Treasury Department Wing Latest To Be Accused Of Domestic Spying

from the just-dipping-into-the-domestic-stream-until-someone-says-stop dept

Some more domestic spying taking place, this time by financial regulators. While the US Treasury Department is well within its legal wheelhouse to investigate domestic financial wrongdoing, its Office of Intelligence and Analysis is only supposed to monitor financial activity occurring outside of the US. The OIA has apparently been helping itself to domestic financial records, as Jason Leopold reports.

Over the past year, at least a dozen employees in another branch of the Treasury Department, the Financial Crimes Enforcement Network, have warned officials and Congress that US citizens’ and residents’ banking and financial data has been illegally searched and stored. And the breach, some sources said, extended to other intelligence agencies, such as the National Security Agency, whose officers used the Treasury’s intelligence division as an illegal back door to gain access to American citizens’ financial records.

The US Treasury Department has responded to the allegations raised by several anonymous sources, claiming Leopold's article is basically bullshit.

“The BuzzFeed story is flat out wrong. An unsourced suggestion that an office within Treasury is engaged in illegal spying on Americans is unfounded and completely off-base.”

The department claims any sharing of data between the domestic-focused Financial Crimes Enforcement Network (FinCEN) and the OIA is completely legal. The NSA made a similar claim about its perusing of domestic financial data. But those claims seem a little hollow now that the Treasury Department's Inspector General has announced an investigation into this information sharing.

In some cases, the information shared had been properly redacted. But officials claim OIA personnel simply found ways to obtain the blacked-out data.

Some sources have also charged that OIA analysts have, in a further legal breach, been calling up financial institutions to make inquiries about individual bank accounts and transactions involving US citizens. Sources said the banks have complied with the requests because they are under the impression they are giving the information to FinCEN, which they are required to do.

That's how the backdoor works. When identifying information is redacted, the OIA just calls up the financial institution and asks for more information about unnamed accounts until it has enough to nullify built-in minimization procedures.

And there's more. It appears OIA is passing along domestic banking data to other foreign-facing agencies like the CIA and Defense Intelligence Agency. According to Leopold's sources, this has gone on for years. It's only coming to light now because FinCEN officials have begun complaining about the apparent privacy violations.

This has drawn the attention of Sen. Ron Wyden, who is now demanding answers from the Treasury Department.

“If true, those allegations would represent a serious abuse of spying powers to gather Americans’ financial information,” Senator Ron Wyden’s spokesman, Keith Chu, said in a statement: “Sen. Wyden plans to get to the bottom of what happened and take a close look at whether the rules currently protecting the privacy of Americans are strong enough and adequately enforced.”

This is something Wyden does well: dogged pursuits of information pertaining to intelligence community misconduct. Unfortunately, the intelligence community maintains a pretty solid stiff arm, which tends to put years between Wyden's questions and their eventual answers. Throw in some national security concerns, and the agencies involved are likely to be permitted to go dark for as long as possible.

The years of infighting between FinCEN and the OIA appear to be causing collateral damage. Another Leopold report from a couple of weeks ago covers a bizarre incident at the Treasury Department as FinCEN analysts attempted to dig through financial data for anything of interest that might have helped investigators track down participants in the recent London terrorist attack.

When the officials got to their secure operations center in Northern Virginia that Saturday night, they discovered that everyone on duty had been blocked from the classified networks their response depended upon. They couldn't open links emailed by the FBI about the suspected terrorists they were supposed to be chasing. They couldn't begin following the threads connecting those suspects to the people who had been funding and supporting them.

The lack of access for personnel within the Financial Crimes Enforcement Network — never before reported — cost antiterrorism forces on both sides of the Atlantic crucial time in identifying and pursuing the people and networks around the attackers, according to sources and documents reviewed by BuzzFeed News.

One possible explanation for the lockout may be the ongoing feud between FinCEN and the OIA. The OIA grants access to FinCEN, which allows it to piece together paper trails from both domestic and foreign banking data. If the OIA wanted to keep FinCEN out, it easily could. The other explanation is human error: unrenewed network security keys.

Whatever is happening isn't pretty. Human errors like these can result in lost human lives. If there's a turf war happening, the latest claims about OIA malfeasance are only going to result in less cooperation during critical times which, again, will possibly result in the loss of lives.

Filed Under: backdoor surveillance, financial records, fincen, oia, surveillance, treasury

Jason Leopold Files Lawsuit Over NSA's Refusal To Release Keith Alexander's Financial Records

from the the-agency-is-just-so-used-to-saying-'no' dept

FOIA enthusiast Jason Leopold isn't going to sit back and let former NSA head Keith Alexander recede noisily into the background. Alexander's transition from spy-in-chief to $1 million-a-month rockstar security consultant to our nation's most easily-impressed banks is currently on everyone's minds. First off, how many state secrets is he selling? And just how many hacker-beating patents will he be filing for?

But while slipping loudly out the front door with a quick wave of the hand and an accidental admission that his long tenure at the NSA's helm has done nothing to beat back the terrorist horde, Alexander may have felt his move to the private sector would keep his financial records out of the public eye. Leopold, however, has just filed a lawsuit against the agency for its continued refusal to release these public records.

[S]ome aren't simply laughing off the retired four-star general's new endeavor. Some, like Leopold, are concerned that Alexander might actually plan on selling high-level state security secrets for his hefty price tag.

In the Baltimore division of the federal district of Maryland, the law offices of Jeffrey Light have served the NSA with a complaint, listing Leopold’s multiple attempts to retrieve Alexander's records, and the utter refusal by the agency to fulfill the journalist’s requests.

Citing the Ethics in Government Act, Florida Congressman Alan Grayson wrote on behalf of Leopold, in a letter addressed to NSA Deputy Counsel Ariana Cerelenko, pressing that the public release of Alexander’s financial records are required—“unless the President finds that the release of the form would ‘reveal sensitive information,’ or ‘compromise the national interest.’"

As Daniel Stuckey at Vice points out, the NSA is the lone holdout when it comes to financial records. Even the CIA and the ODNI (Office of the Director of National Intelligence) have made these documents available. But the NSA wants to hold onto Alexander's records even though there's no established legal reason for doing so.

Notably, this is not a FOIA request. This is a document that can be requested by any member of the public simply by filling out a form. These financial disclosures are to be made public under the stipulations of the Ethics in Government Act (EGA) of 1978. But the NSA has held the (now former) agency head above the requirements of this law, even though there's nothing in the law that indicates the agency is outside of its jurisdiction. Obviously, Alexander's departure for the private sector raises questions about his prior connections to companies that may have benefited from expanding surveillance programs or may be potential purchasers of his $1 million/month protection plan. These are questions that need answers, and the NSA is arbitrarily withholding mandatory financial disclosures. If the White House has given the agency super-secret permission to ignore the stipulations of the EGA, hopefully Leopold's lawsuit will force that out into the open. If not, the NSA will need to start explaining why it's not being responsive, and it won't have the handy b(5) exemption [for FOIA requests only] to lean on.

Filed Under: financial records, jason leopold, keith alexander, nsa, public records, transparency

Latest (Official) Document Release Takes A Look At The NSA's Bulk Collection Of Financial Records

from the phone-records-still-hogging-the-spotlight,-though dept

Three more documents have been pried from the cold, decidedly-not-dead hands of the Office of the Director of National Intelligence. Rather than tell us how INTERESTED the intelligence "community" is in this dialogue it's been forced into by leaked documents, the ODNI unceremoniously dumped these on the national desktop before skipping town for the weekend. At least this time, it had the decency to namecheck the EFF's FOIA lawsuit, albeit over at Twitter rather than at the official ODNI blog.

There are three documents this time around, one of which is an update of Judge Walton's corrective measures put in place after discovering the agency's phone metadata program had not been run correctly since its institution. It's a good read but most of it's been covered here before.

The most notable aspect is a discussion of the "alert list," the numbers the NSA used to search incoming phone records. As of 2006, the NSA had 3,980 phone numbers on the list, all of which were deemed to meet the "RAS (reasonable articulable suspicion) standard." This was what was represented to the court. But it was discovered that many more than that had been used for queries without RAS or court approval.

Unfortunately, the universe of compliance matters that have arisen under the Court's Orders for this business records collection extends beyond the events described above. On October 17, 2008, the govemment reported to the FISC that, after the FISC authorized the NSA to increase the number of authorized to access the BR metadata to 85, the NSA trained those newly authorized on Court-ordered procedures. Despite this training, however, the NSA subsequently determined that 31 NSA analysts had queried the BR metadata during a five day period in April 2008 "without being aware they were doing so." (emphasis added [by Judge Walton]). As a result, the NSA used 2,373 foreign telephone identifiers to query the BR metadata without first determining that the reasonable articulable suspicion standard had been satisfied.

That's five days worth of searching records with 2,373 numbers that didn't meet the FISC court's standards or the NSA's own stated minimization procedures, with a possible three "hops" worth of data added. As the court has pointed out before, bypassing these standards makes the harvesting of this data illegal.

Regardless of what factors contributed to making these misrepresentations, the Court finds that the government's failure to ensure that responsible officials adequately understood the NSA's alert list process, and to accurately report its implementation to the Court, has prevented, for more than two years, both the government and the FISC from taking steps to remedy daily violations of the minimization procedures set forth in FISC orders and designed to protect [redacted] call detail records pertaining to telephone communications of U.S. persons located within the United States who are not the subject of any FBI investigation and whose call detail information could not otherwise have been legally captured in bulk.

Illegal capture of data that went unhindered for two years, despite daily violations. Who's looking out for Americans? Well, supposedly it's the good people at the NSA, along with its various levels of oversight. But if the oversight only gets its "facts" from the NSA, it's hardly in any place to provide oversight.

Also included in this document dump is another FISA court order limiting the NSA to court-approved searches (with emergency exceptions). Again, this is a direct result of the NSA's continued failure to abide by the limitations of the law and its own internal policies.

The most interesting document is a supplemental order from the FISA court, which serves to remind everyone that Section 215 covers a whole lot more than just telephone metadata.

The RFPA generally provides that "no Government authority" may obtain "financial records" from a "financial institution" unless one of several exceptions applies. fig 12 U.S.C. 3402; see also id, 3403. Under one of those exceptions, the FBI may, without prior judicial review, compel a financial institution to produce financial records, provided that a designated FBI official has certified that the records are relevant to an authorized foreign intelligence investigation. 50 U.S.C. 34l4(a)(5)(A). Pursuant to Section 1861, the government may request, and this Court may grant, "an order requiring the production of Q1 tangible things (including books, records, papers, documents, and other items)" 50 U.S.C. 1861(a)(1) (emphasis added). Section 1861 requires the government to provide the Court with a "statement of facts showing that there are reasonable grounds to believe that the tangible things sought are relevant" to a foreign intelligence investigation, id, 1861(b)(2)(A), and the Court to determine that the application satisfies this requirement, 5; id 1861(c)(l), before records are ordered to be produced.

Although the RFPA contains no provision explicitly allowing the production of financial records pursuant to a Section 1861 order, the Court agrees with the government that it would have been anomalous for Congress to have deemed the FBI's application of a "relevance" standard, without prior judicial review, sufficient to obtain records subject to the RFPA, but to have deemed this Court's application of a closely similar "relevance" standard insufficient for the same purpose.

So, under the same authority, the FBI (and consequently, the NSA) is allowed to collect almost any "business record," provided it is deemed "relevant" to a foreign intelligence investigation. Marcy Wheeler suggests that this collection of financial records may explain the spike in FISC orders that began in 2010.

In addition, the number Section 215 orders started going up drastically in 2010, along with the number of orders the FISC modified to require minimization procedures.

Nevertheless, the reports show us two new things.



I’ve suggested that 176 modified applications may suggest the government has as many as 44 bulk collection programs, which would be renewed every three months (or, alternately, a whole lot more specific bulk collection orders).

That is, this rise in what are almost certainly bulk collection orders came around the same time as FISC “Bates-stamped” the collection of financial records with Section 215.

Phone metadata has been the issue on everyone's minds these past few weeks, but the reality is that the NSA is collecting several other bulk records under the same authority. And these are all obtained under the pretense that they're somehow "relevant" to a terrorist-related investigation, even though they're gathered in bulk and any minimization procedures can only be speculated on at this point in time.

Even "just metadata" from phone records can paint a pretty accurate picture about someone "incidentally" caught up in the NSA's dragnet. Add another few dozen forms of "metadata" and it's pretty much indistinguishable from giving the agency unfettered access to the everyday lives of millions of people.

Filed Under: bulk collection, financial records, james clapper, nsa, odni, surveillance