Intelligence Director Says Gov't Can Demand Encryption Backdoors Without Having To Run It By The FISA Court

from the keeping-secrets-from-the-secret-court dept

A set of questions from Senator Ron Wyden -- directed at the Office of the Director of National Intelligence -- have finally received answers. The answers [PDF] were actually given to the Senate oversight committee in July but have just now been made public.

Zack Whittaker of ZDNet has taken a look at the answers the ODNI provided and found something that indicates the government can not only compel the creation of backdoors, but can do so without explicit approval from the FISA court.

The government made its remarks in July in response to questions posed by Sen. Ron Wyden (D-OR), but they were only made public this weekend.

The implication is that the government can use its legal authority to secretly ask a US-based company for technical assistance, such as building an encryption backdoor into a product, but can petition the Foreign Intelligence Surveillance Court (FISC) to compel the company if it refuses.

In its answers, the government said it has "not to date" needed to ask the FISC to issue an order to compel a company to backdoor or weaken its encryption.

The government would not say, however, if it's ever asked a company to add an encryption backdoor.

The way this process works is the agency requesting the backdoor or other compelled assistance runs the request by the FISA court. This process does not ask the FISA court to approve the method used, nor does it provide the court with details on the assistance sought. All the FISC determines is whether or not compelled assistance is necessary.

The ODNI maintains it has never asked for compelled decryption or the installation of backdoors… at least not under this authority. If it has, there'd be little in the way of a paper trail to prove it. The FBI, as part of the Intelligence Community, appears to be more interested in securing the help of US courts -- something that would prove far more useful in the long run, considering its domestic focus.

This information comes at a critical time. The surveillance wing of the government wants Section 702 (and related authorities) renewed at the end of this year -- unaltered and with at least a half-decade before the next chance of reform. So far, its two Congressional oversight bodies have been compliant with the IC's wishes. Serious reform efforts have been dumped by both House and Senate judiciary committees, leaving only those authored by longtime surveillance state cheerleaders in the running. With limited oversight and an easy way to route around FISA roadblocks, Section 702 reform is badly needed if we have any hope of the next decade being less filled with Fourth Amendment violations than the last one.

Filed Under: backdoors, compelled assistance, encryption, fisa court, fisc, odni, ron wyden

Wyden's Reform Bill Would Also Deter Misuse Of NSA Powers To Compel Tech Company Assistance

from the not-just-backdoors dept

Sen. Ron Wyden is again raising concerns about NSA tactics, this time through his recently-submitted Section 702 reform bill. The USA RIGHTS Act contains a number of improvements, including addressing backdoor searches of NSA data by federal agencies and increasing the reporting requirements for access of US persons communications and data. It also permabans the NSA's "about" collection -- one it shut down voluntarily after years of misuse but recently expressed an interest in restarting.

There's another form of surveillance being eyed by Wyden's bill: technical assistance. Marcy Wheeler points out some of the limitations imposed by the bill, which appear to target compelled assistance by tech companies.

(B) LIMITATIONS.—The Attorney General or the Director of National Intelligence may not request assistance from an electronic communication service provider under subparagraph (A) without demonstrating, to the satisfaction of the Court, that the assistance sought—

(i) is necessary;

(ii) is narrowly tailored to the surveillance at issue; and

(iii) would not pose an undue burden on the electronic communication service provider or its customers who are not an intended target of the surveillance.

This could refer to FISA-enabled pressure to backdoor encryption or allow the NSA to otherwise compromise hardware and software. And it may be Wyden's way of sending out a heads up to the general public.

This suggests that Wyden is concerned the government might use — or has used — FISA to make sweeping onerous technical demands of companies without explicitly explaining what those demands are to the Court.

No one should be surprised the government is -- or intends to -- use the FISA court to compel compliance. This is another tool it has at its disposal, going hand-in-hand with All Writs orders to cover government requests not explicitly allowed by existing law. As we saw in the government's most famous All Writs case -- its legal battle with Apple over the contents of the San Bernardino shooter's iPhone -- these expansive orders predicated on a 1789 law still have their limits. As more companies fight back against government overreach, the NSA will need to keep its options open if it hopes to compel compliance.

But if it's going to do this, it needs to be on the record. This is what Wyden's bill would do: force the NSA (and other IC agencies) to detail their plans for compelled assistance and seek explicit approval for these actions from the court.

Filed Under: all writs act, compelled assistance, nsa, ron wyden, surveillance, usa rights act