As The NSA Declares Phone Record Program Dead, Trump Administration Asks For A Permanent Reauthorization

from the learn-how-to-read-a-room,-dudes dept

The NSA decided to abandon its phone data collection earlier this year, stating that it was having all sorts of technical issues collecting only the stuff it was asking for. In the good old days prior to the enactment of the USA Freedom Act, the NSA simply asked for everything. "Reasonable articulable suspicion" now guides the record collection -- something that appears to be too tricky for the NSA to wrap its collective collection powers around.

It's not all the NSA's fault. The telcos now hold the records and only hand over what's asked for when the NSA approaches them. Easier said than done, apparently, as over-collection continues and the NSA seems unable to prevent collecting records it's not actually trying to correct.

But it's also the NSA's fault because it's had plenty of time to get used to the new rules and develop better practices/software to sort through collected data. Of course, the NSA has also hinted the program is of limited usefulness and has seemed willing to give it up for years now, especially if the token sacrifice saves other, far more intrusive programs from the Congressional chopping block.

Is it really shut down, though? That's been a tough question to answer. The NSA did recommend the program be shut down and claims it's just gathering dust at the moment, but there's been nothing definitive delivered to its oversight. Until now. Charlie Savage reports for the New York Times that there's finally official confirmation of the program's (possibly temporary) demise. Exiting Director of National Intelligence Dan Coats' unclassified letter makes it clear the NSA has shut down the program indefinitely.

“The National Security Agency has suspended the call detail records program that uses this authority and deleted the call detail records acquired under this authority,” Mr. Coats wrote. “This decision was made after balancing the program’s relative intelligence value, associated costs, and compliance and data integrity concerns caused by the unique complexities of using these company-generated business records for intelligence purposes.”

This isn't really good news, though. The current administration has other ideas for the program -- and a few other collection authorities -- that would excuse them permanently from periodic review.

In a letter to Congress delivered on Thursday and obtained by The New York Times, the administration urged lawmakers to make permanent the legal authority for the National Security Agency to gain access to logs of Americans’ domestic communications, the USA Freedom Act.

Not sure if Dan Coats is just a team player or he actually believes the NSA can power through its technical struggles and finally get this phone record thing nailed down. Savage reports Dan Coats is on board with plans to permanently reauthorize the program under the theory that technical advances will make this program useful again at some undetermined point in the future.

In addition to the phone record collection, the administration also was a permanent reauthorization of other business record collections, authority to wiretap "lone wolf" suspected terrorists with no ties to foreign powers, and its infamous roving wiretaps that follow the suspects, rather than their phones.

The NSA and its programs are barely subject to oversight as it is. This would further insulate four surveillance programs -- one wholly domestic -- from even a rote appraisal of their use and abuse. And for all the talk about how much trouble the phone record collection is, the outgoing Intelligence Director thinks it's wise to just leave it idling in the driveway until the next time the NSA wants to take it out for a spin.

Filed Under: 215 renewal, bulk records, business records, dan coats, mass surveillance, nsa, privacy, section 215, surveillance

Documents Show The NSA's Abuse Of Its Phone Records Collection Continued Right Up Until Its Decision To Pull The Plug

from the too-much-of-a-useless-thing dept

The NSA may have extremely belatedly decided to give up its bulk phone records collection, but that's only after years of dysfunction, abuse, and escalating uselessness. The problems with the NSA's collection of phone records dates back to at least 2004 -- a 14-year streak of violations that may only now be coming to an end because of the NSA's voluntary sunsetting.

For years, the NSA treated the phone records collection as essential to national security. Not much was said about it until Ed Snowden leaked a court order showing the NSA was sweeping up every record possessed by Verizon's business services wing. Then things got heated and the NSA was unable to justify its continued existence.

Once the program was modified, the NSA had even more trouble collecting records lawfully. It may have been limited to performing targeted searches, but it was still somehow able to over-collect. Whether this was due to the NSA's filtering of returned search results or errors on the telco side when providing records, the NSA hasn't definitively said. But it did destroy millions of records it never should have had in the first place, strongly suggesting the agency was still collecting in bulk, despite legislative changes.

The NSA may be winding the program down, but it's not going out without extending its violation streak, as John Bacon reports for USA Today.

The National Security Agency improperly collected phone call records of Americans last fall, months after a previous breach that compelled the agency to destroy millions of records from the contentious program, documents released Wednesday revealed.

The redacted documents, obtained by the ACLU in a Freedom of Information Act lawsuit, do not indicate how many records NSA improperly collected in the October breach, nor which telecommunications provider submitted the improper data.

The NSA is consistent, if nothing else. It continues to violate the rules governing its collections and the American public will be made aware of these abuses months after the fact. This latest revelation didn't come via the ODNI's Tumblr or during a Congressional hearing, but via a lawsuit over withheld documents.

The ACLU notes that this is just more evidence that the NSA can't be trusted with the incredible amount of power it's been given. This is from ACLU staff attorney Patrick Toomey:

The NSA’s collection of Americans’ call records is too sweeping, the compliance problems too many and evidence of the program’s value all but nonexistent.

This is all known now. But every trickle of information about this program has come from FOIA lawsuits and document leaks. None of this has come directly from the NSA or its oversight. This means both entities have been fronting an abusive, useless program for most of two decades and are only now abandoning it because apparently the rigors of compliance outweigh the value of the intel.

Finally, it should be noted the NSA is only ditching the phone records program. It will continue to sweep up other "business records" in bulk. Given its history with this program, it's guaranteed its other collections under this authority are just as abused, and possibly just as worthless.

Filed Under: abuse, business records, mass surveillance, metadata, nsa, phone records, privacy, section 215, surveillance

Sixth Circuit Says Cell Site Location Data Just A Business Record; No Warrants Required

from the what-Smith-v.-Maryland-has-wrought dept

To date, four appeals courts have entered opinions on whether cell site location info is covered by the Fourth Amendment. So far, only the Fourth Circuit Court of Appeals has found this to be worthy of a warrant. All others find CSLI to be covered under the Third Party Doctrine. These cases all deal with historical cell site location info, usually obtained in bulk with subpoenas. Near real-time tracking using tower pings is another issue entirely -- one that's rarer because a) obtaining rolling CSLI from a provider is a pain and b) everyone's using Stingrays now.

The Sixth Circuit Court of Appeals is the fourth appeals court to find CSLI isn't covered by the Fourth Amendment. By this point, the arguments against greater privacy protections are all too familiar.

It's Just Metadata:

Content, per this distinction, is protected under the Fourth Amendment, but routing information is not.

It's not as precise as other tracking methods, so not really a problem:

The defendants argue that the government’s collection of those records constituted a warrantless search in violation of the Fourth Amendment. In making that argument, however, the defendants elide both the distinction described above and the difference between GPS tracking and the far less precise locational information that the government obtained here.

The amount of data gathered by the FBI is impressive. Relying on orders issued by three different magistrate judges, the FBI obtained 6-7 months of location info for 16 different cellphones. The coarse location info (accurate to within a half-mile in most cases) helped place two of the suspects near the scene of a couple of robberies. The suspects' attempt to suppress the evidence gathered by these orders made it all the way up the chain to the Appeals Court -- only to find the court affirm the lower court's denial of their motion.

The court quotes from 1979's Smith v. Maryland decision -- the cornerstone of a majority of pro-Third Party Doctrine arguments -- but fails to see any difference between obtaining call routing info tied to a non-mobile landline and information wholly unrelated to any communications generated by mobile phones as they connect to towers..

The court also quotes law enforcement's favorite argument: that people should know things they "share" involuntarily with cell providers are also things they involuntarily share with the government.

[A]ny cellphone user who has seen her phone’s signal strength fluctuate must know that, when she places or receives a call, her phone “exposes” its location to the nearest cell tower and thus to the company that operates the tower.

As in other cases dismissed using this same rationale, this representation of what people should or shouldn't know isn't just inaccurate (and highly dismissive of people who don't realize this give-and-take is part of cellphone operation) but it's also disingenuous. People likely know they generate some sort of location information. What they don't assume is that law enforcement can access records of their movements without a warrant.

The opinion also name-drops the Stored Communications Act -- part of the abysmal Electronics Communication Privacy Act -- as part of the reason the court won't be extending an expectation of privacy to location data.

Some other points bear mention. One is that Congress has specifically legislated on the question before us today, and in doing so has struck the balance reflected in the Stored Communications Act. The Act stakes out a middle ground between full Fourth Amendment protection and no protection at all, requiring that the government show “reasonable grounds” but not “probable cause” to obtain the cell-site data at issue here. See 18 U.S.C. § 2703(d). The defendants and the ACLU effectively ask us to declare that balance unconstitutional. There is considerable irony in that request. The Katz standard asks whether the defendants’ asserted expectation of privacy “is ‘one that society is prepared to recognize as reasonable[.]’” Smith, 442 U.S. at 740 (quoting Katz, 389 U.S. at 361). Here, one might say that society itself—in the form of its elected representatives in Congress—has already struck a balance that it thinks reasonable.

Hardly. The ECPA is a farce -- one that the government has used for years to obtain communications in bulk without a warrant.

Now, as to the lowered bar for obtaining CSLI -- a proxy version of location tracking -- historical data, especially one as "coarse" as CSLI is likely not going to be found to be worthy of Fourth Amendment protection… at least not by the courts. (Even in the Fourth Circuit decision, the concern was about the quantity of records obtained, rather than that they were obtained without a warrant.) As the opinion somewhat notes in its nod to Congress, this is an issue that needs to be addressed by legislation that more accurately reflects the privacy expectations of the public. The Stored Communications Act does not.

But courts do need to be wary of relying on Smith v. Maryland and constantly deferring to the Third Party Doctrine. Even in its coarse, historical form, CSLI reveals far more about a person's movements than law enforcement could obtain through any other warrantless method than following suspects in person. Law enforcement should not be prevented from availing themselves of technological advances, but the benefits need to be balanced against the public's expectations of privacy in records generated and collected as a result of phone usage.

Certainly, no one objects to pen registers for call routing data, but people honestly do not consider themselves to be nothing more than massive databanks the government can dip into with the most minimal of court oversight. Given the fact that many law enforcement agencies are deploying cell site simulators under the cover of pen register orders, the new normal should be an expectation of privacy in involuntarily-generated location data. Law enforcement likely finds coarse location data to be accurate enough for indictments and prosecutions and the continued denial of Fourth Amendment protection only encourages them to obtain CSLI with a court order rather than clear the higher evidentiary hurdles presented by the use of GPS devices.

Unfortunately, without Congressional action, most courts can only rely on legal precedent -- and the bulk of it considers parties generated by members of the public but collected and stored by companies to be unprotected by the Fourth Amendment. The only thing that's going to take Smith v. Maryland off the judicial table is new legislation or a Supreme Court decision declaring location data to have an expectation of privacy. The former seems almost as likely as the latter, but neither can truly be considered inevitable.

Filed Under: business records, cell site location, csli, sixth circuit, third party doctrine, warrants

Three PATRIOT Act Provisions Likely To Sunset, Briefly, But USA Freedom Will Pass Shortly

from the what-happens-next-is-what-matters dept

On Friday, we posted a story looking at the divergent views of two of my favorite privacy experts: Jennifer Granick favoring just letting the three PATRIOT Act clauses to sunset... and Julian Sanchez arguing that just letting those provisions sunset would unfortunately leave aside many of the important reforms in the USA Freedom Act. But, as we noted, both of them seemed to agree that either such result, without further reforms, wouldn't be enough.

Well, now it appears that both things will happen. After some debate, a late vote this evening, the Senate voted 77 to 17 to move forward on the USA Freedom Act -- but a vote will not occur until Monday at the earliest. That means, in a few hours, those three provisions of the PATRIOT Act will expire (and, no, this does not mean -- as some have falsely stated that the PATRIOT Act itself is dead). And then, a few days later, the USA Freedom Act will be passed (even Rand Paul admitted this is what's going to happen, even as he sought to block USA Freedom). Paul and some others are going to try to add some important amendments to the bill, but they're unlikely to pass.

In other words, both of the arguments that Granick and Sanchez made seem to have happened. Section 215 will "sunset" briefly -- hence a symbolic win. And USA Freedom Act, which has some useful reforms, will pass. And... then we'll still have a long way to go to get even more important surveillance reform. The events of this evening are an important step forward. Until just recently, the very idea that we might limit the Section 215 program for real seemed unlikely. And yet, now that's happening -- with both a brief sunset and the reforms in the USA Freedom Act.

But it's not enough. There is still plenty of excessive surveillance happening -- under other provisions, including Section 702 of the FISA Amendments Act and Executive Order 12333. Those need to be dealt with if we're to have real surveillance reform. The end result is that this is a an important victory for surveillance reform -- which never would have happened without Ed Snowden's actions -- but it's just a step. And a lot more is needed. And it's needed now.

Filed Under: bulk collection, business records, executive order 12333, mass surveillance, nsa, patriot act, rand paul, section 215, section 702, sunset, surveillance

Report: FBI's PATRIOT Act Snooping Goes Beyond Business Records, Subject To Few Restrictions

from the 'just-metadata'-means-whatever-the-FBI-can-obtain dept

A report by the FBI's Office of the Inspector General (OIG) on the agency's use of Section 215 collections has just been released in what can only be termed as "fortuitous" (or "suspicious") timing. Section 215 is dying. It was up for reauthorization on June 1st, but the Obama administration suddenly pushed that deadline up to the end of this week. Sen. Mitch McConnell took a stab at a clean reauth, but had his attempt scuttled by a court ruling finding the program unauthorized by existing law and the forward momentum of the revamped USA Freedom Act. And, as Section 215's death clock ticked away, Rand Paul and Ron Wyden engaged in a filibuster to block any last-second attempts to ram a clean reauthorization through Congress.

The report focuses mainly on the FBI's 2007-2009 use of the program in response to previous OIG recommendations and alterations ordered by the FISA court. As is to be expected in anything tangentially-related to the NSA, it's full of redactions, especially in areas where a little transparency would go a long way towards justifying the FBI's belief that the program should continue in a mostly-unaltered state.

Redactions like this do absolutely nothing to assure the public that the program is useful and/or considerate of citzens' rights.

Areas dedicated to discussing controls of the obtained data are similarly obscured. Whatever policies the FBI adopted in terms of minimization, dissemination and oversight at the recommendation of the OIG are covered in black ink.







What information does actually make its way past the redactions shows that what's collected (and turned over to the FBI) goes far beyond the "just" telephone metadata often claimed to be the primary target of the program's collections.

Far from being just business records -- something the public supposedly has no 4th Amendment-related privacy interest in -- the Section 215 program also allows the FBI to obtain "non-public" records and data.

In the 2008 report, we recommended that the Department implement minimization procedures for the handling of nonpublicly available information concerning U.S. persons in response to Section 215 orders…

More sentences scattered throughout the report hint at expansive collections going far beyond the business records covered by the Third Party Doctrine. As noted in the report, reauthorizations of the Patriot Act expanded the program's reach far beyond what was allowed in its earliest iterations -- from business records from certain approved sources to "any tangible thing." This, combined with a continually-lowered threshold for "relevance" has resulted in the following:

We found that [redacted] of [redacted] applications submitted to the FISA Court on behalf of the FBI requested materials related to Internet activity. [p. 7]

Materials produced in response to Section 215 orders now ranges from hard copy reproductions of business ledgers and receipts to gigabytes of metadata and other electronic information. [p. 8]

We reviewed [redacted] related Section 215 applications that requested subscriber and transactional information for [redacted] e-mail accounts from U.S. providers. [p. 40]

The report also notes that minimization procedures do not apply to "publicly-available information," possibly indicating that the FBI's interpretation of the Third Party Doctrine allows it to retain and search non-relevant information on US persons, as well as disseminate it freely without fear of breaching its internal policies. The FBI's "Final Procedures" -- adopted in the wake of the FISA court's smackdown of the NSA, as well as on the recommendation of the OIG -- only applies to "nonpublicly available information."

The OIG also cautions that technological advances have blurred the line between communications and metadata and warns the FBI that vigilance will be needed to keep the two separate. This statement points to the eventual development of further minimization procedures, but if it's anything like the last set of OIG recommendations, it will be years before the FBI gets around to putting anything in motion.

We found the Supplemental Orders significant because the practice began almost 3 years after the Department was required by the Reauthorization Act to adopt specific minimization procedures for material produced in response to Section 215 orders, and over a year after we found that the Interim Procedures implemented by the Department in September 2006 failed to meet the requirements of the Reauthorization Act. The Department and FBI ultimately produced final minimization procedures specifically designed for Section 215 materials in 2013. The Attorney General adopted the FBI Standard Minimization Procedures for Tangible Things Obtained Pursuant to Title of the Foreign Intelligence Surveillance Act on March 7, 2013 (Final Procedures), and in August 2013 the Department began to file Section 215 applications with the FISA Court which stated that the FBI would apply the Final Procedures to the Section 215 productions.

Given the significance of minimization procedures in the Reauthorization Act, we do not believe it should have taken 7 years for the Department to develop minimization procedures or 5 years to address the OIG recommendation that the Department comply with the statutory requirement to develop specific minimization procedures designed for business records…

The report also contained details on numerous instances of potential abuse of the Section 215 collections. Most of these discussions are redacted, but one reveals enough information to indicate the FISA Court was used to obtain information pertaining solely to a US person, as well as other intriguing (but mostly censored) incidents where FBI agents apparently felt FISA Court orders were more useful and expeditious than National Security Letters -- something of an anomaly for an agency that has so thoroughly abused its administrative privileges.

What is clear from these heavily-redacted recountings is that the FBI uses court orders designed for foreign intelligence gathering for domestic investigations, as well as to aid the agency in its cyberwar efforts.

The report also takes note of the severe restrictions imposed by the FISA court in 2008 after uncovering widespread abuse of the metadata collections by the NSA. It points out that several of these restrictions were lifted after an end-to-end review showed no instances of abuse by the agency during the period examined. In addition to confirming that the NSA collects from providers (plural) -- despite the government's arguments to the contrary when disputing plaintiffs' standing in Section 215-related lawsuits -- the report also points to the FBI and NSA obtaining records they shouldn't have had access to by an overly-helpful telco.

[N]SD reported to the FISA Court in March 2011 that in December 2010 and January 2011 NSA technical personnel discovered that the telephony metadata produced by a telecommunications provider included [redacted]. NSA contacted the carrier and was informed that a software change made in October 2010 resulted in this occurrence. According to the NSD's compliance notice filed with the Court, beginning on or about January 14, 2011, the telephony metadata did not include [redacted]. The NSA subsequently provide updates to the FISA Court describing the methods taken to purge the [redacted] from its databases.

And, as is the case with nearly every FBI document release, there's some over-redaction that serves no purpose other than to make the agency look foolish.

In June 2013, former NSA contract employee Edward Snowden caused to be publicly released documents relating to the bulk collection of telephony metadata and the Office of the Director of National Intelligence has since declassified aspects of this program. We have included a description of the NSA program, [redacted] in the body of this report.

The Department relied on [redacted] to obtain FISA Court orders [redacted].

So much for the transparency push. Despite leaks and declassification in response, the FBI withholds information already in the public domain.

Additionally, the document could have shed some light on the FBI's current Section 215 activities, but instead the agency has chosen to hide every last bit of discussion on its ongoing efforts. [pp. 68-72]


FBI head James Comey continues to insist there needs to be a discussion about the respective weighting of security and privacy, but heavily-redacted documents like these do not add to that discussion. How is the public supposed to weigh these two factors if it can't access the FBI's arguments in favor of Section 215's continued existence? The only purpose this document serves is to give legislative true believers something to wave around as they defend the Patriot Act's perpetual, unaltered renewal.

Filed Under: business records, doj, fbi, inspector general, nsa, oig, patriot act, section 215, surveillance

Government Continues To Pretend People Use Cell Phones Simply To Create A Wealth Of Data For Law Enforcement To Access Without A Warrant

from the let's-make-government-cell-phone-data-accessible-by-FOIA-request dept

You'd think approved warrants must be like albino unicorns for all the arguing the government does to avoid having to run one by a judge. It continually acts as though there aren't statistics out there that show obtaining a warrant is about as difficult as obeying the laws of thermodynamics. Wiretap warrants have been approved 99.969% of the time over the last decade. And that's for something far more intrusive than cell site location data.

But still, the government continues to argue that location data, while possibly intrusive, is simply Just Another Business Record -- records it is entitled to have thanks to the Third Party Doctrine. Any legal decision that suggests even the slightest expectation of privacy might have arisen over the past several years as the public's relationship with cell phones has shifted from "luxury item/business tool" to "even grandma has a smartphone" is greeted with reams of paper from the government, all of it metaphorically pounding on the table and shouting "BUSINESS RECORDS!"

When that fails, it pushes for the lower bar of the Stored Communications Act to be applied to its request, dropping it from "probable cause" to "specific and articulable facts." The Stored Communications Act is the lowest bar, seeing as it allows government agencies and law enforcement to access electronic communications older than 180 days without a warrant. It's interesting that the government would invoke this to defend the warrantless access to location metadata, seeing as the term "communications" is part of the law's title. This would seem to imply what's being sought is actual content -- something that normally requires a higher bar to obtain.

But the government never stops defending its normal M.O.: as much as possible with as little paperwork (and judicial oversight) as possible. Here it is responding to a letter sent by defendant Aaron Graham, who has been battling for suppression of 221 days worth of cell site location data (including nearly 30,000 specific data points) the government obtained without a warrant during its investigation of his involvement in a series of robberies.

Graham's letter cited the recent 11th Circuit Court ruling in the US v. Davis case, which found that the government violated the defendant's Fourth Amendment rights by obtaining mobile tracking data without a warrant. (Unfortunately, Davis was not awarded a retrial as the government demonstrated the warrantless collection was obtained "in good faith.") The government's response to this ruling (and its possibly favorable effect on the defendant) simply advises the Fourth Circuit Court that the 11th Circuit Court got everything wrong. (via Mike Scarcella)

In requiring a warrant to obtain cell-site records, however, the Eleventh Circuit erred. The Eleventh Circuit asserted that there is “a reasonable privacy interest in being near the home of a lover, or a dispensary of medication, or a place of worship,” 2014 WL 2599917 at *9-*10, but Fourth Amendment protection of information depends on how the government obtains information, rather than its nature.

So, rather than address the intricacies of the court's decision (that what used to be considered nothing more than "business records" are now very personal diaries of people's lives, thanks to the amount of data being gathered by cell providers), the government instead reiterates that it's entitled to warrantless access because it's always been entitled to warrantless access, technological advances and societal shifts be damned.

The government can obtain cell-site records with a 2703(d) order because they are business records stored at the provider’s discretion. See id. at 611-12. Bank records and dialed telephone numbers reveal far more sensitive, and far more particularized information than cell-site records, but no warrant is required to compel their disclosure.

Fair enough, but two things:

1) These "business records" are stored at the provider's discretion. Customers can't prevent the storage of certain records without forgoing service altogether. They also don't "reasonably" expect service providers to gather tons of data for law enforcement agencies to page through at their discretion. There's an expectation of privacy, albeit one that neither law enforcement nor service providers feel particularly compelled to address.

2) Shouldn't the question then be, why does law enforcement still have warrantless access to this "more sensitive" data, rather than, why doesn't law enforcement have more warrantless access?

Davis erred in distinguishing Miller and Smith by asserting that cell-site records are “not voluntarily disclosed.” 2014 WL 2599917 at *10. Smith assessed the information voluntarily disclosed from the standpoint of a well-informed customer, and cell phone companies inform customers that they collect location data.

The "well-informed customer" is hardly the average customer, and cell phone companies "disclose" plenty of info in pages and pages of fine print that no one ever reads. This shouldn't be taken to mean that customers are willingly generating a wealth of data for law enforcement to access at will. But the government reads all the fine print customers don't and chooses to believe every customer knows just how much info they're allowing law enforcement agencies to access without a warrant by simply turning on their cell phones. But the government's not done being disingenuous.

Moreover, when a business stores records at its discretion, it functions simply as a witness; the government may compel a witness to disclose records without a warrant regardless of whether the subject was aware the records were collected and stored.

This argument again tries to present the business collecting the records as the entity people should be directing their ire and astonishment at. If only these businesses didn't collect these records, then law enforcement wouldn't be able to access them. But much of what's collected is related to billing information, something these businesses don't collect voluntarily, but because it's essential to the business itself. People "consent" to this collection because the only way to opt out is to not use a phone. This hasn't been a practical option for several decades at this point. But the government continues to act as though people voluntarily generate evidence accessible without a warrant due to their insistence on using "optional" luxury devices. It's only very recently that the courts have started pushing back on this deliberately obtuse assertion, pointing out that circumstances have changed incredibly since the institution of the Third Party Doctrine, much less the Fourth Amendment itself.

Once again the question must be asked: what's so incredibly difficult about obtaining a warrant? In the case of Graham -- where over 200 days of cell site location data was acquired -- there obviously wasn't any timeframe concerns. And every law enforcement agency has built-in workarounds for exigent circumstances to be used in cases where time is of the essence. All of these arguments are the government aiming to maintain the status quo in the face of technological upheaval -- and with each passing day, the arguments seem a little more ignorant and petulant.

Filed Under: business records, law enforcement, mobile phones, privacy, third party doctrine, warrants

Looks Like Sprint Did Challenge FISC Order For Call Data, Asked If It Was Serious

from the um...are-you-for-real? dept

Last September, we noted that the FISA Court had finally released a heavily redacted version of its attempt to justify the NSA's use of Section 215 of the PATRIOT Act to sweep up phone records on every phone call. It's noteworthy that this was the first time that the FISC had ever bothered to actually detail why it believed the program was legal, despite approving such bulk collection orders for years. In that ruling last fall (which had been written last July), one of the things that FISC Judge Claire Eagan stated was:

To date, no holder of records who has received an Order to produce bulk telephony metadata has challenged the legality of such an Order. Indeed, no recipient of any Section 215 Order has challenged the legality of such an Order, despite the explicit statutory mechanism for doing so.

We found that to be fairly disappointing that no company had stepped up to challenge these orders. In fact, we noted just last month that an unnamed phone company was the first to challenge the records -- but it turns out that's not true. In fact, it turns out that what Eagan claimed in her ruling isn't true either.

In some newly declassified documents from the Director of National Intelligence, it's revealed that Sprint challenged the order, and basically forced the government to reveal the actual legal basis for the request. Sprint isn't named in the declassified legal filing, but people have confirmed that that's who it was.

The actual filing is a "Motion for Amended Secondary Order" from the DOJ, in which it's pretty clear that Sprint basically asked the government "are you fucking serious? you want us to hand over everything?" The motion from the DOJ is basically asking the FISA Court to repeat its original order with a legalese version of "yes, we're serious." As Julian Sanchez points out, it seems pretty clear that Sprint basically went back to the government and said could you repeat that, so that we actually know this is for real?

The Washington Post further claims that Sprint had a legal challenge drafted and ready to go, but was eventually persuaded by the DOJ and/or FISC not to go that far. Still, the idea that no one had questioned the legality of these orders doesn't appear to be accurate. Yes, we could have hoped that Sprint would have gone to greater lengths, but as we were just discussing this morning, the government puts immense pressure (often in the form of lies) on anyone who dares to challenge its ability to spy on everyone.

Filed Under: bulk collection, business records, fisa, fisc, nsa, phone records, section 215, surveillance
Companies: sprint

Eric Holder Admits That, If It Wanted, NSA Could Collect Internet Searches & Emails Just Like Phone Metadata

from the no-constitutional-issue-at-all dept

During a recent House Judiciary Committee hearing concerning oversight, Rep. Zoe Lofgren decided to quiz Attorney General Eric Holder about the federal government's surveillance efforts, starting off with a rather simple question. She notes that the bulk phone record collection program is considered to be legal by its supporters, based on Section 215 of the Patriot Act, which allows for the collection of "business records." So, she wonders, is there any legal distinction between phone records and, say, internet searches or emails? In other words, does the DOJ believe that it would be perfectly legal for the US government to scoop up all your search records and emails without a warrant? Holder clearly does not want to answer the question, and first tries to answer a different question, concerning the bulk phone records program, and how the administration is supposedly committed to ending it. But eventually he's forced to admit that there's no legal distinction: This is important. As you may recall, some of the attempts to deal with the phone record collection, including President Obama's, focus only on ending the specific phone record collection program, not the underlying law (or the interpretation of that law). This isn't to say that there are ongoing programs to do bulk warrantless collection of those other types of information, but it is worth recognizing that the government believes there would be no Constitutional issue if it decided to set up such a program.

All along, this has been the problem with Section 215. When it first was discussed, it was often called the "library" provision, as the example that people talked about was using Section 215 to collect the records of what books someone checked out of the library. However, as the phone collection program showed, it's been turned into something much, much broader. Fixing this interpretation is going to take a lot more than just ending one program. It requires changing what is allowed by Section 215.

Filed Under: 4th amendment, business records, emails, eric holder, internet searches, nsa, section 215, surveillance, warrants, zoe lofgren

Mike Rogers' Plan To 'Stop' Bulk Collection Of Phone Records Riddled With Dangerous Loopholes That Will Expand Surveillance

from the but-of-course dept

Now that people have had a chance to go through the proposal by Reps. Mike Rogers and Dutch Ruppersberger to "stop" the bulk phone record collection under Section 215 of the Patriot Act, they're finding more and more things to be concerned about. We had noted some potential easter eggs in there for law enforcement, but the deeper people look, the worse it gets. Trevor Timm notes that the bill is really a trojan horse to expand surveillance capabilities, while pretending to end them.

Curiously, a large majority of the House bill focuses on new ways for the government to collect data from "electronic communications service providers" – also known as the internet companies. Why is a bill that's supposedly about ending bulk collection of phone-call data focused on more collection of data from internet companies?

From there, we turn to Julian Sanchez, who has given one of the most thorough explanations of what's actually in the bill, noting that it fails to really end the bulk collection of phone records while also potentially massively expanding other surveillance capabilities.

First, the HPSCI bill’s seemingly broad prohibition on bulk collection turns out to be riddled with ambiguities and potential loopholes. The fuzzy definition of “specific identifiers” leaves the door open to collection that’s extremely broad even if not completely indiscriminate. Because the provision dealing with “call detail records” applies only to &sect:215 and the provision dealing with “electronic communications records” excludes telephony records, the law does not bar the bulk collection of telephony records under FISA provisions other than §215. The prohibition on non-specific acquisition of other communications “records” probably does not preclude bulk collection under the FISA pen register provision that was previously used for the NSA Internet metadata dragnet. And, of course, none of these prohibitions apply to National Security Letters. If the government wanted to keep collecting metadata in bulk, it would have plenty of ways to do so within the parameters of this statute given a modicum of creative lawyering—at least if the FISC were to continue being as accommodating as it has been in the past.

Second, something like the novel authority created here may well be necessary to enable fast and flexible acquisition of targeted records without dragnet collection. However, once we get down to details—and even leaving aside the question of ex-post versus ex-ante judicial approval—this authority is in some respects broader than either the current §215 telephony program, the president’s proposal, or the pre-Snowden understanding of the FISA business records authority. Critically, it eliminates the required link to a predicated investigation—which, in the case of U.S. persons, must be for counterterror or counterespionage purposes.

In other words, this appears to be a superficial attempt to end bulk collection "under this program," while at the same time knocking down a bunch of barriers to much broader bulk collection under other authorities, with less oversight and fewer ways to push back against abuse. Did anyone really expect anything different from the NSA's two biggest defenders in the House?

Filed Under: bulk collection, business records, dutch ruppersberger, mike rogers, nsa, section 215, surveillance, trojan horse

Almost Everything About The Bulk Collection Of Phone Data Is Illegal

from the a-simple-explanation dept

We already wrote about the Privacy and Civil Liberties Oversight Board (PCLOB) and its scathing report as to how the program to collect phone records on pretty much every phone call in the US was both illegal and unconstitutional. However, if you don't want to get too down in the weeds over why it's illegal, the absolutely best summary I've seen comes from Julian Sanchez and fits into a tweet:

215 allows FBI to get records relevant to an investigation. PCLOB: NSA program fails on "FBI", "records," "relevant" & "investigation."

— Julian Sanchez (@normative) January 23, 2014

In case you can't read that, it says:

215 allows FBI to get records relevant to an investigation. PCLOB: NSA program fails on "FBI", "records," "relevant" & "investigation."

Believe it or not, he's not even being that glib here. Section 215 is pretty clear on all of those things. It's just for the FBI, and allows them to get records relevant to a specific investigation. Yet, the program is run by the NSA, which collects the data, instead of the FBI. It is not collecting "records" as intended by the law, and most of those records are irrelevant, and none of this is tied to any particular investigation. I'm reminded of the joke that the Holy Roman Empire wasn't actually holy, Roman or an empire.

When the law includes four basic conditions, and basically all four of them are not met, the program is beyond illegal. It's just a farce. It's kind of amazing that President Obama and other NSA defenders are still arguing that the program is perfectly fine.

Filed Under: bulk metadata collection, business records, fbi, julian sanchez, nsa, pclob, section 215, surveillance