At Long Last, NSA Finally Recommends Its Bulk Phone Collection Program Be Put Out Of Its Misery

from the DNR-please dept

Early last month, it appeared the NSA was ready to shut down its bulk phone records collection. The subject of the first Snowden leak was argued to be an essential part of the national security process, but as it underwent significant modifications, the NSA seemed willing to sacrifice a program of dwindling value to save its more intrusive collections.

This perhaps inadvertent revelation came via a podcast, which is just the way things are done these days. Appearing on the Lawfare podcast, national security advisor Luke Murry had this to say about the Section 215 phone records collection:

Mr. Murry brought up the pending expiration of the Freedom Act, but then disclosed that the Trump administration “hasn’t actually been using it for the past six months.”

“I’m actually not certain that the administration will want to start that back up,” Mr. Murry said.

NSA abandonware. That's one for the history books. This comment has now received official backup from the NSA, which has informed its oversight that it's not really interested in continuing this surveillance program.

The National Security Agency (NSA) has formally recommended that the White House drop the phone surveillance program that collects information about millions of US phone calls and text messages. The Wall Street Journal reports that people familiar with the matter say the logistical and legal burdens of maintaining the program outweigh any intelligence benefits it brings.

The program's alterations -- courtesy of the USA Freedom Act -- now require the NSA to provide reasonable, articulable suspicion prior to asking for records from phone companies. The phone companies simply return responsive records, rather than hand over call data on all calls to the agency for it to sort through at its leisure. The NSA claims "logistical and legal" issues make this program not worth continuing. Perhaps it's actually the evidentiary burden that's making this too much of a hassle -- more "legal" than "logistical."

Whatever the case, it's up to Congress to officially dump the program. The NSA may not be currently collecting anything, but its guidance could be ignored by non-national security experts on Capitol Hill who may be less willing to shitcan domestic surveillance programs.

In a recent interview, Senator Richard Burr of North Carolina, the Republican chairman of the Senate Intelligence Committee, said, "If we have technical problems or challenges that NSA has to take into account, that's okay... It's not something we easily shelve."

If the NSA wants to kill the program, it behooves Congress to preside over its funeral. The best eulogy for the mostly-useless program would be codification of its overdue mortal coil offloading.

A group of bipartisan lawmakers on Thursday introduced a bill that would end the National Security Agency's (NSA) mass collection of U.S. phone data.

The bill's introduction by a group of civil libertarian lawmakers comes weeks after a national security aide to House Minority Leader Kevin McCarthy (R-Calif.) revealed that the NSA has shuttered its call-detail records program.

The Ending Mass Collection of Americans’ Phone Records Act would end the program for good, taking away the NSA's authority to restart it. The bill was introduced by privacy hawks Sens. Ron Wyden (D-Ore.) and Rand Paul (R-Ky.) and Reps. Justin Amash (R-Mich.) and Zoe Lofgren (D-Calif.).

It seems like an easy sale. The NSA isn't going to be pushing back on this one. The only opposition will be reps like Burr who seem to think they know national security better than the National Security Agency.

Filed Under: bulk surveillance, mass surveillance, metadata, nsa, phone records, richard burr, section 215, surveillance

The NSA Appears To Have Shut Down Its Bulk Collection Of Phone Records

from the program-so-valuable-no-one-could-find-a-use-for-it dept

The program considered so "essential" NSA defenders said it couldn't even be slightly modified is apparently no longer in use. During a recent Lawfare podcast, national security advisor Luke Murry dropped a bit of a bombshell. Charlie Savage summarizes Murry's comments:

The National Security Agency has quietly shut down a system that analyzes logs of Americans’ domestic calls and texts, according to a senior Republican congressional aide, halting a program that has touched off disputes about privacy and the rule of law since the Sept. 11 attacks.

[...]

Mr. Murry brought up the pending expiration of the Freedom Act, but then disclosed that the Trump administration “hasn’t actually been using it for the past six months.”

“I’m actually not certain that the administration will want to start that back up,” Mr. Murry said.

Murry is referring to the Section 215 bulk data collection. Exposed by the Snowden leaks, Section 215 was modified by the USA Freedom Act, which went into effect June 2015. The biggest modification was where the records were stored. The NSA could no longer collect all phone records from providers and search through the data at its leisure. Instead, it had to provide telcos with lists of targeted numbers. The data remained in the hands of service providers, with the NSA only having access to suspicion-supported phone records.

The alterations to the Section 215 program resulted in the NSA purging a bunch of records that didn't fit the new parameters. The NSA finally let go of a few of its haystacks, conveniently destroying records integral to multiple lawsuits against the agency. The USA Freedom Act modifications -- combined with the NSA's long history of abusing its collection authorities -- seem to have made it impossible for the NSA to continue utilizing its phone records collection program.

The bulk records collection is now in the hands of telcos, resulting in a slimmed-down dataset the NSA didn't seem particularly enthused to have. Apparently the program is as useless as critics have said it is. The NSA has gone at least six months without asking for data via this authority. This program is due for renewal at the end of this year, but the comments made to Lawfare suggest the NSA may be content to let it expire.

Marcy Wheeler suggests a few underlying motivations for the NSA's abandonment of the Section 215 collection -- and one might be the Supreme Court's extension of Fourth Amendment protections to cell site location info.

[This] suggests that the problem with the records may not be the volume or the content turned over, but some problem created either by the specific language of the law or (more likely) the House Report on it or by the Carpenter decision. Carpenter came out on June 22, so technically after the NSA claims to have started deleting records on May 23. It also may be that the the NSA realized something was non-compliant with its collection just as it was submitting the 6th set of 180-day applications, and didn’t want to admit to the FISC that it had been breaking the law (which is precisely what happened in 2011 when the government deleted all its PRTT records).

Wheeler says the NSA may have been asking for location data as well to better track the phones it targeted. The IC may have seen the writing on the third-party wall following the Supreme Court's oral arguments in November 2017. This may account for its plug-pulling a month ahead of the decision's release.

Or it may be something far less respectful of the Constitution. It could be the NSA has found another way to collect this same data without having to run it by the newly-adversarial FISA court. As Wheeler points out, Section 215 may have been restricted but the powers granted by Executive Order 12333 continue to expand.

Whatever the real motivation, it appears the domestic surveillance program that never prevented a terrorist attack will continue to never prevent terrorist attacks. The upside is we may not be throwing any more tax dollars at a national security program that adds nothing to our nation's security.

Filed Under: bulk surveillance, ed snowden, mass surveillance, metadata, nsa, phone records, section 215

Court Finds Canadian Spy Agency Illegally Collected Data In Bulk For More Than A Decade

from the fighting-terrorism-means-never-having-to-say-you're-sorry.-or-anything,-real dept

The streak of losses for spy agencies continues. All this "lawful" bulk collection of domestic data? Not all that "lawful," actually.

The Federal Court of Canada faulted Canada’s domestic spy agency Thursday for unlawfully amassing data, for misusing its surveillance warrants and for not being forthright with judges who authorize its intelligence programs.

Sounds a whole lot like what happened recently in the UK, where the tribunal found British spy agencies illegally collected data in bulk. And the other part of it -- the "not being forthright with judges" -- sounds a whole lot like the NSA's multiple run-ins with PO'ed FISA judges who have to trudge through miles of misrepresentations with zero help to find the underlying malfeasance.

On the other hand, the court also came to the conclusion that no warrants are needed to seek tax records in bulk, thanks to recent legislation. So, there's that.

But the decision showed that Canada's spy agencies are subject to just as much oversight as those located in other countries: none.

The centre and the data within it are so secret that the Federal Court – which authorizes CSIS wiretapping bids – had no idea they existed.

“The Court had never before been fully informed of the existence of the program. The Court, during the hearings, learned that the program had been in existence since 2006 yet it had never heard nor seen any evidence on the matter,” reads a partly redacted new ruling from Federal Court Judge Simon Noël.

It's pretty easy to run an illegal surveillance program when no one's looking, much less has any clue that such a thing even exists. And yet, when exposed by leaks or whistleblowers, the first thing agencies do is claim that everything is "lawful" and subject to tremendous amounts of rigorous oversight.

And every time they do that, a new leak or court decision proves these defensive statements to be a lie. The most dangerous thing about terrorism isn't the attacks. It's the actions governments take -- both overt and obscured -- in response.

In this particular case, the Canadian spy agency blew off its obligation to inform the court of the existence of the program and the data it was collecting. Rather than do that, it operated in secrecy under the presumption that all would be forgiven because it was fighting the new Good Fight.

This fall, the Security Intelligence Review Committee criticized CSIS for going beyond its “strictly necessary” collection mandate by “ingesting bulk data sets” in bids to predict patterns of terrorism.

These bulk sets included information the court wasn't aware the agency was collecting. In the tribunal's vernacular "associated data": phone and email metadata, gathered on top of data deemed "strictly necessary" and actually approved by the court.

The ruling may be a harsh assessment of CSIS's illegal activities but it's unclear what repercussions it will actually have for the agency. The only outcome so far is suggested legislative changes and a very belated call for actual oversight.

The problem is that more recent legislation has codified the illegal activity, granting CSIS access to the same data the Tribunal found was illegally collected -- without a warrant. Unless that law (Bill C-51) is rolled back, there will be no permanent consequences for the illegal activity. All that will be left will be a "scathing" ruling that will ultimately do little to deter the agency from engaging in further abuses.

Filed Under: bulk surveillance, canada, surveillance

National Intelligence Office's Top Lawyer Fires Off Spirited Defense Of Bulk Surveillance, Third Party Doctrine

from the "in-order-for-programs-to-remain-legal,-I-must-view-it-this-way" dept

Robert Litt, General Counsel for the Office of the Director of National Intelligence, has been given space at the Yale Law Review Journal to publish his citable article "Why Everyone's Wrong About the Fourth Amendment." Or, as Litt would like us to refer to it:

Preferred Citation: Robert S. Litt, The Fourth Amendment in the Information Age, 126YALE L.J. F. 8 (2016), http://www.yalelawjournal.org/forum/fourth-amendment-information-age.

To be fair, Litt never says we're all wrong about the Fourth Amendment and the Third Party Doctrine. He only says Judge Leon is. Judge Leon was the single district court judge who found the bulk collection of phone metadata to be unconstitutional.

Technically, we're not all wrong, but we may as well be, because no court has found the collection unconstitutional save Judge Leon's and Litt doesn't agree with it. Several paragraphs follow, but the crux of Litt's argument is nothing new: it's just 1979's Smith v. Maryland decision all over again.

I do not think that Judge Leon’s efforts to distinguish Smith were successful. First, while Judge Leon is certainly right that metadata can be very revealing of personal activities, there is nothing new about that insight. Justice Stewart dissented from the decision in Smith itself in part because he recognized that metadata “easily could . . . reveal the most intimate details of a person’s life.” The point of Smith was not that metadata is innocuous, but that you have chosen to reveal it to a third party. To use an analogy, if you give a document to a third party, you have lost your expectation of privacy in that document, whether it is a laundry ticket or a confession of mortal sin. Moreover, the fact that cell phones today contain a lot of information beyond metadata does not seem relevant when the government did not actually search or collect any of that other information.

[...]

[I] find it hard to understand the alchemy by which information that you choose to disclose to a third party develops an expectation of privacy because you have chosen to disclose a lot of that information. That seems counter-intuitive to say the least. For all of these reasons, if you accept Smith’s holding that there was no expectation of privacy in the telephone metadata in that case because it had been voluntarily exposed to a third party, you can’t conclude there was an expectation of privacy in the metadata in this case.

The thing is that while people may voluntarily agree to hand over certain information to service providers (and it's safe to say the "agreement" is anything but "voluntary"), they do not naturally assume the service provider will share this -- no questions asked or warrants demanded -- with anyone else who comes asking for it. That's where the reliance on Smith v. Maryland fails. "Choose to disclose" is much different than "forced to disclose." And it's not as if it can truly be said phone users relinquish all ownership of that data. It's specifically tied to them and they "share" it with service providers -- which if that's how Litt wants to interpret the interaction, he should at least be honest and give both parties some sort of ownership, along with the privacy expectations that go with it.

A lot of the rest of it is given over to Litt's displeasure that courts have even granted plaintiffs standing in bulk metadata program lawsuits. Whatever the Third Party Doctrine doesn't shut down, the plaintiffs' inability to claim anything more than theoretical rights violations by programs the government refused to discuss publicly should have seen the cases tossed immediately. He agrees the framework is there for massive violations of privacy but these actually damaging acts simply never occurred. But abuses did occur and were covered up by the NSA, nearly resulting in the program being shut down back in 2008 by FISC Judge Reggie Walton.

This fact undercuts Litt's assertions in defense of the now-curtailed program.

For several years, and with judicial authorization, the NSA collected metadata in bulk about U.S. phone calls from telephone companies for counterterrorism purposes. The metadata was kept in secure databases. It could only be accessed by a few specially trained NSA analysts, and then only to identify telephone numbers in contact with so-called “seed” numbers as to which there was a reasonable and articulable suspicion of an association with terrorism—such as, for example, a number used by a suspected terrorist.

First off, the program was accessed by more than just a "few" specially trained analysts. It was a free-for-all until the FISA Court shut that down. Second, the reasonable, articulable suspicion standard wasn't always applied to searches of the database. For a period of time, NSA analysts ran searches against an "Alert List" of numbers the FISA Court had never approved for use -- i.e., no RAS declaration was made by the NSA to support additions to the list used for searches of the bulk data. Some of these numbers were added simply because they were two or three hops away from an RAS-supported number, meaning there was nothing supporting the use of these "connected" numbers as new "seeds" for database searches and contact chaining.

What Litt does get right is that the NSA has done itself no favors with its decades of opacity.

Where we fell short was on the third leg of the stool, transparency. There would have been less damage to the Intelligence Community from the disclosures of the last couple of years had we been more forthcoming about our activities before those leaks. Obviously, intelligence activities have to be conducted with some degree of secrecy, and the same is true of some law enforcement activities. Specific methods and targets of surveillance have to be protected. But if we don’t discuss what we are doing and how we are regulating it even in general terms, we cede the field to those who are hostile to intelligence activities.

And, perhaps inadvertently, Litt lets us know President Obama is just as big a fan of the NSA as his predecessor was.

A decision by Congress to authorize certain activities under certain controls, made after discussion and debate, should be a strong factor in support of the reasonableness of those activities. Congress is going to have a number of opportunities to address these issues. For example, Section 702 expires at the end of 2017, and there are continued efforts to modernize the Stored Communications Act. It may be too much to hope that in the current political environment, Congress could have a dispassionate and comprehensive discussion about such weighty issues, but the Executive Branch would welcome such a discussion.

Given the selection of presidential frontrunners, I have no reason to believe Litt's assessment of the situation will be any less accurate by the time the Section 702 expiration date rolls around.

Filed Under: 4th amendment, bulk surveillance, mass surveillance, nsa, odni, privacy, robert litt, surveillance, third party doctrine

Pathological: Surveillance State Defenders Use Their Own Failure In Paris To Justify Mass Surveillance

from the shut-up-jackasses dept

We already wrote a bit about the absolutely ridiculous attempts to connect the Paris attacks of last week with Ed Snowden and encryption. But, of course, the surveillance state sees successful terrorist attacks -- which often demonstrate their own failings -- as a way to double down on getting more power. Take, for example, our old friend and former NSA General Counsel Stewart Baker.

As pointed out by Marcy Wheeler, Baker used the Paris attacks to argue that it was evidence that the NSA should not shut down its Section 215 bulk collection of phone records.

NSA's 215 program was designed to detect a Mumbai/Paris-style attack. https://t.co/UelhvrlNPp Maybe this is the wrong month to drop it.

— stewartbaker (@stewartbaker) November 14, 2015

There are so many problems with this level of idiocy that it's difficult to know where to start, but let's go with the basics... (1) the NSA program is still on and still working for another few weeks before it shifts to a slightly modified version. (2) France has its own equivalent program that is still in operation. In fact, France famously expanded its surveillance laws late last year prior to both the Charlie Hebdo and Paris attacks. (3) Outside of the US, the NSA relies on Executive Order 12333, which allows the NSA to collect a hell of a lot more information than the somewhat limited Section 215 program. (4) None of those programs appears to have discovered the Paris attacks (or, if they did, they clearly failed in stopping the attacks). (5) In other words, these programs did not work and yet the knee-jerk surveillance state defenders are using them as proof that the programs work.

What the actual fuck, Stewart?

Look, it's one thing to use horrible tragedies to promote your own political desires. It's another thing entirely to use the out and out failure of these intelligence programs to argue that they're proof of why those programs work and/or should be expanded.

Filed Under: bulk surveillance, executive order 12333, mass surveillance, nsa, paris attacks, section 215, stewart baker, surveillance state

Normalization Of Mass Surveillance Continues: Ireland And Georgia Join The Snoopers Club

from the in-camera dept

One of the consequences of the Snowden leaks of mass surveillance around the world is that a number of governments have been bringing in new laws in order to provide a legal framework for the snooping they have previously been carrying out illegally, when they obviously thought that no one would ever find out. Here's a story in The Irish Times about recent moves in Ireland:

Foreign law enforcement agencies will be allowed to tap Irish phone calls and intercept emails under a statutory instrument signed into law by Minister for Justice Frances Fitzgerald.

Companies that object or refuse to comply with an intercept order could be brought before a private "in camera" court.

The legislation, which took effect on Monday, was signed into law without fanfare on November 26th, the day after documents emerged in a German newspaper indicating the British spy agency General Communications Headquarters (GCHQ) had directly tapped undersea communications cables between Ireland and Britain for years.

As that reports, there's also a troubling new secret court for enforcing such intercept orders -- something that is extremely unusual in Ireland:

"Even with very sensitive cases in Ireland they’re not prosecuted in camera," said TJ McIntyre, lecturer at University College Dublin’s school of law and chairman of advocacy group Digital Rights Ireland. "It's worrying because it means telecommunications companies might be pressured into doing things that aren’t entirely legal."

The companies would be prosecuted in secret, and would be unable to disclose their objections publicly – or even the fact that they were being prosecuted.

Ireland's move is a further example of how enshrining the ability to spy at home and abroad is taking precedence over basic rights -- in this case, to an open trial. Another country making worrying moves to normalize snooping on its citizens is Georgia, whose Parliament gave a first reading to new laws covering this area, as reported by Civil.ge:

The government-backed package of bills allows the Interior Ministry to retain its direct access to telecom operators' networks, but also empowers the office of personal data protection inspector to electronically monitor if the security agencies are carrying out surveillance lawfully, based on court warrant.

But the opponents, which also include civil society groups who have long been campaigning for reining in security agencies' unrestricted direct access to telecom operators’ networks, argue that actual wording of the bill, full of complex technical terms about lawful interception management system, hash codes and log files, is far from what its sponsors are trying to portray and leaves room for the Interior Ministry to bypass personal data protection inspector for carrying out illegal monitoring of mobile phone and internet communication.

Unfortunately, the more these laws are passed, the more other countries are likely to follow suit, until legalized mass snooping becomes the norm. That's all the more reason to challenge these early examples in any way possible, as is happening in the UK, for example, before the idea spreads everywhere.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bulk surveillance, georgia, ireland, mass surveillance, surveillance

UK's GCHQ Can Get Warrantless Access To Bulk NSA Data

from the keeping-your-hands-clean dept

Last week, we learned that the GCHQ certainly isn't engaged in mass surveillance -- provided you redefine the meaning of "mass" and "surveillance" in unconventional ways. Now we discover that maybe it doesn't really need to, since it can just ask the NSA and other secret services for access to their raw data without even needing a warrant, as a group of human rights organizations have discovered:

Details of previously unknown internal policies, which GCHQ was forced to reveal during legal proceedings challenging their surveillance practices in the wake of the Snowden revelations, reveal that intelligence agencies can gain access to bulk data collected from US cables or through US corporate partnerships without having to obtain a warrant from the [UK's] Secretary of State. This position seems to conflict with reassurances by the Intelligence Services Committee in July 2013 that whenever GCHQ seeks information from the US a warrant is in place.

The "arrangements", as they are called by Government, also suggest that intercept material received from foreign intelligence agencies is not subject to the already weak safeguards that are applied to communications that are intercepted by the UK's Tempora programme. On the face of the descriptions provided to the claimants, the British intelligence agencies can trawl through foreign intelligence material without meaningful restrictions and can keep such material, which includes both communications content and metadata, for up to two years.

Once again, we see evidence that intelligence agencies are happy to do the dirty work for each other so that they can all claim to have clean hands -- just as the outgoing head of the GCHQ claimed when he said that people there would "walk out the door" rather than be involved in anything so sordid as mass surveillance. It also shows how even the weak safeguards and ineffectual oversight of spy agencies can be circumvented by this kind of mutual help, something pointed out by the organizations behind the latest information:

The disclosed "arrangements" bring into sharp relief the minimal safeguards and weak restrictions on raw intelligence sharing with foreign governments, including between the UK and the United States. The fact that GCHQ can request and receive large quantities of "unanalysed" raw bulk data from foreign intelligence agencies without a warrant in place, simply because it would "not be technically feasible" to obtain it in the UK, shows the inadequacies in [the UK's Regulation of Investigatory Powers Act 2000] to deal with intelligence agency co-operation. Under these "arrangements", there is a clear risk that agencies can sidestep British legal restrictions to obtain access to vast amounts of data.

There is a minor silver lining to these latest revelations that the situation in the UK is even worse than previously believed. It's the fact that a legal action against GCHQ's mass surveillance has, unexpectedly, forced the UK government to admit to even more unsavory practices. Here's how that came about:

Descriptions of the policies were disclosed to the parties after a secret hearing at the Investigatory Powers Tribunal, which is currently considering a challenge to GCHQ's surveillance practices that has been brought by human rights organisations including Privacy International, Liberty and Amnesty International. A public hearing of the case was held in July, but these “arrangements" were revealed to the Tribunal in a closed hearing that the claimants were barred from attending. Some details about the policies are now disclosed in order for the claimants to provide comment.

That's a useful reminder that no matter how hopeless these actions might seem, they are not only pretty much the only avenue open to human rights organizations who wish to challenge mass surveillance by governments, but they sometimes yield valuable new information that bolsters the case for greater oversight and tighter regulation of spy agencies.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: bulk surveillance, gchq, nsa, privacy, surveillance, warrants