specific drug investigations. This utilization raised significant legal questions because the DEA had amassed the Program A, Collection 1 and Program B bulk data collections under its statutory authority, in 21 U.S.C. § 876(a), to require the production of data that was "relevant or material" to a drug investigation.

We found that Program C raised different kinds of challenging legal issues that the DEA also failed to fully assess. We found that the DEA failed to formalize a complete and adequate legal assessment regarding its use of Program C to obtain reports and other advanced analytical information to ensure such use was lawful and appropriate under its administrative subpoena authority, 21 U.S.C. § 876(a), and the Electronic Communications Privacy Act, 18 U.S.C. § 2703(c)(2).

These legal problems were compounded by the DEA's careless approach to the few legal boundaries it chose to respect. The DEA used untargeted subpoenas that failed to show the records had relevance to active drug investigations. What little there was in place to vet subpoenas prior to issuance consisted of a pull-down menu that only listed kinds of sources (confidential informant, other ongoing investigation, etc.). Nothing specified exactly why the records requested were being sought. The DEA's sole backstop for auditing its subpoenas was nothing more than confirming the pulldown menu of vague sources had actually been used when filling in the boilerplate. The DEA allowed agents to shrug their way into hundreds or thousands of records at a time using nothing more than this:

In practice, the DEA typically did not require more "particularization" than a single conclusory sentence, and did not explicitly require the documentation or certification that the request was relevant to a drug investigation...

Then there's the DEA's massive data retention problem. However indiscriminate the collection process was, the retention/deletion "process" was even worse.

We also found that the DEA failed to establish any policies on storage or retention of the Program B bulk data at any time before or during the operation of that program. Although Program B is no longer active, the DEA has failed to develop a final disposition plan regarding tens of thousands of records of purchases that reside on DEA servers.

The IG has a few problems with the DEA's parallel construction, but it doesn't really have a problem with parallel construction itself. It doesn't consider hiding the origin of evidence "inappropriate," but it does draw the line at hiding this from everyone involved in a prosecution.

[P]arallel construction should not be used to prevent prosecutors from fully assessing their discovery and disclosure obligations in criminal cases.

However, most the DOJ IG's sympathies fall on the side of the prosecution, which should surprise no one.

While the DEA has denied misusing parallel construction in this manner, we found some troubling statements in the DEA's training materials and other documents, including that Program A investigative products cannot be shared with prosecutors. Such statements appear to be in tension with Department policy on a federal prosecutor's "duty to search" for discoverable information from all members of the "prosecution team," which typically includes federal law enforcement officers who participated in the investigation of the defendant.

This doesn't leave much consideration for defendants, who are forced to fight blind when challenging evidence used against them.

There are recommendations, but they're not of much use since two of three programs are pretty much dead. The bulk collection of purchase data (Program B) was killed in 2014, following the Snowden leaks. Program C operates pretty much like the modified Section 215 collection -- with telcos searching and storing records, rather than dumping them into the DEA's databases. Program A was also modified shortly after the Snowden leaks began, with a heavier emphasis on ensuring subpoenas were linked to ongoing drug investigations.

It will probably be several years before we see a follow-up report on the DEA's bulk collections. As the IG notes, the DEA did everything it could to stonewall this investigation.

For a substantial period after we initiated this review, the DEA took many actions that hindered the OIG's access to information available to it that the OIG was plainly authorized to obtain under the Inspector General Act.

These actions included failing to produce or delaying the production of relevant and responsive materials without any compelling or sufficient basis.

[...]

Further, the OIG discovered many highly relevant documents, which had not been produced, only after learning about them in witness interviews. This latter issue was particularly significant with respect to the dearth of documents containing legal reviews of programs in our review, which the DEA failed to produce to the OIG until a witness identified their existence to us. The DEA's actions significantly delayed our review and were wholly inconsistent with the requirements of the Inspector General Act.

This tracks with the Inspector General's problems with multiple DOJ agencies over the past several years. The FBI and DEA blow off investigations, refuse to produce documents, and do as little as possible to ensure their oversight can actually do any overseeing.

As the report notes, the programs were never on solid legal ground. It points out the programs were brought to life under AG Barr, who never bothered to ask for a legal opinion from the DOJ's Office of Legal Counsel before setting them in motion. The FBI had concerns about these programs when the DEA offered it access, but those questions went unanswered. The last time the legal questions were thoroughly discussed was in 1999, seven years after the programs went into effect.

Between 1999 and the 2013 Snowden leaks, only a single memo discussing the potential legal pitfalls of these bulk collections was issued. The single conclusion drawn was that the public should never be allowed to find out about these collections. And for the most part we didn't -- not until years after the fact. Good job... I guess.

Two decades and no definitive legal clearance. The only blip in the data stream was the unscheduled leaking of NSA documents. Without Snowden, these programs would likely still be running unaltered -- hoovering up millions of phone records with zero reasonable suspicion.

Filed Under: bulk data collection, dea, privacy

USA Freedom Act Fails To Move Forward... For Incredibly Stupid Reasons

from the onto-the-next-round dept

So, this evening the USA Freedom Act failed to get the 60 votes it needed for cloture to "advance" to a full floor vote. It ended up at 58 to 42. There was a short debate prior to the vote, and the debate was... stupid. Yes, there are some legitimate concerns with the USA Freedom Act, mostly in that it doesn't go far enough. But that's not what the debate was about at all. You had a bunch of bizarrely clueless Senators, many of whom insisted they were against the act because it would take the bulk collection out of the hands of the NSA and put it into the hands of the telcos -- with the claim being that the NSA could keep that data safer. Senators Susan Collins and Saxby Chambliss kept harping on that point. But it's flat out wrong. Because the whole point of this is that the telcos already have this data. The debate is between "telcos have the data" and "telcos and NSA have the data." Arguing that telcos-only is inherently more likely to lead to a privacy violation makes no sense at all.

Chambliss went further, repeating (over and over again) that it's okay for the NSA to have this data because only 22 people have access to it. Of course, as Marcy Wheeler points out, that's not true. 22 people can authorize a search based on "reasonable articulable suspicion" but many others can access the results. Furthermore, as Harley Geiger points out, the problem is not even at the point of access, but collection, and there's nothing in the law that says the limit is always 22. Frankly, the whole 22 people debate seems strange to me. Is Chambliss really arguing that it's okay to violate the 4th Amendment if only 22 people can do it?

Separately, Senator Dianne Feinstein very reluctantly supported the bill, noting that she's very afraid that if this bill doesn't pass, the whole Section 215 program will go away. Frankly, that actually sounded like a good reason not to support the bill. She also kept insisting that it wasn't being abused because there were only "288" searches last year on that data. First of all, 288 already seems like quite a lot to me, and again we go to Marcy Wheeler for the fact check, where she points out that it's not 288 searches, but rather 288 "selectors," which could be queried multiple times (and those selectors could scoop up lots of data).

Hopefully, it turns out that Senator Feinstein's "fears" on this bill were accurate, and that it leads to the end of Section 215 altogether. But, the completely bogus debate over this effort just highlights how ridiculous the idea is that the Senate has any sort of "oversight" over the NSA, or that it has the interests of the Constitution or the public in mind.

Filed Under: bulk data collection, dianne feinstein, nsa, patrick leahy, privacy, saxby chambliss, senate, surveillance, surveillance reform, susan collins, usa freedom act

Judge Gives DOJ Until The End Of The Month To Submit Declassified Opinion Containing FISA Court's Justifications For The Section 215 Program

from the surveillance-state-sausage-making dept

It appears the government will finally be releasing the FISA court's thought process justifying the mass harvesting of Americans' metadata from fully-immunized telcos under the Section 215 program (now 501). An earlier court order from FISA judge Dennis Saylor discussing the potential release of this court opinion described it thusly:

The government has identified the Opinion issued in Docket Number BR 13-25 on February 19, 2013, as one that "contain[s] analysis by this Court evaluating the meaning, scope, and/or constitutionality" of Section 215 of the USA PATRIOT Act, codified as amended at 50 U.S.C. § 1861.

Whether it will be instructive and enlightening (rather than stuffed full of Third Party Doctrine bullshit and circular "it's legal because it's legal" reasoning) remains to be seen. But the last two words of that previous sentence are something at least: it will "be seen." And, apparently, with a minimum of redactions.

For the reasons stated herein, the Court is directing the government to prepare and declassify a redacted version of the opinion issued by the Foreign Intelligence Surveillance Court (FISC) in Docket Number BR-25 on February 19, 2013.

The ACLU (and others) have pushed for a release of this particular FISC opinion for more than a year now. The court doesn't even attempt to address the First Amendment implications of withholding the opinion from the public because there are plenty of other angles justifying its release. The court notes that the release would serve the public's interest as recent disclosures (both authorized and unauthorized) have brought the Section 215 program into the court of public opinion (as well as actual federal courtrooms).

While the FISA court may have arrived at this conclusion based on ongoing events, the government arrived somewhere completely different.

After appropriations had been reinstated and a timetable for declassification review had been set, the government advised that, “[a]fter careful review of the [February 19, 2013] Opinion by senior intelligence officials and the U.S. Department of Justice, the Executive Branch has determined that the Opinion should be withheld in full and a public version of the Opinion cannot be provided.”

The FISA court asked for the combined brain power of the DOJ, Executive Branch and an unspecified number of "senior intelligence officials" to explain their thought process and got a lot of unintelligible mumbles and floor-staring in return.

Noting that “the government has provided no explanation of this conclusion,” the Court ordered the government to submit “a detailed explanation of its conclusion that the Opinion is classified in full and cannot be made public, even in a redacted form.”

Duly chastened, the brain trust resorted to one of its favorites: making this info public would jeopardize ongoing investigations. But it conceded that the opinion could still be declassified if a sufficient amount of black ink is spilled. The FISC pressed harder, asking for narrower redactions that removed only the targets in question, rather than the accompanying language that would clarify the court's stance on the bulk collection issue. Surprisingly, despite its lack of practice with operating anything narrowly-defined or targeted, the government managed to come up with a redacted version that satisfied the unexpectedly demanding FISA court.

[T]he Court notes that releasing the February 19, 2013 Opinion pursuant to the Second Redaction Proposal achieves the basic objective sought by the movants: disclosure of the Court’s legal reasoning, to the extent that it can reasonably be segregated from properly classified facts. There is an inherent risk that the end product of such an exercise “may confuse or obscure, rather than illuminate, the decision[ ] in question.” In re Motion for Release of Court Records, 526 F. Supp.2d at 495. On balance, however, the Court is satisfied that publication of the February 19, 2013 Opinion in conformance with the Second Redaction Proposal would enhance, rather than detract from, public understanding of the Court’s reasoning as to the legal issues presented.

Well, I guess we'll see what it looks like when we get it. August 29th is deadline for the submission of a formally declassified version of the (supposedly) narrowly-redacted opinion. The FISA court then needs to give it a quick once-over before publishing it "immediately" to its website. I don't expect to see it any sooner than the end of this month, but we'll be taking a good look at it when it finally arrives.

Filed Under: bulk data collection, bulk phone records, doj, fisa court, fisc, foia, justification, legal justification, nsa, section 215

USA Freedom Act Passes Out Of House Judiciary Committee With Some Good And Some Bad

from the it's-meh-all-around dept

As expected, the USA Freedom Act has been passed out of the House Judiciary Committee today, moving the bill forward in a process that will likely bring some version of it to the House floor in the next few weeks. The markup include a variety of amendments, some dopier than others. One generally good amendment was added, bringing back the transparency provisions for tech companies to reveal some information about government requests they receive. Unfortunately, this wasn't as strong as it should be, keeping very wide "bands" under which the tech companies have to obfuscate how many requests they actually receive and how many users are impacted. There was some push to tighten the bands, and that is likely to continue, but it's unlikely to change. Late yesterday, the manager's amendment also added an important definition for "specific selection term" -- which if left totally undefined would easily lead to abuse. The definition is... not great. It can still be abused, but not as readily as when there was no definition.

The other major problem is that this new version strips out the attempt to close the loophole that allowed backdoor searches on Americans without a warrant. This is a big deal as the original version would have closed that loophole. The NSA apparently lobbied hard to remove it, and when Rep. Zoe Lofgren tried to amend this new version to bring back the ban, it was rejected quickly. In other words, the NSA (who has pretended this is no big deal) likely uses this "loophole" quite a bit and doesn't want to lose it.

That said, the bill is clearly a step forward, and both EFF and CDT have cautiously praised the House Judiciary Committee for moving forward on the bill, while still asking for more civil liberties protections and greater transparency.

The real question, though, is what will the House Intelligence Committee do with the bill tomorrow. As we noted earlier today, after fighting it for months, Rep. Mike Rogers has now indicated he's more comfortable with the (weakened) bill, and will be doing a dual markup of both his own bill and this new USA Freedom Act, leading many to suspect that some sort of deal has been reached to effectively incorporate parts of his (bad) bill into this USA Freedom Act -- potentially weakening it even further. We'll find out in a few hours.

Filed Under: bulk data collection, house intelligence committee, house judiciary committee, jim sensenbrenner, mike rogers, nsa, surveillance, usa freedom act

Mike Rogers Lies About Bulk Data Collection, Insists It's Necessary, Even As He Introduces Bill He Says Will Kill It

from the say-what-now? dept

As was expected, on Tuesday morning, Rep. Mike Rogers officially introduced his new bill concerning bulk data collection by the NSA. Overnight, it appears that Rogers and his staff realized that the originally proposed name of the bill, the End Bulk Collection Act of 2014, was so bogus that they couldn't go forward with that. So the official bill is now called the FISA Transparency and Modernization Act. There are significant concerns about how the section on supposedly "ending" bulk collection might actually allow for even greater searches of data.

But the thing that seemed most ridiculous was that, at the same time Rogers gave his press conference in which he claimed he was ending the bulk data collection by the NSA, he was publishing an op-ed in USA Today claiming the program was "necessary" and "vital" and that was why he was calling for it to end. He kicks it off with an already widely debunked bullshit story about how Section 215 could have stopped 9/11:

On the morning of September 11, 2001, Khalid al-Mihdhar stepped on to American Airlines Flight 77, the flight he would later crash into the Pentagon. Al-Mihdhar might have been in prison, instead of on that flight, if the government knew he had called an al-Qaeda safehouse in Yemen from inside the U.S. seven times before the attacks. The failure to spot phone calls by al-Mihdhar and others led the Intelligence community to begin collecting large volumes of call data records, specifically the number dialed and the date and duration of the call, to determine whether suspected terrorists had contacts inside the United States.

This is simply not true. The NSA was already intercepting calls to that very safehouse starting at least two years earlier. The CIA had been following al-Mihdhar for years earlier. The FBI was aware of him as well. The problem was that the CIA failed to alert anyone that Mihdhar had a US visa and came to the US. So the problem was never that they didn't have the information. It was that the NSA, the FBI and the CIA simply didn't cooperate and share the necessary information. This has nothing to do with the Section 215 bulk data collection.

Since last summer, a great deal has been written about the program's scope, capabilities and legality —much of it wrong. The fact is that the program is legal. It was authorized by Congress and found constitutional many times over. No review of the program revealed an intentional misuse of its authority.

This is not actually accurate. It is not a "fact" that the program is legal. At least one court has said that it is not legal as has the Privacy and Civil Liberties Oversight Board (PCLOB), who found the program to be clearly both illegal and unconstitutional. As for the claims that it was "authorized" by Congress and found "constitutional" many times over, neither is particularly accurate. Mike Rogers himself hid the details of the program from Congressional reps who voted on it, and the FISA court never actually explored the constitutionality of the bulk phone records collection until after the Snowden revelations, at which point it had to cover its ass for all the approvals of the program it had given based on a totally different authority.

We recognize that the Intelligence community must have the confidence of the American people to do its life-saving work. Over the past nine months, we have studied ways to reform the program while maintaining its effectiveness.

WHAT EFFECTIVENESS? Everyone who has explored the program has admitted that they were somewhat shocked to learn that there is no evidence anywhere that the program has done anything useful, ever. To argue that we need to "maintain its effectiveness" is a joke.

Most of the rest of the piece is trying to explain why his new bill is a good idea, even after he opened it with a series of outright lies. Then, apparently because he can't resist, he closes on a misrepresentation as well:

Without NSA counterterrorism tools, Najibullah Zazi might have set off bombs during rush hour in the New York City subway in September 2009.

Except the Zazi case is another one that's been debunked as well. But that doesn't stop Rogers from doubling down on his argument:

Some people may say that's "not enough" when compared to the amount of information the NSA obtains, but we would be shocked if anyone on September 12, 2001, wouldn't have done everything possible to find hijackers like al-Mihdhar and prevent just one terrorist attack.

Yeah, that's a great closer. The argument that anything goes because of September 11th should, frankly, disqualify Rep. Rogers from holding office. Doing "everything possible" would mean abandoning the Constitution that Rogers is supposed to be upholding. We're a nation built on the principle that we don't abridge basic freedoms to "do everything possible" to stop one crime. Yet, Rogers still doesn't seem to recognize this.

Filed Under: 9/11, bulk data collection, ed snowden, khalid al-mihdhar, mike rogers, najibullah zazi, nsa, surveillance

Dutch Ruppersberger Proposes Replacing Bulk Metadata Collections With Targeted Pen Register Searches

from the time-for-the-NSA-to-get-out-of-the-bulk-collection-business dept

One of the ranking members of the House Intelligence Committee has just handed down a rather sensible proposal that would take the "bulk" out of "bulk collection" and allow the records to remain at telcos rather than being stored by the NSA or another third party. (Hint: it's not Mike Rogers.)

The suggestion runs as follows:

The concept, which Rep. C.A. Dutch Ruppersberger (D-Md.) said he is still refining, would require court review of numbers that the phone companies are asked to search against. But it would not call for a requirement that companies hold data longer than they do now…

Details would have to be worked out, but, he said, the idea would be to send suspect numbers, which a court has deemed to meet the standard, to all phone companies. They would search daily against this list and send back to the NSA any numbers that hit up against the list.

Ruppersberger's proposal (which he says has sprung out of "serious discussions" with Rep. Rogers) retains the RAS (Reasonable Articulable Suspicion) stipulation that currently governs the NSA's searches of the stored metadata, but it does loosen other restraints -- namely, that the searches be constrained to targets of "authorized investigations" and "agents of foreign powers."

If this sounds all too familiar, there's a reason for that.

Some analysts say that what Ruppersberger appears to be proposing looks very similar to existing authority under the “pen register” provision of the Foreign Intelligence Surveillance Act. That provision enables the government to order a phone company to send back in real-time “dialing” information, such as phone numbers, if the government can show the information sought would be “relevant to an ongoing investigation to protect against international terrorism” or espionage.

This pen register concept was thoroughly bastardized by FISC judge Colleen Kollar-Kotelly in 2004 to give the agency permission to use an open-ended (but targeted) surveillance technique as a way to grab every phone record from telcos in three-month chunks (granted in perpetuity by the FISA court).

But the pen register statute hasn't been written off the books. It still exists and is, in fact, still used occasionally by the NSA, which prompts the following question: why bother introducing new legislation and new guidelines? Why not just make the NSA adhere to the existing statute (albeit one not so thoroughly distended by a previous FISA court decision)?

“So the natural way to solve this problem is not by creating a new authority, but by taking the existing authority designed for exactly this purpose, and narrowing it so it can’t be again used for bulk collection,” said Julian Sanchez, a fellow at the CATO Institute and surveillance expert.

The problem with new laws is that it adds to the number of exploitable tools the NSA can use. As noted above, this eliminates some of the limits governing the bulk records collection. While arguably better than the unlimited metadata harvesting the NSA has done for most of the last decade, the public would be better served by simply requiring the agency to follow existing pen register statutes, provided, of course, the FISA court restores the definition back to its original form.

It is good to see another legislator pushing the NSA back towards targeted surveillance, something it increasingly abandoned in the wake of the PATRIOT Act, especially one that has the misfortune of working closely with Rep. Mike Rogers.

Filed Under: bulk data collection, dutch ruppersberger, nsa, pen register, section 215, surveillance

Could 'Tailored Access Operations' Be An Alternative To 'Collect It All'?

from the easy-choices dept

One of the most contentious aspects of the NSA's surveillance is the central belief by General Alexander and presumably many others at the agency that it must "collect it all" in order to protect the public. To stand a chance of overturning that policy, those against this dragnet approach need to come up with a realistic alternative. An interesting article by Matt Blaze in the Guardian offers a suggestion in this regard that takes as its starting point the recent leaks in Der Spiegel about the extensive spying capabilities of the NSA's Tailored Access Operations (TAO). As Blaze points out:

if you are being individually targeted, you really don't stand a chance. The NSA's tools are very sharp indeed, even in the presence of communications networks that are well hardened against eavesdropping. How can this be good news? It isn't if you're a target, to be sure. But it means that there is no good reason to give in to demands that we weaken cryptography, put backdoors in communications networks, or otherwise make the infrastructure we depend on be more "wiretap friendly". The NSA will still be able to do its job, and the sun need not set on targeted intelligence gathering.

The key word there is "targeted": instead of building in to the Internet general weaknesses that allow everyone to be spied upon (and that can also be exploited by criminals or hostile nations), the NSA could use its elite TAO squad to gain access to the systems of particular individuals. This has several huge advantages over dragnet collection. First, it avoids the whole problem of searching for possible needles in an enormous haystack -- the favorite metaphor of the NSA. Instead, it puts the emphasis on investigating just the needles. Secondly, it can't be applied indiscriminately:

as well as TAO works (and it appears to work quite well indeed), they can't deploy it against all of us -- or even most of us. They must be installed on each individual target's own equipment, sometimes remotely but sometimes through "supply chain interdiction" or "black bag jobs". By their nature, targeted exploits must be used selectively.

The final advantage is that because of the more limited scale of the surveillance, it is possible to require individual approval from a judge for every single operation before it is carried out. By scaling things back, meaningful oversight can be introduced in a way that is simply not possible when the crude "collect it all" approach is employed. As Blaze concludes:

The intelligence community no doubt regards targeted collection methods like TAO as a method of last resort, to be used only when mass surveillance fails. We urgently need to reverse this. Yes, we can expect resistance from the NSA and its "five eyes" partners at any suggestion that they scale back mass collection in favor of targeted methods. It means doing things differently, not to mention that carefully focused targeting is likely more expensive than drinking from the fire hose to which they've become accustomed.

But if TAO is a bit more expensive, it also demonstrates that we have a real choice here. We can safely curtail mass collection, shore up needlessly "wiretap friendly" infrastructure and generally protect ourselves against mass surveillance, all without shutting down legitimate intelligence gathering. In a free society, this should be an easy choice to make.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bulk data collection, collect it all, nsa, surveillance, tailored access operations

Keith Alexander Tells Senators He Can't Think Of Any Other Way To Keep The US Safe Other Than Bulk Metadata Collections

from the oh,-he-knows-other-ways...-he-just-doesn't-like-them dept

NSA head Gen. Alexander once again appeared before the Senate to defend his agency's actions and to deliver the talking points in an effort to head off a number of pieces of legislation aimed at rolling back the NSA's powers.

If the NSA has a chance to hold off what now appears to be near inevitable, it will need to update its rhetorical ploys. Alexander offered nothing much in the way of new arguments, which is only going to hurt the agency's position. It looks as though the old stuff isn't really working anymore. His assertion that the Section 215 program has led to 50+ terrorist attacks averted has disintegrated. Sen. Leahy raised additional questions about the efficiency of the 702 program (internet metadata) in the hunting terrorists. No answer was forthcoming but the agency head implied it would take much longer than next Wednesday's hearing to come up with an answer.

No surprises here either, as Gen. Alexander almost literally played the 9/11 card.

"Metadata is a way of knowing where those books are in the library, and a way of focusing our collection... to knowing, where are the bad books," Alexander says.

He holds up an index card – it's meant to be an old-style card-catalog card (sorry, millennials) – on which are listed the categories of information encompassed by "metadata": time, date, duration, contact numbers.

Then he returns to the 9/11 attacks and says, as he always does, that the attack might have been stopped by a metadata collection program like the USA has now.

Might have been. Except it wasn't. Sen. Leahy called Alexander out for using this tired ploy.

Leahy jumps in and says the failure to prevent the 9/11 attacks also has been put down to a failure to communicate within the intelligence community. US agents had the info they needed, they just failed to share it with one another.

There's no tread left on those tires, General. The Guardian points out this is the first time Alexander has been interrupted while deploying the "could have prevented 9/11" argument.

This wasn't the only used-up rhetoric Alexander deployed. He defended the bulk collections by claiming he "didn't know" a "better" way to protect Americans from terrorism.

"I don't know a better way to do it,” he said. "It's like holding onto a hornets' nest. We're getting stung. You've asked us to do this for the good of the nation … nobody's thought of a better way. We can't let the nation down."

That was Alexander's justification. There's no other way but a bulk, untargeted metadata collection containing millions of records of non-suspects.

But when Alexander says there's no other way to keep Americans safe, he's (no surprise) lying. There is another way and Alexander knows it because the NSA was forced (by the FISA court) to accomplish the task of fighting terrorism without being given access to millions of non-relevant phone records. FISA Judge Walton's orders, which followed on the heels of the admission of widespread abuse of the Section 215 collections, forced the NSA to seek court approval just to search what had previously been collected.

Since the March 5, 2009 FISA Court order, the Court's approval has been required for each selector before it is tasked for BR FISA metadata analysis. On Mar 21 NSA resumed manual access to BR FISA metadata, allowing chaining [redacted] of FISA Court-approved selectors associated with [redacted] following multiple operational and technical reviews to ensure compliance.

As Judge Walton noted then, the collection itself seemed to be overkill and prone to abuse.

The minimization procedures… have been so frequently and systemically violated that it can fairly be said that this critical element of the overall BR regime has never functioned effectively.

Nearly all of the call detail records collected pertain to communications of non-US persons who are not the subject of an FBI investigation… [or] are communications of US persons who are not the subject of an FBI investigation… and are data that otherwise could not be legally captured in bulk by the government.

So, there are other ways to accomplish this and the agency has had to work within stricter limitations in the past. The multiple flaws in Alexander's assertions are highlighted in this statement. Most of what's collected isn't pertinent to investigations and is, in fact, bordering on illegal. The only thing saving Alexander's favorite collection is some very favorable readings of the Third Party Doctrine and secret interpretations of the laws governing these data hauls.

Legislative efforts being made aim to roll back some of this power, something Alexander can't bear to see happen. If nothing else, a neutral storage site that can only be accessed by court-aprroved RAS selectors would be a start. But according to the chief spy, these limitations would lead to another 9/11. He wants it all and he wants unfettered access. There are other ways of compiling and searching metadata. Alexander knows this, but he has no interest in a more targeted approach.

This is Alexander's "hornet nest." Any stings he collects while handling it are solely his fault. If he doesn't like the pain associated with handling the hornet's nest, maybe he shouldn't have fought so hard to keep holding it.

Filed Under: 9/11, bulk data collection, fud, keith alexander, nsa, surveillance, terror

Feinstein Releases Fake NSA Reform Bill, Actually Tries To Legalize Illegal NSA Bulk Data Collection

from the don't-buy-the-lies dept

Despite Dianne Feinstein's supposed "conversion" earlier this week about the NSA being out of control with its spying, and the associated performance of NSA folks claiming that they were screwed, it's quickly become apparent that this was all pure theater to make people think that real reform might be coming. Feinstein claimed she was shocked about this and called for a full investigation... and yet, just two days later, she held a markup of her planned "reform" bill for the collection of intelligence by the NSA (and held the markup in secret -- because nothing says "let's increase transparency of the NSA" like keeping the debates and votes secret). That bill was moved out of committee today by a vote of 11 to 4, leading Feinstein to release the bill with a bunch of misleading claptrap designed to make people think it's real reform. It even confused some folks who know this stuff into thinking, after a quick first pass, that it "banned" the bulk data collection. And you might think that's the case because her description says:

• Prohibits the collection of bulk communication records under Section 215 of the USA PATRIOT Act except under specific procedures and restrictions set forth in the bill;
• Establishes criminal penalties of up to 10 years in prison for intentional unauthorized access to data acquired under the Foreign Intelligence Surveillance Act (FISA) by the United States;
• Prohibits the bulk collection of the content of communications under Section 215 of the USA PATRIOT Act;

Reading that, you might think it actually banned the bulk data collection that's been reported on, but it does not. That "except under specific procedures and restrictions set forth in the bill" just takes the highly questionable reasoning of the FISA Court in approving the bulk data collection and makes that the "exception." In other words, it does exactly the opposite of what Feinstein claims. Rather than banning bulk data collection, it legalizes it. That third point on the "content" is just a red herring -- the same red herring that Feinstein and others have been waving about wildly for months, pretending people are upset about the collection of actual recordings, rather than the collection of metadata. She's wrong. People are upset about the collection of metadata, which this legalizes.

Even more ridiculous, the focus (both in the marketing and the bill itself) on collection of content "under Section 215" is another red herring, since it appears that much of that collection actually happens under other programs anyway. So this doesn't change a damn thing.

Other supposed "changes" in the bill -- including limiting who can perform queries on the data, how many "hops" they can analyze and how long they can retain the data, all match with current practice and don't change a thing. Even though James Clapper and Keith Alexander more or less seemed to concede at yesterday's House hearing that they'd be okay with cutting back on the data retention from five to three years, this bill keeps it at five. There are a few other minor changes, but this bill is almost entirely as expected, simply codifying the status quo, even though Feinstein has insisted that it was legal all along. The one minor "concession" which many had expected -- having a third party at the FISA Court who could fight for civil liberties -- is watered down. Rather than an actual adversarial setup, with this person representing civil liberties, it's set up as an appointed "amicus cureia" or "friend of the court," where they basically just advise the court on the issue.

This bill is a farce, and made even more farcical by the misleading way in which Feinstein has presented it, pretending it bans bulk data collection when it actually legalizes it.

Filed Under: bulk data collection, dianne feinstein, fisa, fisa court, fisa improvements act, fisc, lies, nsa, nsa surveillance, section 215