Inspector General Says CBP's Device Search Program Still A Mess, Still (Ironically) Mostly Undocumented

from the PAPERS-PLS dept

The CPB continues to increase the number of electronic devices (at least temporarily) seized and searched at border crossings and international airports. Basic searches -- ones that don't involve any additional tech or software -- can be performed for almost any reason. For deeper searches, the CBP needs only a little bit more: articulable suspicion.

Even though it's only a very small percentage of the total, it continues to increase, both in total numbers and as a percentage of the whole.

In fiscal year 2018, OFO processed more than 413 million travelers arriving at U.S. POEs and conducted an estimated 33,062 basic and advanced electronic device searches of those inbound travelers (.008 percent). In FY 2019, CBP processed more than 414 million travelers and conducted an estimated 40,610 basic and advanced electronic device searches of those inbound travelers (.010 percent).

That's from the DHS Inspector General's latest investigation [PDF] of CBP device searches. The last time the IG stopped by the CBP to perform some oversight in this area, it declared the whole thing a catastrophe. There was very little direct supervision of searches, documentation was almost nonexistent, and the CBP had no idea whether more searches were resulting in more investigations or arrests of criminals. Not only that, but the CBP had yet to implement any method of quantifying the security/safety gains of performing invasive device searches at border crossings.

Right at the top, the IG refers to the CBP's policy on device searches, which clearly and succinctly states the agency's obligations:

CBP’s Directive requires CBP officers to fully document all information related to searches of electronic devices.

You can already guess where this is headed.

First, there's a callback to the last investigation by the IG:

In our first audit of CBP’s searches of electronic devices at POEs [Ports of Entry], we reported deficiencies in supervision, guidance, equipment management, and performance measures and made five recommendations to improve the program’s effectiveness. CBP concurred with all five recommendations and has taken some actions to improve oversight, such as streamlining license renewals, developing processes to conduct annual field office reviews, and updating its self-inspection worksheet to better identify deficiencies. As of May 2021, CBP had not fully implemented four of five recommended corrective actions.

Since there's been no improvement on the back end, there's been no improvement on the front end.

Here's a more detailed description of what's required when a phone is searched by CBP personnel:

CBP’s Directive requires CBP officers to include all information related to the search, such as whether the device’s wireless data connection was disabled, a tear sheet was provided, and if a supervisor approved advanced searches. In instances in which OFO detains or seizes an electronic device, officers document such incidents on DHS Form 6051D, Detention Notice and Custody Receipt for Detained Property and DHS Form 6051S, Custody Receipt for Seized Property and Evidence, to demonstrate chain of custody. The Directive also tasks supervisors with ensuring officers complete thorough inspections and that all notification, documentation, and reporting requirements are met.

Here's what happened instead:

OFO [Office of Field Operations] did not always adhere to all requirements outlined in the Directive when conducting electronic device searches nor properly document searches. Of the 100 from FYs 2018 and 2019 that we reviewed, 79 had one or more instances of non-compliance, which totaled 139 instances. [...] We also identified 32 EMRs [electronic media reports] not approved by a supervisor within 7 days.

The largest number of infractions came from two areas: no indication of whether the device's data connection was disabled (27) -- something that's supposed to prevent agents from intercepting incoming communications or accessing content stored in the cloud -- and no indication of whether a supervisor was present for advanced searches (44), which is a violation of CBP policy.

That's just the problem with the stuff that's (apparently incompletely) documented. Then there are the cases where no documentation occurred at all.

During site visit... we identified instances in which OFO officials used advanced screening equipment to conduct advanced searches of electronic devices without documenting these searches in TECS. For example, in reviewing DOMEX activity log entries from the three POEs, we identified 33 advanced searches that were not documented in TECS.

CBP officials said these didn't need to be tracked because they were not related to new searches, but rather to ongoing investigations, training, and "ongoing maintenance." As proof of this claim, the officials offered nothing.

We could not confirm these assertions because OFO did not have controls to ensure all advanced searches were traceable to the officer conducting the search.

As for seeing if these searches are actually resulting in any net security and public safety gains, the CBP is still sort of working on that. There are existing metrics the CBP could use, but it has simply chosen not to.

According to an OFO official, OFO does not see the benefit of receiving the outcomes of referrals, or tracking prosecutions and convictions, and does not have a system to track or receive this information. Without tracking final legal disposition of devices and information transferred to other Federal agencies, OFO cannot fully evaluate the program’s effectiveness or whether advanced searches are achieving their intended purpose to detect evidence and identify crimes.

The refusal to properly track and document searches also causes problems elsewhere.

For example, OFO equipment used to search computers [equipment name redacted] has not functioned since July 2018 due to network compatibility issues. Because of these technical issues, officers at POEs cannot conduct advanced searches of computers on-site.

Here's the punchline:

Despite technical issues, OFO renewed the software licenses for all equipment in 2019 and 2020, including for equipment that does not function, at a total cost of $330,629.

Which leads to yet another punchline in the OIG's recommendations:

We recommend the Executive Assistant Commissioner for the Office of Field Operations: a. Suspend the renewal of licenses for nonfunctional equipment, as appropriate.

You think?

The report concludes like the last one did. Recommendations for the CBP to something -- anything! -- to improve its tracking and documentation of phone searches. And like last time, the CBP has promised to get right on that… eventually. And we the people can all expect more of the same in the 2022 report, given the lack of progress since the last IG review.

Filed Under: 4th amendment, cbp, device search, dhs, inspector general

Oversight Unable To Discover Which FBI Agents Leaked Clinton Investigation Info Because Goddamn Everyone Was Leaking Stuff

from the selective-transparency dept

Selective leaking has always been a part of the federal government's day-to-day business. When there are narratives to massage, controlled leaking is tolerated. Leaks that make the government look bad tend to result in prosecutions, but leaks that act as highly unofficial PR or align with the motivations of the agencies they're leaked from are largely ignored.

Every so often, though, oversight is asked to keep an eye on leaking, if only to make it appear that all leaks are considered equal. In the interest of perceived fairness, the FBI's Office of the Inspector General has taken a look at the incidents surrounding the selective release of information about the investigation of Hillary Clinton's use of a personal email server during her stint at the State Department under Barack Obama.

There were questions about political motivations -- ones not helped at all by selective leaks about the investigation. This was on top of supposedly official actions, like then-FBI director James Comey's decision to hold a press conference to announce the outcome of the FBI's investigation. In the agency's determination, what Clinton did was unwise and gave the appearance of impropriety, but was not illegal.

That would have been it. But shortly before the 2016 election, James Comey decided it was time for him to act unwisely and give off an air of impropriety by announcing the FBI would be reopening its investigation of Clinton and her email server, thanks to developments in an unrelated case. Comey's actions were also questionable, but apparently not actually illegal.

The OIG tried to dig into the FBI's use of selective leaking during this time period. And it has arrived at the conclusion that it's almost impossible to accurately point fingers, much less discourage powerful federal agencies from doing whatever the hell they want to, policies and laws notwithstanding. (h/t Brad Heath)

The report [PDF] leads off with a summary of the undoubtedly frustrating investigation. First, it points out how things should be handled…

Among the issues we reviewed in that report were allegations that FBI employees improperly disclosed non-public information regarding the FBI’s investigation into former Secretary of State Hillary Clinton’s use of a private email server. FBI policies strictly limit the employees who are authorized to speak to the media, and require all other employees to coordinate with or obtain approval from the FBI’s Office of Public Affairs (OPA) in connection with such communications.

And follows that up with a resigned statement about how things actually are…

Nonetheless, as described in our 2016 pre-election report, we found that these policies appeared to be widely ignored during the period we reviewed. Specifically, in our analysis of FBI telephone records, FBI email records, FBI text, and Microsoft Lync instant messages, we identified numerous FBI employees, at all levels of the organization and with no official reason to be in contact with the media, who were nevertheless in frequent contact with reporters.

The Federal Bureau of Sunk Ships (feat. Loose Lips). This would be a national embarrassment if it weren't so hilarious. The FBI screws over public records requesters on a regular basis and issues tight-lipped "no comments" or Glomars whenever it's being scrutinized by critics. But apparently everyone on staff is handing out secrets to half the Rolodex whenever they're feeling particularly chatty about politically-tinged investigations.

And if this seems damning, imagine what the OIG would have found if it was actually engaged in an investigation determined to root out criminal activity.

Because this was a non-criminal administrative misconduct review, there was no legal basis to seek a court order to compel Internet service providers to produce to the OIG the content of any personal email communications for these FBI employees.

As much as I'd like to see some federal agents suddenly jobless, I appreciate the restraint of the OIG, which would have been treading into First Amendment waters by seeking content of communications with journalists. All the same, it appears the FBI doesn't really need to keep paying people to staff its Public Relations department. It has all the unofficial help it needs to get the word out.

Those who were caught chatting it up with reporters tended to pass the buck, offering the Inspector General facts not in evidence to justify their casual disregard of FBI policy.

Employees interviewed by the OIG generally claimed that they believed their contacts were either authorized by OPA or a field office Special Agent in Charge (SAC) or Assistant Director in Charge (ADIC) to provide background about an FBI initiative or completed investigation, or were personal in nature. Given the absence, in most instances, of any documentary evidence reflecting the substance of these communications, the OIG was unable to determine whether these communications were consistent with the explanations provided by the FBI employees or instead involved the sharing of non-public information with reporters.

Behold the Federal Office of the Future! It's not just telecommuting and flexible staffing. It's also paper trail-less, which probably helps the environment in some way. God bless America.

In conclusion: holy shit.

Our ability to identify individuals who have improperly disclosed non-public information is often hampered by two significant factors. First, we frequently find that the universe of Department and FBI employees who had access to sensitive information that has been leaked is substantial, often involving dozens, and in some instances, more than 100 people.

Second, although FBI policy strictly limits the employees who are authorized to speak to the media, we found that this policy appeared to be widely ignored during the period we reviewed. We identified numerous FBI employees, at all levels of the organization and with no official reason to be in contact with the media, who were nevertheless in frequent contact with reporters. The large number of FBI employees who were in contact with journalists during this time period impacted our ability to identify the sources of leaks. For example, during the periods we reviewed, we identified dozens of FBI employees that had contact with members of the media.

Forget FOIA. Maybe all anyone needs is a barely targeted "request for comment." And it would be ridiculous to believe the FBI is the only agency that behaves this way. The federal government -- as multiple presidents have discovered -- is staffed by the leakiest bunch of leakers who ever leaked. The problem isn't the leaks. It's the selective prosecution of leaks. If the leaks serve the government, they're just part of the public service infrastructure. But if they embarrass the government or expose wrongdoing, they're suddenly criminal acts. And that unequal treatment cannot be addressed by internal investigations. It's a mindset problem -- one the government has no intention of changing, no matter who's occupying the Oval Office.

Filed Under: doj, fbi, hillary clinton, inspector general, james comey, journalism, leaks, oversight, reporting, transparency

Treasury Oversight Says IRS Should Consider Getting Warrants Before Buying Location Data From Data Brokers

from the everyone-reads-Carpenter-differently dept

Last October, Senators Ron Wyden and Elizabeth Warren asked the IRS's oversight to take a look at the agency's use of third-party data brokers to obtain cell site location info harvested from phone apps. This new collection of location data appeared to bypass the Supreme Court's Carpenter decision, which said cell site location info was protected by the Fourth Amendment.

This means warrants were needed to obtain this information from cell service providers. Multiple government agencies -- including the CBP, DEA, and Defense Department -- appear to believe approaching data brokers a couple of steps removed from the location data collection process aren't affected by this warrant requirement. While both cell site location info from cell providers and bulk data from brokers can accomplish the same long-term tracking of individuals, the latter tends to be less detailed since it sometimes requires apps to be in use to produce location data, rather than just connected to a cell tower.

The IRS may have believed no warrants are needed to buy bulk data from brokers, but its oversight disagrees. The Treasury Department Inspector General says the 2018 Supreme Court ruling may cover this data as well.

A new Treasury Department watchdog report warns that law-enforcement agencies may not be on firm legal footing when they use cellphone GPS data drawn from mobile apps without obtaining a warrant first.

In a review of the Internal Revenue Service’s use of a commercial platform that allowed the agency to track cellphones, the Treasury Department inspector general for tax administration said that a landmark 2018 Supreme Court case might preclude the warrantless tracking of criminal suspects through location data generated by weather, game and other apps. The report encouraged stricter controls on use of the data.

But it's only a "may." The report [PDF] says the IRS should consider seeking a warrant before obtaining this data in the future. However, the IRS hasn't purchased data for a few years now because it doesn't consider it useful. And its only utilization of data broker Venntel occurred before the Supreme Court's Carpenter decision was handed down.

According to the purchase order, the subscription was for one year from September 9, 2017, through September 8, 2018, at the cost of $19,872. CI stated that the single-user license subscription was used exclusively by a single field office in the Cyber Crimes Unit, and Venntel was only utilized on a few specific occasions and did not produce effective results. According to CI, the last use of this database was in March 2018…

That would be two months before the Carpenter decision, which would make it a good faith effort if anyone were to challenge this evidence. But if anyone was going to, they'd likely already have done it. And the IRS's limited use (at least of this vendor) reinforces the IRS's claims that bulk location data from brokers doesn't help it with investigations.

Even given the Supreme Court's 2018 decision, IRS officials still seem to believe if the agency make use of this in the future, agents still wouldn't need to seek a warrant.

Carpenter v. U.S. was decided in June 2018. The last known attempt to use the Venntel product was March 2018, before the Supreme Court decision. Nevertheless, it is our understanding that the Carpenter decision concerned historical Cell Site Location Information which is distinct from the opt-in app data available on the Venntel platform.

Ah, but that's the same argument the government made to attempt to avoid a search warrant requirement: that the location data was voluntarily obtained from cellphone users. The Supreme Court disagreed, saying the data was collected continuously, even when owners weren't actively using their cellphones. If US government agencies continue to seek this data without a warrant, they're likely going to start generating caselaw contradicting their presumptions.

Treasury Oversight suggests warrants. The IRS suggests they aren't necessary. For now, the only thing preventing internal conflict is the IRS's determination that this particular form of cell location data is mostly useless.

Filed Under: 4th amendment, csli, data brokers, elizabeth warren, inspector general, irs, location info, oversight, privacy, ron wyden, treasury department, warrant

TSA Oversight Says Agency's Suspicionless Surveillance Program Is Worthless And The TSA Can't Prove It Isn't

from the it-works-in-the-sense-that-it-employs-people dept

The TSA's "Quiet Skies" program continues to suffer under scrutiny. When details first leaked out about the TSA's suspicionless surveillance program, even the air marshals tasked with tailing non-terrorists all over the nation seemed concerned. Marshals questioned the "legality and validity" of the program that sent them after people no government agency had conclusively tied to terrorist organizations or activities. Simply changing flights in the wrong country was enough to initiate the process.

First, the TSA lost the support of the marshals. Then it lost itself. The TSA admitted during a Congressional hearing that it had trailed over 5,000 travelers (in less than four months!) but had yet to turn up even a single terrorist. Nonetheless, it stated it would continue to trail thousands of people a year, presumably in hopes of preventing another zero terrorist attacks.

Then it lost the Government Accountability Office. The GAO's investigation of the program contained more investigative activity than the program itself. According to its report, the TSA felt surveillance was good but measuring the outcome was bad. When you're trailing 5,000 people and stopping zero terrorists, the less you know, the better. Not being able to track effectiveness appeared to be a feature of "Quiet Skies," rather than a bug.

Now it's lost the TSA's Inspector General. The title of the report [PDF] underplays the findings, stating the obvious while also understating the obvious: TSA Needs to Improve Management of the Quiet Skies Program. A good alternative title would be "TSA Needs to Scrap the Quiet Skies Program Until it Can Come Up with Something that Might Actually Stop Terrorists."

I mean…

TSA did not properly plan, implement, and manage the Quiet Skies program to meet the program’s mission of mitigating the threat to commercial aviation posed by higher risk passengers.

In slightly more detail, the TSA did nothing to set up the program correctly or ensure it actually worked. The IG says the TSA never developed performance goals or other metrics to gauge the effectiveness of the suspicionless surveillance. It also ignored its internal guidance to more effectively deploy its ineffective program.

Here's why:

This occurred because TSA lacked sufficient, centralized oversight to ensure the Quiet Skies program operated as intended.

There were some positives, but they were limited. The DHS and TSA set up information sharing programs, and performed quarterly reviews to remove passengers from the Quiet Skies watchlist. But that's about it. And, as the IG points out, these steps don't add up to anything that might quantify its success rate or justify its existence.

The failure had a trickle down effect, showering the air marshals who thought the program was useless (if not illegal) with second-hand shame.

After almost two years of flight coverage, FAMS [federal air marshals] could not provide outcome-based performance measures to show that its surveillance of Quiet Skies passengers who had already received enhanced screening at checkpoints was the most efficient use of its limited resources.

As for the good news about the periodic removal of people from the TSA's suspicionless surveillance, it's not without its bad news. The IG says the TSA didn't do it in a timely fashion or, you know, correctly.

The Implementation Plan requires TSA and DHS to conduct quarterly oversight reviews of Quiet Skies’ risk-based, intelligence-driven rules created and updated by I&A. However, in 2017 and 2018 TSA identified software algorithm and system malfunctions that resulted in passengers not being removed from the Quiet Skies List after [redacted].

And the TSA had problems with the people it had added to this watchlist, failing to ensure they got all the surveillance and checkpoint friskings they apparently deserved.

As currently designed, TSA cannot ensure all Quiet Skies passengers receive enhanced screening at checkpoints in accordance with its Implementation Plan.

[...]

We reviewed results from TSA inspections conducted from October 2015 through February 2019, in which inspectors found incidents related to the Boarding Pass Printing Result requirement. From our review of 16 incident reports, we identified [redacted] in which the boarding passes either were not designated as needing enhanced screening or the aircraft operator did not ensure the passenger received enhanced screening at the checkpoint.

Unfortunately, the number of failures is redacted. But given the TSA's track record elsewhere, it's probably safe to assume the failure rate was above 50%.

The IG recommends the TSA fix everything that's broken. That's most of the program, it appears. The TSA agrees… to a point. The TSA disagrees that it did not "properly plan or manage" the program, including its lack of metrics. According to the TSA's response, the fact that a few dozen targets (out of the thousands trailed by the TSA) showed up on other watchlists is an indication the program is a success.

In October 2020, TSA's I&A reviewed Quiet Skies encounters between 2014 and 2019, and found that 58 individuals designated for additional scrutiny by Quiet Skies are now "watchlisted" in the Terrorist Screening Database as a KST [known suspected terrorist]. This data indicates that Quiet Skies are approximately 30 times more likely to pose an actual high risk than a randomly selected passenger, validating Quiet Skies' value in identifying higher-risk travel.

Nice try. But TSA already threw all plausibility out the window back in 2018 with this testimony before Congress.

The officials said about 5,000 US citizens had been closely monitored since March and none of them were deemed suspicious or merited further scrutiny, according to people with direct knowledge of the Thursday meeting.

Tell me again how 58 watchlist hits is a satisfactory metric. Cherry-picking numbers doesn't change the facts already on the record. When you go 0-for-5,000, managing to cross-reference 10-12 targets a year with another highly-questionable database isn't a win.

Filed Under: 4th amendment, air marshals, gao, inspector general, quiet skies, surveillance, tsa

DHS Inspector General Is Going To Take A Look At The DHS's Purchase Of Cell Location Data From Data Brokers

from the it's-about-time-someone-other-than-Ron-Wyden-looked-into-this dept

DHS components are buying up cell location data from third parties to track down undocumented immigrants and whoever else ICE and CBP might be interested in. The IRS is doing the same thing. So is the Department of Defense.

The location data is harvested from dozens of phone apps. This data makes its way to a variety of data brokers -- often without the explicit knowledge of app users or developers -- who then sell access to government agencies. This access seems to violate the spirit of the Supreme Court's Carpenter decision (which erected a warrant requirement for cell site location info), if not the actual letter of ruling.

This has drawn the attention of a number of Senators, including Ron Wyden. In response to Senate questions, the Inspector General for the IRS has opened an investigation into the agency's practice of buying location data from private companies.

The DHS is now undergoing the same scrutiny.

The department’s inspector general told five Democratic senators that his office would initiate an audit “to determine if the Department of Homeland Security (DHS) and its components have developed, updated, and adhered to policies related to cell-phone surveillance devices,” according to a letter sent last week to Capitol Hill and shared with The Wall Street Journal.

The letter came in response to a request in October from Sens. Ron Wyden (D., Ore.), Elizabeth Warren (D., Mass.), Sherrod Brown (D., Ohio), Ed Markey (D., Mass.) and Brian Schatz (D., Hawaii) to probe whether the purchase of commercial cellphone data on Americans for law-enforcement purposes was lawful.

This is welcome news, considering no agency has offered up a legal rationale for dodging apparent warrant requirements by purchasing data from third party brokers -- brokers who are an additional hop away from the third parties who collected the data in the first place. When even app developers aren't sure whose buying their data, it's pretty difficult to argue anyone tracked via this method knowingly and voluntarily "shared" their location with the data brokers selling access to the government.

This won't be the only investigation either. The DHS IG is also looking into other "open source" intel gathering performed by DHS agencies. The guidelines for gathering intel from social media accounts and other publicly accessible internet services hasn't been explained sufficiently and/or examined by the DHS's Congressional oversight.

Unfortunately, this investigation may not lead to the termination of this data collection. The DHS's general counsel has already declared this to be legal -- something revealed by BuzzFeed earlier this year.

In an internal memo obtained by BuzzFeed News, the DHS's top attorney, Chad Mizelle, outlined how ICE officials can look up locations and track cellphone data activity to make decisions on enforcement.

Mizelle also believes the agency can use the data without obtaining a warrant or violating the Fourth Amendment, which protects the public against unreasonable searches and seizures.

That's the pitch the DHS is making. It hasn't made that pitch publicly, however. BuzzFeed's reporting covered a leaked memo. This claim hasn't been made on the record and, given the flexible contours of the Supreme Court's Carpenter decision, there's a good chance it won't hold up in court, much less under Congressional scrutiny. But, as it stands now, these agencies are still in the location data buying business until further notice.

Filed Under: 4th amendment, data brokers, dhs, inspector general, location data, privacy

Inspector General's Report Confirms CBP Contractor Was Hacked, Resulting In Sensitive Info Making Its Way To The Dark Web

from the collect-it-all,-protect-it-barely dept

Last year, a CBP vendor suffered a data breach affecting more than 100,000 people who had crossed the border at checkpoints. The CBP refused to name the contractor involved in the breach, but internal documents indicated it was Perceptics. Perceptics provided and maintained the system that photographed cars and their occupants as they crossed the border.

The vendor's involvement in the breach has now been publicly confirmed, thanks to an Inspector General's investigation of the incident. Sensitive information that was never supposed to be located on Perceptics' servers was obtained by hackers and (partially) distributed on the dark web. [h/t Motherboard]

The report [PDF] lists the extent of the damage, which was fairly minimal given what was involved.

The subcontractor’s network was later the subject of a malicious cyber attack that compromised approximately 184,000 traveler images from CBP’s facial recognition pilot. After removing duplicate images, CBP reduced its estimate to 100,000 individual images, of which they discovered 19 were posted to the Dark Web.

From which the IG draws this inevitable conclusion:

This incident may ultimately result in damage to the public’s trust in Government biometric programs.

Yes, whatever trust there is that hasn't been damaged yet, I guess.

Perceptics was authorized to be on-site to perform maintenance work. It was never authorized to transfer any photos to its own servers. But it did. And it did this in the worst way possible.

According to documentation from Unisys and CBP, Perceptics subsequently admitted to Unisys that it had downloaded approximately 184,000 traveler images from the equipment in conjunction with the work order tickets. Perceptics personnel accomplished this using an unencrypted USB hard drive that was eventually transported back to their corporate office in Knoxville, Tennessee. From there, subcontractor personnel uploaded CBP’s images to a Perceptics server.

This unauthorized data exfiltration led directly to another unauthorized data exfiltration.

Perceptics’ corporate network was subjected to a ransomware attack at some point prior to May 13, 2019. The attack compromised thousands of driver and passenger images that CBP captured during the VFS pilot. CBP determined that more than 184,000 traveler facial image files, as well as 105,000 license plate images from prior pilot work, were stored on the subcontractor’s network at the time of the ransomware attack. In addition, the hacker stole an array of contractual documents, program management documents, emails, system configurations, schematics, and implementation documentation related to CBP license plate reader programs.

Perceptics refused to pay the ransom and the hacker (d/b/a "Boris Bullet Dodger") released "9,000 unique files" on the dark web.

The Inspector General says Perceptics should never have taken files offsite. But it's not the only party to blame. CBP should have made this far more difficult to achieve.

Perceptics was able to make unauthorized use of CBP’s biometric data, in part because CBP did not implement all available IT security controls, including an acknowledged best practice. Additional IT security controls in place during the pilot could have prevented Perceptics from violating contract clauses and using an unencrypted hard drive to access and download biometric images at the pilot site.

The rest of the report is the CBP promising to secure barn doors as per the IG's recommendations. Certainly this will have some effect going forward. But the fact remains the CBP collects a lot of personal information that can be tied to border crossers' vehicles. All of this in one place continues to make the CBP -- and most government agencies -- tempting targets for malicious hackers.

Filed Under: border crossing, cbp, dark web, facial recognition, hacked, inspector general, leaked, security
Companies: perceptics, unisys

Defense Department Oversight Thwarted By Defense Department Officials Who Refused To Talk About Trump's Communications

from the cut-to-DoD-officials-tying-gags-over-their-own-mouths dept

Every presidential administration seems to make a game of thwarting oversight. The current one is no different. President Trump is setting himself apart from the pack by firing IGs at an alarming pace. Whatever's being done in our name at various government agencies is being done in the dark. Whistleblowers and leakers are being hunted down and persecuted/prosecuted (another favorite presidential sport).

What would be considered unlawful obstruction in a criminal investigation is just business as usual at the Executive branch. The latest (but certainly not the last) obstruction was revealed in the investigation of the "JEDI" contract procedure. Amazon really wanted to be a part of American bloodsports, but was beaten out by Microsoft for lucrative Pentagon cloud storage contracts. Amazon sued, alleging it got illegally screwed by the President, claiming his frequent derogatory comments about Amazon and the Jeff Bezos-owned Washington Post pushed the Pentagon towards selecting Microsoft.

An investigation was opened by the Defense Department's Inspector General. And we'll never know what really happened because it appears the administration inserted itself into the investigation. Jacqueline Feldscher has more details at Politico:

The Pentagon’s inspector general “could not definitively determine” whether the White House influenced the procurement process for a major cloud computing contract because senior Defense Department officials were barred from answering questions on the subject during interviews, according to a 313-page report released on Wednesday.

Sticking it to the Deep State, I guess. So, what looks like some impropriety now officially only looks like some impropriety because the Defense Department's general counsel told DoD officials to not answer any questions about communications between the DoD and the White House. "Presidential communications privilege" successfully asserted.

Given the lack of answers, it seems pretty ridiculous for the Pentagon to hang the "Mission Accomplished" banner and declare everything to be above-board. But that's what has happened because that's the the kind of government we have. Here's the Pentagon's spokesperson pretending there's nothing to see here.

"This report should finally close the door on the media and corporate-driven attacks on the career procurement officials who have been working tirelessly to get the much needed JEDI cloud computing environment into the hands of our frontline warfighters while continuing to protect American taxpayers."

Everything is over except its eventual fading into obscurity, washed under the flotsam that is the day-to-day horror of living in an ongoing pandemic. The Pentagon has cleared itself of any wrongdoing by refusing to answer questions related to alleged wrongdoing. The overseers were neutralized by presidential privilege, resulting in the Inspector General drawing inconclusions the Pentagon has declared to be exculpatory with one comment to the press. The IG's office decided to release the incomplete report anyway, stating it did not want to further delay any reporting on its non-findings since it was apparent no amount of waiting things out was going to get these officials to discuss things they didn't want to discuss.

As for Amazon, it must be refreshing to be on the other side of impropriety accusations for once. The run-up to the awarding of the contract saw a few DoD officials becoming far too friendly with the cloud service provider.

The inspector general substantiated allegations of ethical misconduct against Deap Ubhi, a Pentagon employee who worked on the early stages of crafting the JEDI program before leaving the department to work for Amazon.

Investigators did not, however, find evidence of ethical misconduct by other senior defense officials, including former Defense Secretary Jim Mattis, who attended a dinner with Amazon officials organized by his former aide Sally Donnelly.

Ah. Well, at least the IG found out something about somebody. The President's dislike for Amazon and Bezos remains under "presidential privilege" wraps and the swamp will continue draining at its current rate of 0 liters/flush.

Filed Under: communications, contract, dod, donald trump, inspector general, jedi, oversight, retaliation, transparency
Companies: amazon, microsoft

Donald Trump Fires Inspector General Who Brought Ukraine Phone Call Whistleblower Complaint To Congress

from the just-more-retaliation-targeting-the-proper-channels dept

No one really needs to wait until Friday afternoon to bury bad news. Not these days when bad news is all we seem to have, occasionally mixed with even worse news. But the White House remains the White House, so the time-honored process of dumping stuff you want to stay out of the headlines right before everyone punches out for the weekend remains in place.

The government as a whole claims it wants whistleblowers to report wrongdoing through the proper channels. It then routinely follows this up by ensuring the proper channels remain the best way to see good deeds punished.

The whistleblower that reported President Trump's inappropriate conversation with Ukraine president Volodymyr Zelensky saw their report buried by the White House's Office of Legal Counsel. So much for the proper channels. President Trump himself asked for the whistleblower to be outed, undermining the protections the federal government has established to ensure wrongdoing is reported.

The only party receptive to the whistleblower's complaints has now been fired by President Trump, closing the loop on the White House's retaliatory actions.

President Donald Trump on Friday fired Intelligence Community Inspector General Michael Atkinson, who had told Congress about the whistleblower complaint that led to Trump's impeachment, the President told Congress in a letter obtained by CNN.

So, there's another spot open in the administration -- one that will probably be filled by an underqualified suck-up, rather than someone who can actually do the job. Trump's faith in appointees often appears to be directly related to how good they make him look, rather than how well they do their jobs.

"As is the case with regard to other positions where I, as President, have the power of appointment ... it is vital that I have the fullest confidence in the appointees serving as inspectors general," Trump wrote. "That is no longer the case with regard to this Inspector General."

Atkinson's response letter is worth reading. It makes it clear his firing was politically motivated and had nothing to do with his ability to carry out his duties.

It is hard not to think that the President's loss of confidence in me derives from my having faithfully discharged my legal obligations as an independent and impartial Inspector General, and from my commitment to continue to do so.

More of the same from this administration, which isn't all that different from the actions of the administrations that preceded Trump's. Whistleblowers get punished. Those aiding whistleblowers in their efforts by following the law are also retaliated against with alarming frequency.

This is what whistleblower laws are supposed to deter. But they're ultimately toothless, especially when it comes to presidential appointees who can be hired and fired at will. Since the protections only go so far, whistleblowers are likely to be deterred by appointees inhabiting the "proper channels," who may selectively bury reports to ensure their own employment continues. Those that do pass on information that will displease the administration put their own necks on the line, and that's the sort of ideal that rarely has a 100% participation rate in Washington, DC.

It would be nice if these protections -- and the rules against retaliation -- were respected across the board. But they'll never be. They'll only be used when they're politically expedient.

Filed Under: donald trump, friday night massacre, inspector general, leaks, michael atkinson, retaliation, whistleblower protections, whistleblowers

New Inspector General's Report Finds Even More Problems With The FBI's FISA Surveillance Applications

from the demanding-the-best-people-but-demanding-nothing-from-them dept

The FBI's inability (or unwillingness) to craft factual FISA court affidavits was exposed late last year by an investigation by the DOJ's Inspector General. During the FBI's surveillance of former Trump advisor, Carter Page, information known by the agency was omitted to allow agents to continue its interception of Page's communications. Despite having obtained info showing Page was likely not acting on behalf of a foreign power, the FBI continued its surveillance for months by hiding this key finding from the FISA court.

The fallout from this report continues. The FISA Court banned the FBI agent who lied on the warrant applications. The court also instructed the FBI to start cleaning up its Carter Page mess, including tracking down where any other info it might have illegally collected in this case might have gone, in order to prevent further violations by other agencies in the future.

Current and former DOJ/FBI officials made it clear the FBI's questionable actions in this case were only the agency's most current violations. The skirting of internal guidelines and the truth itself was a common practice dating back nearly 20 years.

The Inspector General's findings in the Page investigation were the tip of the unexpected iceberg. The IG is now looking at the rest of the FBI's FISA work. And the office is finding even more to be concerned about.

The finding of broader failings in the Foreign Intelligence Surveillance Act program came in a review launched by Justice Department Inspector General Michael Horowitz after an earlier inquiry found numerous errors in applications to monitor former Trump campaign foreign policy adviser Carter Page. In a bid to assess whether the faults in the Page’s surveillance process were an aberration or a chronic problem, Horowitz’s audit team zeroed in on 29 applications for surveillance of U.S. citizens or green-card holders over a five-year period.

Horowitz found an average of 20 errors in each of the applications.

It's impossible to say how many of these errors were accidental or deliberately induced. But an average of 20 errors per application is breathtaking, considering the FISA court's national security focus. This is where the government should be the most careful and the FBI clearly isn't. And if this is where the FBI's top agents end up, you have to wonder how many errors normal, non-FISA applications contain.

There's a specific set of policies the FBI is supposed to adhere to when asking the FISA court for permission to engage in domestic surveillance. Even the most minimal conditions of the Woods Procedures aren't being followed by agents. The Procedures say the FBI must compile and retain supporting documentation to ensure FISA applications are "scrupulously accurate." We already know the applications aren't accurate. The report [PDF] points out at least one reason why:

[W]e could not review original Woods Files for 4 of the 29 selected FISA applications because the FBI has not been able to locate them and, in 3 of these instances, did not know if they ever existed…

The system appears to be broken from the ground up. The applications contain errors. The supporting information isn't accurate when it isn't missing completely. Interviews with agents and supervisors by the IG reveal this has been an ongoing problem for years now. And no one up top is doing anything to fix it.

FBI and NSD officials we interviewed indicated to us that there were no efforts by the FBI to use existing FBI and NSD oversight mechanisms to perform comprehensive, strategic assessments of the efficacy of the Woods Procedures or FISA accuracy, to include identifying the need for enhancements to training and improvements in the process, or increased accountability measures.

Every 90 days, the FBI is supposed to justify continued surveillance to the FISA Court. It did this multiple times during the Carter Page investigation, continuously omitting facts that would have resulted in its surveillance being terminated. The FBI does this in multiple cases, apparently. A mixture of malice, stupidity, and laziness has resulted in the mess observed by the Inspector General.

[B]ased on the results of our review of two renewal files, as well as our discussions with FBI agents, it appears that the FBI is not consistently re-verifying the original statements of fact within renewal applications. In one instance, we observed that errors or unsupported information in the statements of fact that we identified in the initial application had been carried over to each of the renewal applications. In other instances, we were told by the case agents who prepared the renewal applications that they only verified newly added statements of fact in renewal applications because they had already verified the original statements of fact when submitting the initial application. This practice directly contradicts FBI policy.

The FBI agrees with the IG's assessment that it's terrible at following its own policies. But the response attached to the IG report -- crafted by the Deputy FBI director -- says things will be fine because… the FBI is creating more policies!

[T]he FBI has been intensely focused on implementing these remedial measures with the goal of ensuring that our FISA authorities are exercised with objectivity and integrity. Among many other changes, we revised FISA request and verification (Woods) forms, developed a new confidential human source checklist, developed and released training on this checklist, developed and provided new training on revised FISA forms, and developed new FISA process rigor training. The revised Woods form now requires agents and supervisors to attest to their diligence in re-verifying facts from prior applications. All Woods forms, both for initial applications and renewals, must now be scanned and maintained in the electronic case file. These already-implemented changes will drive accountability, accuracy, and completeness in the FISA process.

All of this new paperwork doesn't mean anything if the FBI isn't going to make sure agents follow it. The problems seen in 2002 still exist nearly 20 years later, and that's after the implementation of additional policies following every successive reaming from the Inspector General and the FISA Court. If the FBI isn't going to start engaging in serious oversight -- including meaningful discipline of agents who fail to follow policies -- the problems will continue. The only change will be the length of oversight reports, which will contain details of all the new ways the FBI is ignoring its own protocols.

Filed Under: 4th amendment, carter page, doj, fbi, fisa, fisa court, fisa warrants, fisc, inspector general, surveillance

Defense Department Watchdog Says Retaliation Against Whistleblowers Is The Rule, Not The Exception

from the coloring-outside-the-lines-is-still-the-best-option dept

The more things change, the more whistleblowers still don't have protections worth a shit. President Trump is waging a war on whistleblowers -- about the only thing he's doing that isn't the polar opposite of his predecessor. For three straight presidencies, government employees seeking to report wrongdoing and misconduct have been shut down, ignored, and retaliated against, despite periodic protections being erected by legislators.

The Defense Department's watchdog made it clear during recent testimony that things are no better at the agencies he oversees. Eric Katz of Government Executive has more details.

Officials at the Defense Department are not taking action when the inspector general validates allegations of whistleblower reprisal, Glenn Fine, who is currently performing the duties of the Pentagon’s IG, told a panel of the House Oversight and Reform Committee. He called it critical that management take prompt remedial action and called on Congress to take action when the department fails to do so.

“Recently, we’ve seen a disturbing trend of the [Defense Department] disagreeing with the results of our investigation or not taking disciplinary action in whistleblower reprisal cases without adequate or persuasive explanations,” Fine said. “Failure to take action sends a message to agency managers that reprisal will be tolerated and also to potential whistleblowers [that they] will not be protected.”

Since no one really wants to protect whistleblowers, whistleblowers aren't being protected. Fine may want to protect whistleblowers, but his hands are tied. He can accept reports and pass them on, but he can't do anything meaningful to deter reprisal because his powers are (purposefully) limited and the protections paper-thin. He can only hope his oversight -- Congress -- takes this issue as seriously as he does.

But it seems unlikely Congress will help. The President himself has threatened the whistleblower who reported Trump's inappropriate phone call with Ukraine president Volodymyr Zelensky. Other legislators have made similar statements, expressing their displeasure with anyone who would insinuate their president is anything but an upstanding example for all Americans.

The chilling effect of these statements and actions is real.

A recent Government Executive survey found one-in-three federal employees are now less likely to report wrongdoing to the appropriate authorities due to attacks by Trump and congressional Republicans on the whistleblower whose filing kicked off the impeachment proceedings. Another 16% said they are now more likely to blow the whistle.

More than 50 Inspector Generals signed a letter condemning the White House Office of Legal Counsel's opinion that it's cool and legal to unilaterally block whistleblower reports. But this -- and Fine's statements -- are being lobbed into a highly-unreceptive atmosphere. This administration doesn't want to hear the shrill, nonstop sound of dozens of blown whistles... no more than the last one did. A threatened whistleblower is a silenced whistleblower and for far too many government agencies -- and the legislators that oversee them -- no news is the best news. Is it any wonder so many whistleblowers opt out of this corrupted system?

Filed Under: defense department, donald trump, inspector general, retaliation, whistleblowers