Pentagon Issues First Update To Domestic Surveillance Guidelines In 35 Years, Not All Of It Good

from the fixes-need-fixing dept

Cody Poplin at Lawfare points out that the Defense Department has just issued an update on rules governing its intelligence collection activities -- the first major update in over 30 years. These would directly affect the NSA, which operates under the Defense Department.

The most significant alteration appears to be to retention periods for US persons data. While everything is still assumed to be lawful under Executive Order 12333 and DoD Directive 5240.1, the point at which a record is deemed to be "collected" -- starting the clock on the retention period -- has changed.

Under the new rules, “collection” occurs “upon receipt,” whereas the previous manual defined “collection” as occurring when the information was “officially accept[ed] … for use.” The change ensures that all protections governing even the incidental collection of U.S. personal information (USPI) applies upon receipt of that information. The clock starts to run as soon as information is collected, meaning that collected information must be promptly evaluated to determine the proper retention period.

This should result in better minimization of incidentally-collected US persons info as the determination must be made shortly after harvesting, rather than waiting until the collected data is queried. This likely means the NSA may be making more efforts to head off incidental collection, as leaving things the way they are will now result in additional logistics headaches.

This doesn't necessarily mean incidentally-collected info will be swiftly disposed of. The DoD can still hold onto this data for five years. And, if the target of the incidental collection leaves the country during that retention period, the DoD can hold onto the data for a quarter-century.

Info on US persons/entities (still located in the US) is also being granted additional protections, including enhanced minimization procedures for dissemination of collected data to other agencies and other countries.

The NSA will also be expected to make additional trips to the FISA court.

[T]he new manual incorporates new physical search rules that reflect changes to the Foreign Intelligence Surveillance Act since 1982. These include requirements to obtain a FISA warrant for nonconsensual physical searches conducted inside the United States and for targeted collection of U.S. person information outside the United States.

Most of this appears to be changes for the better -- something that likely wouldn't have occurred without Snowden's leaked documents. The last change to these rules was made back in 1982 when no one had any idea the wealth of communications content and data that would be travelling around the globe in digital form.

But a closer look at the details -- especially the part pertaining to "special circumstances" that alter the rules of collection and retention -- suggests there still may be a few exploitable loopholes that would allow the NSA to target US persons and entities.

If DoD agencies wish to target a US person (whether at home or abroad), they're instructed to use the "least intrusive" method of surveillance: public sources. If the information sought can't be found there, the next step is to seek cooperation from other sources that may have the same info. This is basically a consensual search, but involving third parties. The last step is to seek top-level approval from the DoD's general counsel. This will provide some additional oversight, but still makes it a mostly "in-house" process -- something that's not exactly comforting.

The additional restrictions on the collection of US persons in the US seem to limit potential abuse/misuse of surveillance tools.

Other specific limitations apply to collection of USPI inside the United States, including that the information may be collected only if 1) the information is publicly available or 2) the source of the information is advised or otherwise aware that he or she is providing the information.

But the list of exceptions to these limitations appears to directly remove these two stipulations.

In the event that neither or the two previous requirements are met, the Defense Intelligence Component may employ collection methods that are directed at the United States if a) the foreign intelligence is significant and the collection is not undertaken for the purpose of acquiring information about a U.S. person’s domestic activities; b) the intelligence cannot be obtained publicly or from sources who are advised they are providing information to the DoD; or c) the Defense Intelligence Component head concerned or a single delegee has approved as being consistent with the manual and its outlined procedures the use of techniques other than the collection of publicly available information or from an informed source.

Reading these both together suggests that if the DoD can't obtain the info it's seeking from public/advised sources, it can use that limitation as a reason to deploy supposedly foreign-facing surveillance methods against US persons. If that's the correct reading (and the "or" -- rather than an "and" -- in the list of requirements suggests it is), the limitations on domestic surveillance are mostly meaningless.

Filed Under: collection, defense department, incidental collection, nsa, privacy, surveillance

DOJ Apologizes For Misleading FISC Concerning Evidence; Hints Strongly That It Used Opportunity To Destroy Evidence

from the evidence,-who-needs-it? dept

A few weeks ago, we noted that FISC Judge Reggie Walton was quite reasonably pissed off at the DOJ for directly withholding key information about evidence in a series of lawsuits concerning NSA surveillance programs. The full details are a bit down in the weeds, but the short summary is that there's been some debate over whether or not the government needs to retain surveillance data because it's evidence in these cases, or if it needs to destroy the surveillance data, as required by the rules over its holding of the data. There's been a bit of back and forth over all of this, but the DOJ apparently directly withheld from the FISC a request by EFF lawyers to inform the court that a data preservation order should cover two of the key NSA surveillance cases that it has been involved in for years (since well before the Snowden disclosures). The DOJ not only did not inform the court, but it also appears to have tried to dissuade the lawyers from raising the issue. Judge Walton ordered the DOJ to explain itself, and it gives a long apology, repeatedly insisting that it didn't believe those cases were related, since they were focused on surveillance data ordered by the President, rather than the FISA Court -- a weak excuse at best:

Based upon the nature of the claims made in Jewel and Shubert, which the Government has always understood to be limited to certain presidentially authorized intelligence collection activities outside FISA, the Government did not identify those lawsuits, nor the preservation orders issued therein, in its Motion for Second Amendment to Primary Order filed in the above- captioned Docket number on February 25, 2014. For the same reasons, the Government did not notify this Court of its receipt of plaintiffs' counsel's February 26, 2014, e-mail. With the benefit of hindsight, the Government recognizes that upon receipt of plaintiffs' counsel's e-mail, it should have made this Court aware of those preservation orders and of the plaintiffs' disagreement as to their scope as relevant to the Court's consideration of the Government's motion and regrets its omission. The Government respectfully submits that in light of this submission, and this Court's Opinion and Order dated March 12, 2014, granting the Government's motion for temporary relief from the destruction requirement in subsection of the Court's Primary Order, no additional corrective action on the part of the Government or this Court is necessary.

It goes on for much longer trying to suggest that this was all just an honest mistake, and how could it have possibly realized that the lawyers for the plaintiffs in those cases might think the issue of preserving their evidence was related to similar questions over preserving evidence of other NSA cases. It insists that it really was just focused on the more recent cases that were filed post-Snowden ("filed after last year's unauthorized public disclosure concerning the collection of telephony metadata pursuant to FISA authority") and hadn't even considered how it related to older cases concerning NSA surveillance.

The Government did not notify the Court of Jewel and Shubert in the Motion because the Government has always understood those matters to challenge certain presidentially authorized intelligence collection activities and not metadata subsequently obtained pursuant to orders issued by this Court under FISA, and because the preservation issues in those cases had been previously addressed before the district court in which those matters are pending. Jewel and Shubert, filed in 2008 and 2007, respectively, challenge particular NSA intelligence activities authorized by President Bush after the September 11, 2001 terrorist attacks without statutory or judicial authorization.

As the DOJ goes on to explain, it assumed the preservation issues in the Jewel and Shubert cases were settled, and therefore irrelevant to the FISA issue (especially since, in its mind, the two sets of cases covered different programs). Thus, the DOJ claims, its emails dissuading the lawyers from raising the issue weren't so much about silencing those lawyers and hiding information from FISC, but were a true misunderstanding, in that it was just letting those lawyers know the issues were unrelated, as well as a desire (no joke) to not bother the FISC with unnecessary distractions.

In particular, the request in its February 28 email that counsel for the Jewel plaintiffs "forebear from filing anything with the FISC, or [the district court], until we have further opportunity to confer" was a good faith attempt to avoid unnecessary motions practice in the event that the issue could be worked out among the parties through the Government's provision of an unclassified explanation concerning its preservation in Jewel and Shubert. Accordingly, the Government did not bring the Jewel plaintiffs' February 25 email to this Court's attention.

Of course, there's still the big question of, between the two FISA court orders, whether or not the DOJ did, in fact, destroy some of the evidence. And, a follow-up correction from the government very strongly suggests that it absolutely did use the opportunity to destroy evidence. The follow-up is a correction to a footnote, in which the DOJ makes it clear that "consistent with the Government's understanding" (which appears to be mistaken) and "prior to" the more recent filing, "the Government complied with this Court's requirements that metadata obtained by the NSA under Section 215 authority be destroyed no later than five years after their collection."

What that almost certainly means is that the NSA destroyed the metadata collected up until 2009, which likely is relevant to the Jewel and Schubert cases, even though the lawyers in those cases had alerted the DOJ of these concerns. For all of the DOJ's "apologies" in the first document, this certainly seems very convenient for the US government. And, as Marcy Wheeler notes, the destroyed evidence may have included "cover almost all of the phone dragnet violations discovered over the course of 2009." Convenient. But the DOJ is really, really sorry about it. Really.

Filed Under: collection, destruction of evidence, doj, fisa court, fisc, jewel, metadata, nsa, preservation, reggie walton, shubert, surveillance
Companies: eff

Democratic Leadership Says NSA Data Collection Is Fine Because You 'May Be In Communication With Terrorists'

from the seriously? dept

One of the things that became quite clear with yesterday's vote by the House to keep the NSA collecting records on every single one of your phone calls was the strange bedfellows that came together over this issue. Fighting against the surveillance were conservatives who were skeptical about government power along with liberals who were skeptical of government overreach into private lives. On the flip side, you had the White House and the leadership of both parties -- who tend to lean more towards supporting excessive power in the executive branch (perhaps because of their own dreams of being able to control that power). It's not often you see Michele Bachmann and Nancy Pelosi agreeing on very much.

Over at the Huffington Post, there's a good article about these odd pairings, noting the oddity of Bachmann endorsing the "identical" position as the Obama administration. But the really stunning point is at the end of the article, where it mentions that Steny Hoyer, the Democratic whip, who's in charge of gathering up the votes on the Democratic side, and who apparently was working overtime to convince Democrats to vote in favor of ignoring the 4th Amendment, sent the most bizarre "description" of the amendment. While that only has a clip, a friend sent over the full "description" sent by Steny Hoyer to all of the Democrats in the House:

Amash/Conyers/Mulvaney/Polis/Massie Amendment – Bars the NSA and other agencies from using Section 215 of the Patriot Act (as codified by Section 501 of FISA) to collect records, including telephone call records, that pertain to persons who may be in communication with terrorist groups but are not already subject to an investigation under Section 215

Talk about misleading. The program pertains to everyone. At this point, it's no secret that the records collected under this authority include a record of every single phone call. This is not about collecting records of people talking to terrorists. It's about collecting records on everyone. So, the only rational deciphering of Hoyer's email is that he believes that every American "may be in communication with terrorist groups" and therefore it's okay to spy on them.

How do these people get elected?

Filed Under: business records, collection, democrats, metadata, nsa, nsa surveillance, section 215, steny hoyer, terrorists