CIA To FOIA Requester: Assassination Attempts Are Illegal So Of Course We Don't Have Any Records About Our Illegal Assassination Attempts

from the heads-up,-cops:-excessive-force-is-illegal-so-we-have-never-deployed-excessive-f dept

The CIA has delivered a rather curious response to a records requester. J.M. Porup sent a FOIA request to the agency asking it for documents about its rather well-documented assassination attempts and received a very curious non-answer from the US's foremost spooks.

The CIA’s response to the question about assassinations wasn’t a denial that it had engaged in such activity. It just explained that such activity is illegal: “Please refer to Executive Order 12333 which describes the conduct of intelligence activities, citation 2.11, which pertains to the prohibition on assassinations,” the brief response from the CIA read.

No Glomar. No "no records found." No complaints that the request was too burdensome. No invocation of national security exemptions. Just this, which basically says, "Hey guys, assassination is illegal." And, of course, it is. But that hasn't stopped the CIA from engaging in assassination attempts.

The Church Committee exposed this (along with a long list of other violations by government agencies) back in the 1970s. In fact, one of the smoking gun moments of the Church Committee hearings was the production of a non-smoking poison dart gun developed by the CIA. And, as Matthew Gault points out for Vice, the CIA spent years trying to make a Fidel Castro death look like an accident.

The Agency attempted to lace Castro’s shoes with thallium salts in an attempt to make his hair fall out, developed a special hallucinogen it planned to spray on him during a live broadcast, and created a pen that concealed a hypodermic needle full of poison it planned to use against Castro.

And that's just assassination attempts targeting this particular politician. The CIA has global reach and endless potential. That it has been mostly ineffective is beside the point. The CIA has created records detailing its assassination attempts. Citing an Executive Order forbidding government employees from engaging in assassination attempts is a non-starter, especially when there's already documentation in the (regular) history books.

Now, if we want to grant the CIA more credibility than it actually deserves, we can read this Executive Order citation as a barely coded message: of course the CIA doesn't have records pertaining to assassination attempts because what government agency in its right mind would do anything with inculpatory documents other than feed them to the nearest shredder? That's the best case scenario: the CIA has been illegally destroying documents detailing its illegal activities.

The worst case scenario is the CIA has plenty of documents on hand but is choosing to hide behind an Executive Order that forbids the things the CIA has already done and, may in fact still be doing.

The answer is, of course, fuck right off with this. J.M. Porup will be suing the CIA over these documents, which will at least force it to drop its Executive Order pretense and engage this request a bit more honestly. At that point, it will have access to a bunch of (slightly more legitimate) FOIA exemptions. But until it's willing to address this more honestly, it can't expect "well, no, that would be illegal" to be a satisfactory answer. Courts aren't going to be receptive to this particular strain of bullshit, even if they've been willing to grant a whole lot of leeway on the national security front historically.

Filed Under: assassinations, cia, executive order 12333, foia, transparency

Top EU Data Protection Body Asks US To Fix Problems Of 'Privacy Shield' Or Expect A Referral To Region's Highest Court

from the please-don't-make-us-do-this dept

The Privacy Shield framework is key to allowing personal data to flow legally across the Atlantic from the EU to the US. As we've noted several times this year, there are a number of reasons to think that the EU's highest court, the Court of Justice of the European Union (CJEU), could reject Privacy Shield just as it threw out its predecessor, the Safe Harbor agreement. An obscure but influential advisory group of EU data protection officials has just issued its first annual review of Privacy Shield (pdf). Despite its polite, bureaucratic language, it's clear that the privacy experts are not happy with the lack of progress in dealing with problems pointed out by them previously. As the "Article 29 Data Protection Working Party" -- the WP29 for short -- explains:

Based on the concerns elaborated in its previous opinions ... the WP29 focused on the assessment of both the commercial aspects of the Privacy Shield and on the government access to personal data transferred from the EU for the purposes of Law Enforcement and National Security, including the legal remedies available to EU citizens. The WP29, assessed whether these concerns have been solved and also whether the safeguards provided under the EU-U.S. Privacy Shield are workable and effective.

As far as the commercial aspects of Privacy Shield are concerned, the WP29 is unhappy about a number of important "unresolved" issues such as "the lack of guidance and clear information on, for example, the principles of the Privacy Shield, on onward transfers [of personal data] and on the rights and available recourse and remedies for data subjects." The issue of US government access to the personal data of EU citizens is even thornier. Although the WP29 welcomed efforts by the US government to become more "transparent on their use of their surveillance powers", the collection of and access to personal data for national security purposes under both section 702 of FISA and Executive Order 12333 were still a problem. On the former, WP29 suggests:

Instead of authorizing surveillance programs, section 702 should provide for precise targeting, along with the use of the criteria such as that of "reasonable suspicion", to determine whether an individual or a group should be a target of surveillance, subject to stricter scrutiny of individual targets by an independent authority ex-ante.

As regards the Executive Order 12333, WP29 wants the Privacy and Civil Liberties Oversight Board (PCLOB) "to finish and issue its awaited report on EO 12333 to provide information on the concrete operation of this Executive Order and on its necessity and proportionality with regard to interferences brought to data protection in this context." That's likely to be a bit tricky, because the PCLOB is understaffed due to unfilled vacancies, and possibly moribund. In conclusion, the WP29 "acknowledges the progress of the Privacy Shield in comparison with the invalidated Safe Harbor Decision", but underlines that the EU group has "identified a number of significant concerns that need to be addressed by both the [European] Commission and the U.S. authorities." It spells out what will happen if they aren't sorted out:

In case no remedy is brought to the concerns of the WP29 in the given time frames, the members of WP29 will take appropriate action, including bringing the Privacy Shield Adequacy decision to national courts for them to make a reference to the CJEU for a preliminary ruling.

That is, it will ask the EU's highest court to rule on the so-called "adequacy decision" of the European Commission, where it decided that Privacy Shield offered enough protection for EU personal data moving to the US. There's a clear implication that WP29 doubts the CJEU's ruling will be favorable unless all the changes it has requested are made soon. And without the Privacy Shield framework, it will be much harder to transfer personal data legally across the Atlantic. Moreover, the EU's data protection laws are about to become even more stringent next year, when the new General Data Protection Regulation (GDPR) is enforced. Organizations in breach of the GDPR can be fined up to 4% of annual global turnover, which means even the biggest Internet companies will have a strong incentive to comply.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: eu, executive order 12333, privacy, privacy shield, safe harbor, section 702, surveillance

New Evidence Shows Defense Dep't Abusing Surveillance Procedures To Spy On Americans

from the even-more-evidence dept

I know that the cynical among you already assume -- falsely -- that the surveillance state ignores all rules and spies willy nilly on everyone. That is not true. However, they do have a long and scary history of "reinterpreting" or stretching the definitions of things to do widespread surveillance in ways that clearly violate the letter and spirit of the law, even as they try to justify it. For many years now, we've written about concerns with Executive Order 12333 -- a Reagan-signed Executive Order that enabled much greater surveillance oversees. In the summer of 2014, State Department whistleblower Stephen Napier Tye revealed that everyone focusing on other programs -- such as Section 215 under the PATRIOT Act or Section 702 under the FISA Amendments Act -- were missing the point: nearly everything was being done under EO 12333, and those other programs were just used to fill in the gaps. Here's what he said at the time:

Executive Order 12333 contains nothing to prevent the NSA from collecting and storing all such communications — content as well as metadata — provided that such collection occurs outside the United States in the course of a lawful foreign intelligence investigation. No warrant or court approval is required, and such collection never need be reported to Congress. None of the reforms that Obama announced earlier this year will affect such collection.

Without any legal barriers to such collection, U.S. persons must increasingly rely on the affected companies to implement security measures to keep their communications private. The executive order does not require the NSA to notify or obtain consent of a company before collecting its users’ data.

Tye says that he filed an internal complaint with the State Department's Inspector General (and with the NSA's Inspector General), noting that collecting information on Americans via 12333 (again, which has no oversight in Congress) violated the 4th Amendment. Note that nothing appears to have happened because of this. The Privacy and Civil Liberties Oversight Board (PCLOB) targeted 12333 for investigation soon after Tye's revelations, but no report was ever produced. The PCLOB is effectively dead for now, and with it, everything it had researched on 12333. Notably, the surveillance state supporters in Congress last year tried to kneecap the PCLOB to stop it from investigating 12333 (that effort failed, but with the PCLOB on life support it may not matter).

Just a few months ago, Senator Ron Wyden put out another Wyden Siren, asking the intelligence community to state how many Americans had been targeted under 12333. As per usual, when Wyden sends such a letter, a big part of it is alerting the American public to the fact that the intelligence community is up to no good and trying to hide it. Wyden's letter certainly suggested that 12333 was being widely abused to spy on Americans, despite its supposed focus on surveillance overseas.

And now, Human Rights Watch has released some documents, obtained via a FOIA request, showing that the Defense Department modified its policy to allow using 12333 to spy on Americans without a warrant, so long as the US government designated them as "homegrown violent extremists" -- whatever that means.

Newly released documents reveal a US Defense Department policy that appears to authorize warrantless monitoring of US citizens and green-card holders whom the executive branch regards as “homegrown violent extremists,” Human Rights Watch said today. Separately, the documents also reinforce concerns that the government may be gathering very large amounts of data about US citizens and others without warrants. Both issues relate to a longstanding executive order that is shrouded in secrecy and should be a focus of congressional inquiry.

Now, some people may argue that if we're talking about "violent extremists" (homegrown or not), we should be surveilling them. And perhaps you're correct -- but it's hard to see why law enforcement can't obey the 4th Amendment and get a freaking warrant out in such cases. Human Rights Watch details the policy changes and the problems associated with it here:

One of the documents indicates that pursuant to a 2016 change in procedures concerning Executive Order 12333, the Defense Department may now extend the monitoring of US persons for “counterintelligence” purposes to people the government regards as “HVEs,” which a senior Defense Department official consulted by Human Rights Watch confirmed means “homegrown violent extremists.” The official indicated that the term is “shorthand … used in the counterintelligence community to describe people who may not have a specific connection to a particular foreign terrorist group but are engaged in violent extremist activities, often following engagement with these groups’ propaganda on the Internet or social media, etc.”

The procedures themselves do not directly mention such “homegrown violent extremists,” instead providing in more general terms that the monitoring of US persons for “counterintelligence” purposes may extend to “[a]n individual, organization, or group reasonably believed to be acting for, or in furtherance of, the goals or objectives of an international terrorist or international terrorist organization, for purposes harmful to the national security of the United States.”

In indicating that this category includes “HVEs,” the training document depicts this expansion of the “counterintelligence” collection definition as a “[k]ey” change in the new procedures. The document indicates that the change allows the collection of intelligence on US persons even in the absence of a “specific connection to foreign terrorist(s).” As examples, it alludes to the individuals who carried out mass shootings in San Bernardino, California in 2015, and in Orlando, Florida in 2016.

The Defense Department’s methods and criteria for identifying “homegrown violent extremists” remain unclear, raising fears that the designation could be applied in ways that are arbitrary, inconsistent, or discriminatory. It is also unknown whether US persons who merely exercise their free-expression rights by visiting a controversial website, espousing certain political or religious views, or criticizing the government might be targeted.

The government also has not yet disclosed its legal justification for this policy, especially insofar as it involves any warrantless monitoring of US persons that would normally require a warrant under the Foreign Intelligence Surveillance Act, other statutes, or Fourth Amendment case law. The government should fully disclose the policy, its legal underpinnings, the type(s) of monitoring to which it may lead, and its anticipated and actual application.

As you can see in the released documents, the "counterintelligence exception" has been "expanded" to cover those "homegrown violent extremists" and cites San Bernardino and Orlando as an excuse for this. Note how our surveillance policies apparently changed without any public discussion or debate and via a program that has no direct Congressional oversight. And, on top of that, on an issue that clearly has direct Constitutional issues. It's no secret that the NSA and others will push and stretch interpretations to increase surveillance activities, but here's a case where it seems like they are blatantly trying to skate by while ignoring that the 4th Amendment even exists.

Filed Under: americans, domestic surveillance, eo 12333, executive order 12333, homegrown violent extremists, surveillance

Senator Wyden Wants To Know How Many Times Americans Have Been Targeted By Executive Order 12333

from the am-I-free-to-know-am-I-free-to-know-am-I-free-to-know-am-I-free-to-know-am-I-fre dept

That buzzing noise that never seems to leave the Intelligence Community's ears is Sen. Ron Wyden. Wyden's questions -- often unanswered -- are dog whistles for privacy advocates but ear-bleeding tinnitus for agency officials. Persistence is key in Congressional oversight and few are better at it than Wyden is.

For years, Wyden has been asking how many Americans have been hauled in by the NSA's Section 702 dragnet. And for years, the NSA and ODNI have sidestepped the question. The surveillance bosses got close to returning an answer -- right before they announced they were shutting down the collection that netted the most Americans.

Right before Trump was elected, James Clapper finally said he'd cough up the numbers. But with the regime change, the promise is no longer a promise. The NSA may try to keep this buried, using time and distance from the abruptly-abandoned "about" collection to stiff-arm additional requests for domestic surveillance data.

Ever persistent, Wyden has returned with another set of questions [PDF] regarding NSA surveillance. This one pertains to the least-discussed surveillance authorization and the one almost everyone -- including members of oversight committees -- knows nearly nothing about: Executive Order 12333.

Like Section 702, there's a good probability intelligence gathered under this authority is being used by domestic agencies. Backdoor searches of NSA intel have been unofficial common knowledge for years now, so there's very little reason to believe the NSA's most mysterious authority doesn't have its own built-in peepholes for the FBI and other federal agencies.

Wyden is asking for details on this authority, specifically the number of times it has been used to surveil Americans. As he points out, the order allows the deliberate targeting of American citizens with the Attorney General's approval.

Please provide the following information:

1. How many times, in each of the calendar years 2011-2016, has the Attorney General provided this approval?

2. Can the Intelligence Community conduct these searches "for the purpose of targeting a US. person or a person in the United States" without an individual warrant?

3. What limitations and approval requirements would apply to searches for communications that are reasonably likely to be to, from, or about a US. person or a person located in the United States if the purpose of the search is not to "target" that person?

That's the "what." Here's the "why:"

Concerns about warrantless "backdoor" searches for information about Americans are among the reasons I have repeatedly asked the Intelligence Community to publish an estimate of the number of Americans whose communications have been collected under Section 702 of the Foreign Intelligence Surveillance Act (FISA). Concerns about these searches under Section 702 are also why the Intelligence Community now publishes data on the number of these searches, with the notable exception of searches conducted by the FBI.

Executive Order 12333 poses similar, if not greater concerns, given the lack of public awareness of the breadth of that collection, extremely limited oversight, and the vagueness of the procedures governing collection and use. For these reasons, I believe the public has the right both to clarity with regard to those procedures and data related to the frequency with which Americans and individuals in the United States are the subject of these searches.

No sense holding your breath. As much as I appreciate Wyden's effort, the current administration firmly believes surveillance might makes right. The Intelligence Community has been so emboldened by the administration's lack of concern for civil liberties it's already asked to have the "about" collection -- which it shut down voluntarily so it could finally get 702 orders approved by the FISA court -- turned back on.

If any answers do appear, expect them to be vague and deliberately uninteresting. But at this point, it's probably less disappointing to just not expect them at all.

Filed Under: domestic surveillance, eo 12333, executive order 12333, nsa, odni, ron wyden, surveillance

Rep. Devin Nunes' Hypocrisy On Display In 'Concerns' Over NSA Surveillance

from the let's-try-this-again... dept

We've talked about the astounding hypocrisy of Rep. Devin Nunes a few times in the past. He heads the House Intelligence Committee, which is supposed to be conducting "oversight" of the intelligence community, but has generally been a cheerleader for mass surveillance in recent years. Nunes, in fact, has regularly slammed any attempt to cut back on surveillance, to the point of actively misleading the public in making false claims about how NSA surveillance programs work. The hypocrisy became clear when Nunes flipped out following the firing/resignation of Mike Flynn as National Security Advisor, arguing that it was somehow unprecedented that an American's phone calls with Russian officials were recorded by the intelligence community. Of course, that suggests either near total ignorance of the programs he's supposedly in charge of overseeing, or just blatant political pandering.

And now it's getting worse. Reporter Katie Bo Williams got her hands on an interesting letter that Nunes, along with ranking member Rep. Adam Schiff, just sent to the heads of the CIA, NSA and FBI, continuing to dig in on the whole "recorded Mike Flynn" thing. The target now is Executive Order 12333, which we've spoken about quite a lot. That's the executive order signed by President Reagan, that more or less gives the intelligence community total free rein in conducting surveillance overseas. As an ex-State Department official revealed back in 2014, the vast majority of NSA surveillance actually is done under 12333, and it just uses other programs -- like Section 215 of the PATRIOT Act and Section 702 of the FISA Amendments Act -- to fill in the gaps of what they can't get via 12333. Executive Order 12333, for example, was used to hack into Yahoo and Google's servers overseas, allowing the NSA to scoop up lots of info without any oversight by US courts.

Anyway, based on the letter that Nunes has sent, he's suddenly quite concerned about 12333. And this demonstrates his massive hypocrisy, because another letter he sent a few years ago has him arguing that there should be less oversight on 12333... but we'll get to that. This new letter suggests that the Flynn recording came under 12333, and so he's demanding all sorts of data on how 12333 is used on US Persons.

Of course, what's interesting here is that the Congressional intelligence committees have long stated that they don't really have much oversight into anything under 12333. Dianne Feinstein (who was a top member of the Senate Intelligence Committee) admitted in the past that the committees get zero insight into 12333 intelligence collection:

“The other programs do not (have the same oversight as FISA). And that’s what we need to take a look at,” she said, adding that her committee has not been able to “sufficiently” oversee the programs run under the executive order. “Twelve-triple-three programs are under the executive branch entirely.”

Feinstein has also said the order has few, if any, privacy protections. “I don’t think privacy protections are built into it,” she said. “It’s an executive policy. The executive controls intelligence in the country.”

Got that? Good. At least when Feinstein was bringing it up, she was bringing it up to argue that the Intel Committees should be getting more insight into what 12333 is used for.

However, Devin Nunes, apparently wanted it to be kept in the dark. And wanted the public kept in the dark. That's because I just received in a surprisingly well-timed FOIA response, a letter that Nunes, along with Senate Intel Committee boss Richard Burr, sent a letter to the Privacy and Civil Liberties Oversight Board (PCLOB) back in 2015, basically telling the PCLOB to stop looking into 12333, because it was outside its purview. As you may recall, after doing detailed reports on Sections 215 and 702, the PCLOB announced that it was going to do a detailed study on 12333 to determine if it was violating the privacy and civil liberties of Americans. While that was announced way back in 2014, nothing final ever came out -- and it's unlikely to ever come out because the PCLOB is effectively dead.

But Nunes and Burr were apparently so concerned that the PCLOB might find actual problems with 12333 and how it violates the rights of Americans, that they made it clear that the PCLOB should knock it off:

As we are sure you are aware, intelligence activities conducted under E.O. 12333 address a broad range of national security issues beyond counterterrorism, including significant and important foreign intelligence matters that fall well outside of the PCLOB's limited statutory charter. Many intelligence activities conducted under E.O. 12333 predate the creation of the PCLOB and were not within the scope that the 9/11 Commission or Congress envisioned when PCLOB was established. The purpose is clear and specifically defined by Congress.

We trust you will keep in mind the finite statutory authority as you move forward and work with the Intelligence Community to limit appropriately your review only to those matters which Congress has specifically authorized you to review.

In other words, just two years ago, Devin Nunes was telling the one body in the government specifically tasked with reviewing intelligence collection programs to see how they're being used on Americans, that they should stop doing that. And now, today, he's suddenly demanding to know how the intelligence community uses 12333 to spy on Americans -- as if it had never crossed his mind before that the program was used this way.

This is not effective oversight. This is a hypocritical joke by the name of Rep. Devin Nunes.

Filed Under: 12333, adam schiff, cia, devin nunes, executive order 12333, fbi, mike flynn, nsa, pclob, richard burr, surveillance

Rather Than Ending NSA's Key Surveillance Tool, White House To Now Let Other Agencies Use It

from the uh...-what-now? dept

Late last night, the NY Times broke a very troubling story. Rather than finally putting an end to Executive Order 12333, it appears that President Obama is going to expand the power of it in dangerous ways. We've written about EO 12333 a bunch of times, but for those of you unfamiliar with it, it's an executive order signed by President Reagan that basically gave the NSA pretty free rein to collect signals intelligence outside of the US. Because it's not (technically) about domestic surveillance, what the NSA does under EO 12333 is not subject to Congressional oversight. That is, Congress is mostly as much in the dark as everyone else is on what the NSA is doing overseas. And, as former State Department official John Napier Tye revealed a couple of years ago, for all the talk of domestic surveillance programs revealed by Ed Snowden, the NSA's real power comes almost entirely from 12333.

And it has no limitations. Napier noted that the other programs -- things like Section 215 (now morphed into whatever the USA FREEDOM Act allows) and Section 702 -- were merely used to "fill in the gaps" not covered by 12333.

And it almost certainly involves both foreign and domestic intelligence. Basically, if any of your data goes outside of US boundaries, the NSA is free to capture it under 12333. Remember those stories of the NSA hacking into datacenters of companies like Google, Yahoo and Microsoft? Those datacenters were in Singapore. And the reason the target was Singapore rather than the US, was because of 12333.

Meanwhile, the NSA likes to insist that it respects the privacy of Americans thanks to its vast minimization program that is supposed to dump inappropriate data on Americans, or in stripping out private information when sharing data with other agencies.

But apparently that's going away. Instead, the White House has plans to let the NSA share data collected under 12333 with other government agencies without any minimization. Basically, whatever the NSA collects overseas might now be freely available to the FBI or Homeland Security or the IRS or the DEA. Doesn't that seem at least somewhat problematic? From the NY Times:

The Obama administration is on the verge of permitting the National Security Agency to share more of the private communications it intercepts with other American intelligence agencies without first applying any privacy protections to them, according to officials familiar with the deliberations.

The change would relax longstanding restrictions on access to the contents of the phone calls and email the security agency vacuums up around the world, including bulk collection of satellite transmissions, communications between foreigners as they cross network switches in the United States, and messages acquired overseas or provided by allies.

The idea is to let more experts across American intelligence gain direct access to unprocessed information, increasing the chances that they will recognize any possible nuggets of value. That also means more officials will be looking at private messages — not only foreigners’ phone calls and emails that have not yet had irrelevant personal information screened out, but also communications to, from, or about Americans that the N.S.A.’s foreign intelligence programs swept in incidentally.

This is crazy. For all the talk of the NSA having access to all of this information, and even a fair number of reports of NSA staff "abuse" of their access to data, in general, the NSA certainly has a reputation for being serious about not allowing any abuse of the data. Other agencies? Not so much. The FBI, CIA, DEA and ATF, for example, have long and colorful histories of abusing data to harass and intimidate people. Giving them much wider access to whatever the NSA slurps up overseas, and then trusting those agencies to handle "minimization" (as is the apparent plan) is downright frightening.

And despite this massive change, the public won't get to weigh in. Instead:

Intelligence officials began working in 2009 on how the technical system and rules would work, Mr. Litt said, eventually consulting the Defense and Justice Departments. This month, the administration briefed the Privacy and Civil Liberties Oversight Board, an independent five-member watchdog panel, seeking input. Before they go into effect, they must be approved by James R. Clapper, the intelligence director; Loretta E. Lynch, the attorney general; and Ashton B. Carter, the defense secretary.

Oh sure. They just need approval from the folks who will benefit most from all of this, and no real discussion with the public who will be impacted by it. What a surprise...

Filed Under: atf, cia, dea, executive order 12333, fbi, irs, minimization, nsa, privacy, surveillance

Pathological: Surveillance State Defenders Use Their Own Failure In Paris To Justify Mass Surveillance

from the shut-up-jackasses dept

We already wrote a bit about the absolutely ridiculous attempts to connect the Paris attacks of last week with Ed Snowden and encryption. But, of course, the surveillance state sees successful terrorist attacks -- which often demonstrate their own failings -- as a way to double down on getting more power. Take, for example, our old friend and former NSA General Counsel Stewart Baker.

As pointed out by Marcy Wheeler, Baker used the Paris attacks to argue that it was evidence that the NSA should not shut down its Section 215 bulk collection of phone records.

NSA's 215 program was designed to detect a Mumbai/Paris-style attack. https://t.co/UelhvrlNPp Maybe this is the wrong month to drop it.

— stewartbaker (@stewartbaker) November 14, 2015

There are so many problems with this level of idiocy that it's difficult to know where to start, but let's go with the basics... (1) the NSA program is still on and still working for another few weeks before it shifts to a slightly modified version. (2) France has its own equivalent program that is still in operation. In fact, France famously expanded its surveillance laws late last year prior to both the Charlie Hebdo and Paris attacks. (3) Outside of the US, the NSA relies on Executive Order 12333, which allows the NSA to collect a hell of a lot more information than the somewhat limited Section 215 program. (4) None of those programs appears to have discovered the Paris attacks (or, if they did, they clearly failed in stopping the attacks). (5) In other words, these programs did not work and yet the knee-jerk surveillance state defenders are using them as proof that the programs work.

What the actual fuck, Stewart?

Look, it's one thing to use horrible tragedies to promote your own political desires. It's another thing entirely to use the out and out failure of these intelligence programs to argue that they're proof of why those programs work and/or should be expanded.

Filed Under: bulk surveillance, executive order 12333, mass surveillance, nsa, paris attacks, section 215, stewart baker, surveillance state

Three PATRIOT Act Provisions Likely To Sunset, Briefly, But USA Freedom Will Pass Shortly

from the what-happens-next-is-what-matters dept

On Friday, we posted a story looking at the divergent views of two of my favorite privacy experts: Jennifer Granick favoring just letting the three PATRIOT Act clauses to sunset... and Julian Sanchez arguing that just letting those provisions sunset would unfortunately leave aside many of the important reforms in the USA Freedom Act. But, as we noted, both of them seemed to agree that either such result, without further reforms, wouldn't be enough.

Well, now it appears that both things will happen. After some debate, a late vote this evening, the Senate voted 77 to 17 to move forward on the USA Freedom Act -- but a vote will not occur until Monday at the earliest. That means, in a few hours, those three provisions of the PATRIOT Act will expire (and, no, this does not mean -- as some have falsely stated that the PATRIOT Act itself is dead). And then, a few days later, the USA Freedom Act will be passed (even Rand Paul admitted this is what's going to happen, even as he sought to block USA Freedom). Paul and some others are going to try to add some important amendments to the bill, but they're unlikely to pass.

In other words, both of the arguments that Granick and Sanchez made seem to have happened. Section 215 will "sunset" briefly -- hence a symbolic win. And USA Freedom Act, which has some useful reforms, will pass. And... then we'll still have a long way to go to get even more important surveillance reform. The events of this evening are an important step forward. Until just recently, the very idea that we might limit the Section 215 program for real seemed unlikely. And yet, now that's happening -- with both a brief sunset and the reforms in the USA Freedom Act.

But it's not enough. There is still plenty of excessive surveillance happening -- under other provisions, including Section 702 of the FISA Amendments Act and Executive Order 12333. Those need to be dealt with if we're to have real surveillance reform. The end result is that this is a an important victory for surveillance reform -- which never would have happened without Ed Snowden's actions -- but it's just a step. And a lot more is needed. And it's needed now.

Filed Under: bulk collection, business records, executive order 12333, mass surveillance, nsa, patriot act, rand paul, section 215, section 702, sunset, surveillance

Senate Intelligence Committee Finally Decides That Maybe It Should Figure Out What The Intelligence Community Is Up To

from the seems-a-bit-late-for-that dept

Both houses of Congress set up their respective "Select Committees on Intelligence" in the mid-1970s as basically permanent extensions of the Church and Pike Committees that dug into widespread abuses of the US intelligence community in the preceding decades. The idea was that by creating permanent oversight committees, it would prevent the kinds of abuses that were commonly done by the FBI, NSA and CIA. And yet, as we've noted many times, the intelligence committees don't seem to function as an oversight committee these days. Rather, they seem to be the committee designed to whitewash any abuses and to help the intelligence communities give a false veneer of legitimacy to their widespread abuses.

Just to put an exclamation point on the lack of real oversight, the Associated Press is now reporting that, in the wake of the Snowden revelations, then Senate Intelligence Committee boss (now "ranking member"), Dianne Feinstein, asked the committee to create a "secret encyclopedia" of all the various intelligence programs, because members and staffers apparently hadn't been keeping track:

Trying to get a handle on hundreds of sensitive, closely held surveillance programs, a Senate committee is compiling a secret encyclopedia of American intelligence collection. It’s part of an effort to improve congressional oversight of the government’s sprawling global spying effort.

Sen. Dianne Feinstein launched the review in October 2013, after a leak by former National Security Agency systems administrator Edward Snowden disclosed that the NSA had been eavesdropping on German Chancellor Angela Merkel’s cellphone. Four months earlier, Snowden had revealed the existence of other programs that vacuumed up Americans’ and foreigners’ phone call records and electronic communications.

“We’re trying right now to look at every intelligence program,” Feinstein told the Associated Press. “There are hundreds of programs we have found ... sprinkled all over. Many people in the departments don’t even know (they) are going on.”

Later in the article, Feinstein admits that the committee had not been "satisfactorily informed" about certain surveillance programs.

In other words, the committee clearly hasn't been doing much "oversight." Part of the problem is that so much of the work done by the intelligence community actually falls under executive order 12333. That's the executive order issued by Reagan under which most of the key intelligence programs fall -- and which Congress technically has no oversight mandate.

If the program started back in 2013, why is it only coming out now? Well, because with the changing of the guard in the latest Congress, Senator Richard Burr took over the Senate Intelligence Committee leadership, and he's even more of an intelligence community defender than Feinstein ever was. In the past, he's even argued that there should be no public hearings by the committee, and he's basically fought against any effort for transparency, and always sides with the intelligence community. Given that, many expected him to just kill off Feinstein's attempt at cataloging these programs -- but apparently Burr and Feinstein worked out "a deal" to continue -- but it appears that the "deal" also involves ending this effort by September, and no longer using two staffers from the executive branch who were familiar with these programs:

Feinstein, a California Democrat, initially wasn’t sure that Sen. Richard Burr of North Carolina, who took her place as chairman of the panel when Republicans took control of the Senate in January, would agree to continue the review. But Burr and Feinstein recently reached an agreement to do so, said Senate aides. They were not authorized to discuss the inner committee workings publicly and spoke only on condition of anonymity.

Two executive branch officials who had been detailed to the committee are returning to the executive branch and will not be replaced, the aides said, so the effort will be entirely the work of congressional staff. The project will end in September, the aides said.

Of course, for the past few years, Feinstein had insisted that the Committee was fully informed -- and only now it's coming out that she admits they weren't really. Except, now the committee is controlled by someone who is even more in the bag for the intelligence community than she was. Does anyone honestly think that the intelligence committees will now suddenly start doing a better job keeping the rest of Congress informed about what the intelligence community is up to?

Filed Under: dianne feinstein, executive order 12333, oversight, richard burr, senate, senate intelligence committee, surveillance

How Congress Secretly Just Legitimized Questionable NSA Mass Surveillance Tool

from the just-slipped-it-right-in dept

We recently noted that, despite it passing overwhelmingly, Congress quietly deleted a key bit of NSA reform that would have blocked the agency from using backdoors for surveillance. But this week something even more nefarious happened, and it likely would have gone almost entirely unnoticed if Rep. Justin Amash's staffers hadn't caught the details of a new provision quietly slipped into the Intelligence Authorization Act, which effectively "legitimized" the way the NSA conducts most of its mass surveillance.

For a while now, we've discussed executive order 12333, signed by President Ronald Reagan, which more or less gives the NSA unchecked authority to tap into any computer system not in the US. Over the summer, a former State Department official, John Napier Tye, basically blew the whistle on 12333 by noting that everyone focused on other NSA programs were missing the point. The NSA's surveillance is almost entirely done under this authority, which has no Congressional oversight. All those other programs we've been arguing about -- Section 215 of the Patriot Act or Section 702 of the FISA Amendments Act -- are really nothing more than ways to backfill the data the NSA has been unable to access under 12333. In other words, these other programs are the distraction. 12333 is the ballgame, and it has no Congressional oversight at all. It's just a Presidential executive order.

Yet, what Amash and his staffers found is that a last minute change by the Senate Intelligence Committee to the bill effectively incorporated key parts of EO 12333 into law, allowing for "the acquisition, retention, and dissemination" of "nonpublic communications." Here's where those who slipped this bit into the law got sneaky. Recognizing that they might be called on it, they put it in with language noting that such information could only be held on to for five years -- and then claimed what they were really doing was putting a limit on data already collected:

Backers of the section argue it would actually limit to five years the amount of time communications data could be kept at intelligence agencies, certain exceptions permitting. But it is generally acknowledged that such data is already rarely kept beyond five years, which Amash characterized as a trade-off that "provides a novel statutory basis for the executive branch's capture and use of Americans' private communications."

"The provisions in the intel authorization appear to be an attempt by Congress to place statutory restrictions on the retention of information collected under Executive Order 12333, which is not subject to court oversight, has not been authorized by Congress, and raises serious privacy concerns," said Neema Guliani, legislative counsel with the American Civil Liberties Union. "However, these restrictions are far from adequate, contain enormous loopholes, and notably completely exclude the information of non-U.S. persons."

This seems particularly nefarious. In trying to claim that they're putting a limit on this activity (that's already happening) they can claim that they're not really expanding the power of the NSA and the surveillance state. But, by putting it in law, rather than just having it in an executive order, they're effectively legitimatizing the practice, and making it much harder to roll back.

And they did it all quietly without any debate.

That's massively troubling. Inserting such a major power into the law at the very least deserves (and should require) a full and fair public debate about the issue and whether or not it is truly needed. Doing it in secret, at the last minute, with no public acknowledgement or discussion, and then pretending it's about "limits" rather than legitimizing what's in EO 12333 is really, really nefarious.

Unfortunately, even with Rep. Amash raising the alarm about it, the bill easily passed 325 to 100, without most in Congress probably having any idea about this issue and what it meant. Rep. Zoe Lofgren claimed that if Congress fully understood the provision, it almost certainly wouldn't have passed:

"If this hadn't been snuck in, I doubt it would have passed," said Rep. Zoe Lofgren, a California Democrat who voted against the bill. "A lot of members were not even aware that this new provision had been inserted last-minute. Had we been given an additional day, we may have stopped it."

This is the kind of crap that the intelligence community keeps pulling, and it's why there's so much that's troubling in the way they play the legislative game. Not only do they write the legislative language in sneaky ways that they can carefully interpret themselves -- they then get "friends" in Congress to quietly insert the language when no one's looking. By putting it in bills that have to pass, these things get put into the law and aren't at all easy to remove.

Filed Under: 12333, congress, eo 12333, executive order 12333, intelligence authorization act, justin amash, nsa, surveillance, zoe lofgren