Ninth Circuit Appeals Court May Have Raised The Bar On Notifying Defendants About Secretive Surveillance Techniques

from the PARALLEL-CONSTRUCTION-INTENSIFIES dept

Recently -- perhaps far too recently -- the Ninth Circuit Appeals Court said the bulk phone records collection the NSA engaged in for years was most likely unconstitutional and definitely a violation of the laws authorizing it. The Appeals Court did not go so far as to declare it unconstitutional, finding that the records collected by the government had little bearing on the prosecution of a suspected terrorist. But it did declare it illegal.

Unfortunately, the ruling didn't have much of an effect. The NSA had already abandoned the program, finding it mostly useless and almost impossible to comply with under the restrictions laid down by the USA Freedom Act. Rather than continually violate the new law, the NSA chose to shut it down, ending the bulk collection of phone metadata… at least under this authority.

But there's something in the ruling that may have a much larger ripple effect. Orin Kerr noticed some language in the opinion that suggests the Ninth Circuit is establishing a new notification requirement for criminal prosecutions. For years, the government has all but ignored its duty to inform defendants of the use of FISA-derived evidence against them. The DOJ has considered FISA surveillance so secret and sensitive defendants can't even be told about it. Defendants fight blind, going up against parallel construction and ex parte submissions that keep them in the dark about how the government obtained its evidence.

The language in the Ninth Circuit ruling changes that. It appears to suggest (but possibly not erect, unfortunately) an affirmative duty to inform defendants about surveillance techniques used by the government.

In Moalin, the question was whether defendants had to be notified about a warrantless national security program involving telephone metadata that had been collected about them as part of the investigation. I would have thought the answer is no. Most obviously, there was no search warrant about which to give notice. And beyond that, I would have thought the program under then-existing precedent not to be a search at all.

The Ninth Circuit imagines a different kind of notice requirement, though. Instead of a notice requirement that a warrant was executed, flowing from the warrant itself, this is a notice requirement that appears to be triggered only if and when criminal charges are filed providing notice that evidence about a person was collected using a surveillance practice that may or may not be a search. In effect, it’s a notice to criminal defendants to consider filing a motion to suppress to challenge the investigation and vindicate any Fourth Amendment rights that may or may not have been at stake.

Huge if true. This is the court giving defendants an opportunity to suppress evidence derived from surveillance efforts courts may not (at this point) consider searches under the Fourth Amendment. The Constitutionality may be unsettled, but that shouldn't limit defendants' ability to raise challenges. This is from the opinion:

The principal remedy for a Fourth Amendment violation is the exclusionary rule: a criminal defendant may seek suppression of evidence obtained from an unlawful search or seizure, as well as of the “fruits” of that evidence—additional evidence to which it led. See Wong Sun, 371 U.S. at 488. But criminal defendants who have no knowledge that a potentially unconstitutional search has played a part in the government’s case against them have no opportunity to vindicate any Fourth Amendment-protected rights through suppression.

Notice is therefore a critical component of the Fourth Amendment in the context of a criminal prosecution. And although the Fourth Amendment may apply differently to foreign intelligence surveillance than to searches undertaken in ordinary criminal investigations, notice of a search plays the same role in the criminal proceeding: it allows the defendant to assess whether the surveillance complied with the Fourth Amendment’s requirements, whatever the parameters of those requirements are. Indeed, the Supreme Court has recognized that the notice provisions in FISA and the FAA serve precisely that function.

According to the Ninth Circuit, the Fourth Amendment standard of providing notice to defendants also applies to searches that the government (and some courts) have considered to be outside of the Fourth Amendment's reach -- like the acquisition of third-party records and foreigner-targeting surveillance efforts.

The government can still provide notice without giving up its secrecy, which should (hopefully) limit the number of times the government claims national security trumps all other rulings, regulations, precedential decisions, and Constitutional amendments. The government can have its secrecy and its notification, says the court.

Given the need for secrecy in the foreign intelligence context, the government is required only to inform the defendant that surveillance occurred and that the government intends to use information obtained or derived from it. Knowledge of surveillance will enable the defendant to file a motion with the district court challenging its legality. If the government avers that disclosure of information relating to the surveillance would harm national security, then the court can review the materials bearing on its legality in camera and ex parte.

This would be breaking new ground, especially in cases where the government is using FISA-derived evidence. As Kerr points out, this isn't limited to settled Fourth Amendment precedent. This would allow defendants to challenge evidence derived from techniques and programs courts have yet to address. And this will (hopefully) force courts to confront unsettled Fourth Amendment issues, rather than dismiss them out of hand because no court has previously addressed novel (or secret) surveillance practices.

[N]ot only does it not require a warrant, it doesn’t even seem to require a search. The notice seems to be that evidence was obtained using a surveillance authority. It doesn’t appear to require that this authority is anything that has been understood to involve Fourth Amendment searches or seizures. Rather, the notice is provided so a person can bring a challenge and argue to a court that it’s a search or seizure, and an unreasonable search or seizure at that.

Put another way, this appears to be a Fourth Amendment notice requirement to alert criminal defendants that the government took steps that might constitute a search—but also might turn out not to be a search at all once a court reviews the matter closely. It has faint echoes to me of Miranda v. Arizona, in that it’s a judicially created notice about your rights potentially at stake so that you can take action to vindicate your rights.

If this is what the court is saying, the Ninth Circuit will be handling all sorts of interesting -- and precedent-setting -- cases in the near future. If the government has to be honest about its surveillance techniques, it will no longer be able to dodge Constitutional scrutiny by citing the Third Party Doctrine or claiming national security issues prevent it from informing defendants of the origin of evidence used against them.

This will have the most impact in cases where FISA evidence is in play and the government -- perhaps secure that its national security mantra will encourage the court to aid and abet in obfuscation -- hasn't bothered to engage in parallel construction. On the flipside, government lawyers have probably already parsed this latent threat to unearned secrecy and will be encouraging everyone involved to perform their surveillance in triplicate to prevent the establishment of warrant requirements in cases where reasonable suspicion can't even be met.

Filed Under: 9th circuit, criminal, due process, intelligence community, parallel construction, surveillance

Second Circuit Says Warrantless Backdoor Searches Of NSA Collections Might Violate The Fourth Amendment

from the stay-in-your-own-lane,-g-men dept

The Second Circuit Court of Appeals has suggested -- not exactly ruled -- that backdoor searches of Section 702 collections targeting Americans (citizens and permanent residents) is a violation of the Fourth Amendment.

The case involves Agron Hasbajrami, a lawful permanent resident who was arrested in 2011 as he attempted to board a flight to Turkey. The government claimed Agron -- an Albanian immigrant -- was ultimately headed to Pakistan to join a terrorist organization.

Agron is somewhat of a unicorn. He's one of the few defendants that's actually been informed the evidence used against him was derived from NSA collections under Section 702. The DOJ is supposed to be proactive about this, but instead has chosen to emphasize parallel construction over transparency.

The evidence appears to have come from a backdoor search by the FBI. The FBI is allowed to access Section 702 collections, but domestic data and communications are supposed to be "minimized" to protect US persons swept up by the NSA. If the FBI performs backdoor searches to access Americans' communications that have been incidentally collected by the NSA foreign-facing surveillance programs, it should have to obtain a warrant. But that's not actually the case for a couple of reasons. First, very few defendants are ever informed of the true source of the evidence against them. Second, the secrecy shrouding the NSA's collections and the Intelligence Community's access prevents a lot of judicial examination in the few cases where evidence can actually be challenged.

The Second Circuit's ruling [PDF] kicks Hasbajrami's case back down to the lower court so it can reexamine the Fourth Amendment implications of warrantless backdoor searches. The Appeals Court has no problem with the NSA's collections, which putatively target foreigners. The court says these are lawful. Accessing collected communications from Americans via the NSA's collections, not so much.

The issue here isn't the collection itself or any inadvertent collection of US persons' communications. The problem is the querying of stored communications without a warrant when the target of the queries is a US person. The court doesn't say the FBI can't look at its own stored collections without a warrant to locate intelligence or evidence. Stuff it has already acquired is fair game, more or less. The court makes a physical analogy:

It is true the FBI does not need an additional warrant to go down to its evidence locker and look through a box of evidence it collected from a crime scene.

But that's where the analogy ends.

But lawful collection alone is not always enough to justify a future search.

Pointing to the Riley decision, the court notes that the lawful seizure of an arrestee's phone does not give law enforcement the right to perform a warrantless search of its contents.

Searching the FBI's own data stores tipped to it by the NSA isn't nearly as problematic as what the FBI appears to have done here: browsing the NSA's much larger collection without a warrant to find more communications originating from a US person. Say goodbye to any flattering "evidence locker" analogies.

If such a vast body of information [250 million emails as of 2011] is simply stored in a database, available for review by request from domestic law enforcement agencies solely on the speculative possibility that evidence of interest to agents investigating a particular individual might be found there, the program begins to look more like a dragnet, and less like an individual officer going to the evidence locker to check out a previously-acquired piece of evidence against some newfound insight.

And there's where the Fourth Amendment fits in:

To permit that information to be accessed indiscriminately, for domestic law enforcement purposes, without any reason to believe that the individual is involved in any criminal activity and or even that any information about that person is likely to be in the database, just to see if there is anything incriminating in any conversations that might happen to be there, would be at odds with the bedrock Fourth Amendment concept that law enforcement agents may not invade the privacy of individuals without some objective reason to believe that evidence of a crime will be found by a search.

The case returns to the lower court so it can consider the Fourth Amendment implications it chose to ignore when considering the defendant's motion to suppress evidence that is starting to look like it was acquired unconstitutionally.

If this results in suppression, this case is going to travel right back up the judicial ladder. There's no way the government is going to let its backdoor searches be subject to a warrant requirement. Warrants create paper trails, and the last thing the IC wants is more paperwork linking domestic surveillance to foreign-facing NSA collections. This isn't a win yet, but if the district court aligns itself with the Appeals Court's suggestions, it could be a game changer.

Filed Under: 2nd circuit, 4th amendment, agron hasbajrami, backdoor searches, evidence, fbi, nsa, parallel construction, section 702

EFF Wins FOIA Lawsuit Against DEA, Forces The Release Of More Info About Its Hemisphere Program

from the creeping-transparency dept

Thanks to a FOIA lawsuit, the EFF has lifted a number of redactions from documents detailing the DEA's Hemisphere program. This program was first exposed in 2013 when the New York Times obtained documents showing AT&T was working side-by-side with government agents to hand over massive amount of call records in response to DEA subpoenas.

AT&T has always considered itself to be an integral part of federal government surveillance programs, often going beyond what's required to comply with demands for info. In the case of Hemisphere, it appeared to be operating as an unofficial arm of the government by "embedding" personnel in the DEA to expedite its surveillance efforts.

More documents obtained by other FOIA requesters have peeled back a little bit of the secrecy. Even with redactions in place, the astonishing breadth of Hemisphere's surveillance capabilities was evident. Communications contained in the documents showed both the DEA and AT&T encouraged hiding the program from criminal defendants and the courts overseeing their cases. Parallel construction was the de facto policy, preventing anyone outside of US law enforcement from attacking the origin of evidence used against them.

The EFF's lawsuit victory has revealed even more of the program's inner workings [PDF], including the forms used by the DEA to initiate phone record searches. The searches hardly appear to be targeted, as agents were able to capture an unlimited amount of call data using a single subpoena.

Redactions lifted from previously-released emails show US law enforcement agencies using Hemisphere being told directly to engage in parallel construction.

Operation Hemisphere was initiated after 9/11 and is the name of an AT&T pointing mechanism to give the requester telephonic information that crosses through AT&T towers/switches. When all other means are exhausted in trying to locate a replacement number, a Hemisphere request may be submitted. Similar to ETS information, Hemisphere information is not to be used in 6s, affidavits, etc.

When such information is needed, the requestor submits a special subpoena issued to AT&T and send it to the Op. Hemisphere POC, who then forwards it to the Hemisphere representative in Los Angeles. The response often determines whether or not the agent or analyst will perform a parallel construction.

It also shows the DEA attempting to disavow ownership of the program it spearheaded and recommended to local law enforcement agencies. In response to Rep. Darrell Issa's inquiries about the program -- prompted by the 2013 New York Times reporting -- the DEA tried to claim it had no control of the program and could not discuss it with Congressional oversight.

However, I would note that we will NOT be able to brief on Hemisphere-this is NOT a DEA program. It was created by and is currently managed by ONDCP. I don't want to push you oft: but Hemisphere is not in our wheelhouse.

This is from Erik Akers of the DEA, making the incredulous assertion a program used hundreds of times by the DEA is not "in the DEA's wheelhouse." Akers pushes it back on the Office of National Drug Control Policy, which doesn't appear to be empowered to create and deploy surveillance programs. Here's what the ONDCP can do, according to the federal government's own website.

A component of the Executive Office of the President, ONDCP was created by the Anti-Drug Abuse Act of 1988. The ONDCP Director is the principal advisor to the President on drug control issues. ONDCP coordinates the drug control activities and related funding of 16 Federal Departments and Agencies. Each year, ONDCP produces the annual National Drug Control Strategy, which outlines Administration efforts for the Nation to reduce illicit drug use, manufacturing and trafficking; drug-related crime and violence; and drug-related health consequences. ONDCP also leads the development of the consolidated Federal drug control budget, which is published annually in the National Drug Control Strategy: Budget and Performance Summary.

The ONDCP is advisory. It may provide legal guidance when crafting programs, but there's nothing in the office's duties that includes creating and engaging in surveillance/collection programs. It may serve as the administrative body above the nation's HIDTA (High-Intensity Drug Trafficking Area) activities, but it's not the agency that approaches telcos and demands call records. The DEA does that. To pretend it doesn't is laughable, but that's exactly what the DEA did when its program was exposed by journalists.

The Los Angeles HIDTA -- which oversees roughly a third of the nation -- put out this statement to participants in the Hemisphere program, again in response to 2013's exposure of the program. In it, the HIDTA claims the program is legal, super-powerful, nothing like the NSA, and somehow entitled to secrecy because the DEA and US law enforcement have nothing to hide.

IF HIDTA in general decides to put out some edict to not allow your agents/detectives to utilize this ''tool" it would give the impression to the "common man" .. . jury standards ... that we collectively did something WRONG ... which as we all know is the furthest from the truth.

Hemi is nothing more than AT&T's "Super Search Engine" ... "Google on Steroids" as it were .. . A software record search system developed to reach into AT&T's numerous stove-piped databases; coupled with Analysts who knows what we (law enforcement) is asking for as well how to interpret their confusing raw record data once retrieved ... And all is done through legally approved documents (Admin Subpoena for Feds, Court Orders by State/Locals). That's it ... Nothing more, nothing less ... Period.

Additionally, from a legal perspective ... this system was scrutinized by Corporate Attorneys, Local, State and Federal Prosecutors, US DOJ, FBI and DEA General Counsel Attorneys, and Judges as well ... ALL OF WHOM concur that Hemi is a legal tool ... and nothing MORE than just a "tool."

As far as "keeping it a secret" per se (an issue raised in the articles based on one of the slides) ... Our rational has been simple and truly hasn't changed since the beginning of Sir Robert Peel and the origins of today's "Modern Day Law Enforcement" ... we were attempting to NOT educate the Cartel Attorneys et al on the systems and practices we law enforcement professionals legally have available at our disposal (Key word LEGALLY!)

The article "likens" the Hemisphere Project with the NSA Project ... In short, they're apples & oranges. To access Hemisphere a law enforcement officer/agent must have PC specific to their search request, then must provide either a Federal Admin Subpoena or have a judge sign a Court Order in the case of state/local investigators. This is in total contrast to the blanket Patriot Act search methods used by NSA.

To sum up: the DEA doesn't want to talk about a program it claims it doesn't control. The DEA redacted tons of info about a program that's completely legal and it shouldn't have to justify to the American public, while simultaneously hiding the use of the program from criminal defendants and judges. It is not the NSA, the DEA claims, while engaging in many of the NSA's tactics, like parallel construction and Glomar-esque non-denial denials of the program's existence.

Over in the private sector, AT&T decided it was more DEA than telco to engage in the program, turning a decent profit on unchecked surveillance and benefiting from the legal immunity extended to private sector participants in government surveillance programs. More details will likely emerge, but it's unlikely to uncover some previously-withheld justification that makes the DEA's use of "Google on steroids" phone record searches acceptable.

Filed Under: dea, foia, hemisphere, parallel construction, surveillance
Companies: at&t, eff

Report Shows US Law Enforcement Routinely Engages In Parallel Construction

from the no-solution-in-sight dept

A long report by Human Rights Watch delves into the secretive world behind the evidence given in criminal cases. Multiple law enforcement entities are making use of DEA tips to build cases and secure convictions, but they're burying the original evidence using parallel construction, whitewashing it of possible Fourth Amendment violations.

Parallel construction is nothing new. The DEA has been a long-time participant in the practice. Documents obtained by C.J. Ciaramella in 2014 included training materials laying out explicit directions for hiding the origin of questionably-obtained intelligence. The DEA has had full access to domestic phone records thanks to the Hemisphere program. Records obtained via this legally-dubious method have been passed on to local law enforcement agencies with instructions to obscure the origin of "new" criminal investigations.

The FBI has also encouraged parallel construction, most notably with the non-disclosure agreements its forces local agencies to sign before acquiring cell tower spoofers. Agencies are told to keep info about Stingray devices out of court at all costs -- up to and including dismissing charges. Consequently, Stingray deployments have been hidden behind ping requests and pen register orders, preventing courts from examining the origin of the evidence for Constitutional issues and preventing defendants from challenging the legality of the evidence used against them.

Parallel construction goes far beyond Stingrays and phone records. It can involve nascent technology with unproven track records, allowing criminal sentences to be obtained based on very questionable evidence.

Parallel construction also means judges may never evaluate whether government uses of constantly evolving surveillance techniques adhere to the US Constitution and laws adopted by Congress, as is their role in the US system. For example, if the government were to identify a suspect in a robbery by scrutinizing a store’s security video using a new but flawed facial recognition technology it does not want to reveal, it could send an informant to talk to the suspect and report what he said—then suggest in court records that this conversation was how the investigation began. Such possible uses of parallel construction are especially troubling in human rights terms because new technologies may be inaccurate (including, in the case of facial recognition software, for people of certain racial or ethnic groups) or raise new legal concerns. Unless judges are aware that such new technology has been used, they will not be able to assess whether the technology violates rights.

But judges won't be seeing much info on government surveillance means and methods that the government wishes to keep hidden from the public. The DOJ has dodged its evidentiary obligations for years in regards to NSA-derived evidence, despite multiple government agencies having some sort of access to the NSA's collections.

Worse, the courts have encouraged the practice of parallel construction by giving officers free rein to perform pretextual stops. Any real or perceived traffic violation can serve as a pretext for stop meant to discover evidence of some unrelated crime. A 20-year-old Supreme Court decision turned traffic stops into fishing expeditions.

The Supreme Court's Rodriguez decision only slightly mitigates the damage done by the 1996 decision. It holds a traffic stop ends when the stated objective is completed. If an officer stops someone for speeding -- even if the real purpose is to search for evidence of drug trafficking -- the stop is over when the citation or warning is given. What this means in practice is law enforcement has to move faster to find something approximating reasonable suspicion to extend the stop. Slow-walking the stop until a drug dog arrives still works most of the time.

If more courts were willing to hold officers to the spirit of the decision, pretextual stops would become a very precarious way to obtain evidence. Instead, the courts have generally been willing to continue to give the government considerable leeway during pretextual stops.

This is what keeps the lights on in the DEA's Special Operations Division. Known colloquially as the "Dark Side," the DEA's SOD passes on tips to locals, pointing them at DEA surveillance targets while ensuring these local agencies understand they'll have to find another way to come up with the evidence the DEA has already handed them.

Sources consistently describe the SOD as distributing tips to other agencies, subject to a mutual understanding that the tips will not be revealed in court proceedings. Typically, the division does not disclose the original source of its knowledge, even to other law enforcement officers or prosecutors. Rizer explained the government’s perspective after obtaining and deciding to share information that may be useful in a US criminal investigation: “A lot of times, you don’t want the bad guys to know how you got [the] information…. You want to give [law enforcement] just enough” to start an investigation, but “not enough to know where everything came from.”

This generally leads to pretextual stops, known by a number of unofficial nicknames synonymous with parallel construction:

The documents Ciaramella obtained indicate that the use of “[a] wall off or pretext stop” is an accepted tactic. Human Rights Watch has also identified numerous federal and state judicial decisions in which the government has admitted, after the fact, to having carried out what are known as “whisper,” “wall,” “walled off,” or “wall off” stops. It is unclear how the government decides whether to disclose the fact a traffic stop was pretextual on its own initiative during proceedings: in at least one case Human Rights Watch identified, the disclosure of a “wall stop” was inadvertent (evidence emerged in a New Mexico federal trial that an officer had mentioned a “whisper stop from DEA” to a dispatcher while unaware that he was being recorded). In another case a defendant who had been convicted in Arizona state court only found out the traffic stop in his case was a “whisper stop” requested by the DEA after his conviction, when pertinent records were later disclosed in a California federal court.

"Whisper" refers to federal tipsters who are not to be exposed in court. "Wall stops" refer to building a "wall" between the evidence obtained via the pretextual stop and its true origin via DEA sources. In both cases, nothing about the original evidence can be challenged. Evidence obtained via bulk surveillance or warrantless intercepts remains hidden. The trustworthiness of confidential informants cannot be questioned. It remains walled off from the court and defendants, forcing them to work only with what was derived from a traffic stop that likely would not have happened without the intervention of a government agency whose name never appears in court documents.

To fix the problem of parallel construction, Human Rights Watch suggests a legislative fix. Unfortunately, as solid as the recommendations are, there's roughly a zero percent chance a bill like this would make its way to the president's desk.

Congress should… adopt legislation requiring that all executive branch agencies be treated as part of the prosecution for the purposes of obligations to disclose exculpatory information. Additionally, it should evaluate the judicially developed doctrines (such as applications of the “independent source” doctrine, interpretations of Whren, and the doctrine of collective knowledge) that may facilitate law enforcement’s use of searches and seizures for parallel construction purposes and consider imposing restrictions accordingly.

To address the possibility that parallel construction is used to conceal potentially unconstitutional surveillance, we recommend that Congress adopt legislation strictly requiring the executive branch to notify defendants in all criminal cases of any employment of investigative techniques involving the surveillance of communications or metadata, or the compilation or monitoring of other personal data such as biometric data. Congress should also adopt similar requirements for other proceedings in which individuals’ rights are adjudicated (such as immigration proceedings). Such legislation should impose requirements on prosecutors to determine whether such techniques were employed. In general, Congress should exercise stronger oversight over surveillance and other forms of data-gathering that take place under intelligence authorities.

The first recommendation would make all government agencies answerable to discovery requests. This is an important fix, and one that would face a less of an uphill battle in Congress. Currently, any agency that has passed on info used in parallel construction can simply claim its not part of the prosecution and is therefore not required to hand over information to the defense. This would force agencies to search for and produce documents related to the origins of the evidence handed over to local agencies. Or would in theory. The DOJ has spent years dodging evidentiary obligations for Section 702 cases (another place parallel construction is a common practice), so it's apparent the Justice Department picks and chooses which statutory requirements it will follow. Another law on the books won't make much of a dent.

As it stands now, the system will allow the government to continue to prosecute people while withholding information pertaining to questionably-obtained evidence. Supreme Court decisions on traffic stops haven't made things much better, even with more recent decisions adding a bit back to citizens' Fourth Amendment protections. The end result is ugly: the government can lie with impunity, making a mockery of the Fourth Amendment in the process.

Filed Under: 4th amendment, dea, due process, evidence, parallel construction
Companies: human rights watch

Things The Intelligence Community Is Cool With: Backdoor Searches, Skirting Reporting Requirements, Parallel Construction

from the it's-pretty-clear-the-FBI-needs-more-direct-oversight dept

More answers have been provided to Senate Intelligence Committee questions (most of those penned by the always-inquisitive Ron Wyden) by the Office of the Director of National Intelligence. Some, like how often the NSA "incidentally" collects domestic communications, remain unanswered. But the ODNI's answers [PDF] -- given to the Committee in July -- have finally been made public. There are a few things worth noting in this rare display of transparency. (By which I mean a lack of redactions, rather than expansive openness by the ODNI).

To begin with, the ODNI argues the new amicus position created by the USA Freedom Act is harmful to national security. Its theory? Any delays caused by the introduction of some semblance of an adversarial process only slows the NSA down.

The appointment of an amicus curiae is not without effect. Notably, it is likely to increase the time needed for the government to obtain the authorities it is seeking. For instance, in 2015 when the FISC appointed an amicus curiae in connection with its review of the Section 702 certifications, the Court ultimately extended the time for its consideration of the 2015 Section 702 certifications by 90 days, issuing an opinion and order approving those certifications more than two months alter the statute otherwise would have required. As the government noted at that time, such a delay could be harmful to national security under certain scenarios, for instance if the government were to submit an additional certification or make an important time sensitive change in the Section 702 targeting or minimization procedures.

This sounds a lot like law enforcement's continual annoyance at warrant requirements. Respecting things like the Fourth Amendment and the idea of checks and balances just takes too long -- even when it means spending a hour trying to talk someone into granting consent for a search, rather than phoning a judge to get a warrant sworn out. The ODNI's complaint is, basically, it doesn't want anyone arguing for the rights of Americans (who get swept up in collections and deliberately targeted by the FBI) or on behalf of the rest of the world the NSA views as little more than a prolific source of data.

Wyden also wanted to know who's allowed to unmask US persons in NSA collections. The ODNI answered "any authorized recipient" of NSA intelligence, which hardly answers the question. Drilling it down a little further, the ODNI noted it has 20 individuals in the NSA who can authorize unmasking. There are doubtless many more in the FBI, which can use 702-derived collections to search for evidence of nearly any criminal activity or just browse stuff if it can be argued the information is already "publicly available." The decision to unmask US persons in the FBI is left to "agents and analysts" conducting "fully predicated investigations."

As for its all-but-abandoned duties to inform defendants of the use of Section 702-derived evidence, the ODNI explained it will almost never have to do this because of parallel construction.

As we have publicly stated previously, the Department has concluded that in determining whether information is "derived from" FISA-authorized surveillance, including Section 702, the appropriate standards and analyses are similar to those applied in the context of surveillance conducted pursuant to the criminal Wiretap Act, Title of the Omnibus Crime Control and Safe Streets Act of 1968, 18 U.S.C. 2510-2522. As such, the "derived from" standard incorporates a "fruit of the poisonous tree" analysis analogous to that conducted under the Fourth Amendment exclusionary rule context. The general question under a "fruits" analysis is whether the evidence was acquired as an indirect result of the surveillance, taking into account doctrines such as independent source, inevitable discovery, and attenuation.

In other words, if there's any way the government could have conceivably obtained this evidence -- rather than the way it actually did it -- the DOJ can bypass its notification obligations.

As for the number of times Intelligence Community components access purely domestic communications -- either directly or "incidentally" -- the ODNI is nowhere closer to providing the numbers explicitly requested by Sen. Wyden on multiple occasions or fulfilling the reporting requirements of USA Freedom Act.

The ODNI claims one recipient of 702 data (the CIA) "does not currently have the technical capability" to track these numbers. According to the ODNI, this capability won't be up and running until the end of 2018. The ODNI goes on to point out the FBI performs no internal tracking of its 702 searches/queries and makes no statement suggesting the agency is even looking into providing these numbers. The NSA, however, performed 30,355 "queries" on US persons' data, using 2,280 "approved" search terms.

The ODNI also explains the difference between a "query" and a "search" in reference to accessing unminimized domestic data and communications. A "query" flags relevant data in existing collections. A "search" actually looks at the contents of communications. In both cases, the ODNI says no warrant is needed. If the domestic communications are swept up lawfully (as part of a FISA-ordained collection), there's no Fourth Amendment violation when content is accessed by a "search." The legal rationale is that the Fourth Amendment is adhered to during the collection process, so it cannot possibly be violated when the collections are accessed by the FBI, NSA, CIA or other IC component.

Wyden's long-running question about incident collection of US persons communications remains unanswered. Questions about the FBI's prolific use of NSA data have been answered with a shrug. The DOJ has been given a pass on its evidence source obligations and IC components have multiple ways of search foreign-facing collections for US persons communications and data, all while supposedly upholding Fourth Amendment ideals. These are the powers the ODNI wants to see renewed for several years with zero changes to the status quo and, given the looks of surviving legislation, its wishes might come true.

Filed Under: backdoors, nsa, odni, parallel construction, reporting, ron wyden, surveillance

NSA, DOJ Still Aren't Letting Defendants Know They're Using Section 702 Evidence Against Them

from the only-losers-follow-laws dept

The NSA has never taken its evidentiary obligations seriously. The agency is supposed to inform the court and defendants if surveillance-derived evidence is being used against them. (And it's actually supposed to hand over the evidence as well.)

This just doesn't happen. The NSA encourages parallel construction to obscure the true source of evidence used in court cases. The FBI's access to Section 702 collections makes this much easier. It allows the FBI to present NSA evidence as its own, heading off any scrutiny of the NSA's programs and collection methods.

The NSA was always supposed to hand over this information. It's been mandatory for years. But it doesn't. After it was reported the NSA has misled none other than the Supreme Court of the United States about its fulfillment of evidentiary obligations, the agency briefly began complying with the law. It issued five notices in the span of a year (2013-2014) before going dark again.

It appears the NSA's brief flirtation with statutory compliance was just that: brief, cheap, and completely hollow. A show of compliance was made but the NSA had no intention of acting in good faith going forward. The Intercept is publishing more Snowden docs, these ones confirming the NSA's continued obligation-shirking.

A Uzbekistani man living in the US has just been convicted of terrorism charges -- something that followed several months of interaction with two FBI informants, including one who actually lived with him during the course of the investigation. The DOJ got its conviction, but it did it without fulfilling its statutory obligations.

[J]ustice Department lawyers gained their conviction against Kurbanov after failing to disclose a legally significant fact: Kurbanov’s conversations with his alleged terrorist associate had been captured through PRISM, a National Security Agency mass surveillance program whose existence was revealed in documents provided by whistleblower Edward Snowden. Under PRISM, the government obtains communications directly from at least eight large technology companies without the need for warrants, a type of practice authorized in 2008, when Congress provided new surveillance powers under FISA.

Using this collection program, along with the NSA's interpretation of its statutory obligations, no court anywhere is being informed about the collection itself or its use against defendants. When pressed for answers, the DOJ tends to respond with a hoisting of its national security talisman, which usually wards off additional judicial scrutiny.

The DOJ's oversight -- and the NSA's -- should know something's wrong. It's not as though all of this information can only be gleaned from leaked classified documents.

A nationwide review of federal court records by The Intercept found that of 75 terrorism defendants notified of some type of FISA spying since Section 702 became law, just 10 received notice of Section 702 surveillance. And yet Section 702 was credited with “well over 100 arrests on terrorism-related offenses” in a July 2014 report from the Privacy and Civil Liberties Oversight Board…

Those hyping a clean reauth of Section 702 are prone to pointing at gaudy numbers like that one. But they're also willing to overlook the much smaller numbers showing the NSA isn't playing by the rules. I guess we're just supposed to accept the fact that terrorist prosecutions will never be according to Hoyle. That's the price we pay for security, apparently: a mockery of due process and checks and balances in service of the greater good.

Filed Under: criminals, doj, evidence, nsa, parallel construction, section 702

Stingray Memo From FBI To Oklahoma Law Enforcement Tells PD To Engage In Parallel Construction

from the fake-it-til-you-make-it dept

The concept of "checks and balances" kind of takes a beating when one branch of the government says it's ok to lie to another branch. We've already seen the FBI tell law enforcement agencies -- through extensive NDAs it makes them sign before they can deploy cell site simulators -- that it's better to let suspected criminals walk away from charges than risk allowing details on Stingray devices to make their way into the public domain via submitted evidence.

Many law enforcement agencies appear to be doing exactly that. More than one agency has misled judges with applications for pen register orders and requests for cell site location data -- neither of which provide details on the technology actually being used.

Another memo from the FBI shows the federal agency directly instructing a local law enforcement agency to engage in parallel construction. The memo, obtained by Oklahoma Watch, explicitly spells out what is supposed to happen if cell site simulator use is part of the evidence chain. (h/t Nate Wessler)

Information obtained through use of the equipment is FOR LEAD PURPOSES ONLY, and may not be used as primary evidence in any affidavits, hearings or trials. This equipment provides general location information about a cellular device, and your agency understands it is required to use additional and independent investigative means and methods, such as historical cellular analysis, that would be admissible at trial to corroborate information concerning the location of the target obtained through use of this equipment.

The problem is that this sort of "lead" often leads directly to search warrants of residences where people are located. The Oklahoma City PD is being told to obtain other non-Stingray-related data that could plausibly explain how it managed to located Subject X at Location Y. Officers won't be telling magistrate judges when seeking pen register orders or subpoenas for cell location info. And officers won't be telling defendants or their representation how they managed to be in the right place at the right time with a search warrant.

The memo also notes that the FBI "will use all appropriate legal means" to prevent Stingray use from being uncovered in discovery requests. Apparently, "all appropriate legal means" covers parallel construction.

What sets this apart from the FBI NDAs we've covered here previously is that this memo is limited to the local law enforcement's borrowing of FBI equipment to locate suspects. With the FBI still in control of the device, it's obviously going to be that much more concerned with controlling the narrative.

Clifton Adcock of Oklahoma Watch notes that local law enforcement appears to be using Stingray devices but covering it up through pen register orders. In one case, this has led to a very suspect request from the Oklahoma City PD, suggesting it had borrowed an FBI cell site simulator to locate the defendant.

In one of those cases, a defense attorney, Douglas Parr of Oklahoma City, said he believes a cell site simulator was used to collect his client’s phone data. The client is charged with drug trafficking. During a hearing in Oklahoma County District Court in September 2015, Parr asked an Oklahoma City police detective whether a simulator had been used. The detective, who had requested the order, testified that to his knowledge such a cell site simulator had not been used.

Testimony in the case shows the officer did not file for a trap and trace order with the court until the day he testified in September – more than a year after he conducted the surveillance.

According to the FBI's new rules for Stingray use, warrants must be sought and provide explicit details about the technology being used -- including the facts that Stingrays search every phone in the area while trying to locate devices and that local service may be disrupted during deployments. The DOJ's ruleset arrived a few months after this particular Memorandum of Understanding was signed with the Oklahoma City PD. One would hope a revised version is on the way, if not already in the hands of Oklahoma law enforcement -- one that does a better job of reflecting the DOJ's current stance on warrants and information dissemination.

Filed Under: 4th amendment, evidence, imsi catcher, oklahoma, parallel construction, stingray

NSA's Stellar Wind Program Was Almost Completely Useless, Hidden From FISA Court By NSA And FBI

from the lies-on-top-of-lies-on-top-of-legal-quackery dept

A huge report (747 pages) on the NSA's Stellar Wind program has been turned over to Charlie Savage of the New York Times after a successful FOIA lawsuit. Stellar Wind has its basis in an order issued by George W. Bush shortly after the 9/11 attacks. Not an executive order, per se, but Bush basically telling the NSA that it was OK to start collecting email and phone metadata, as well as warrantlessly tap international calls into and out of the United States.

The extensive detailing of the program's history contains some rather surprising elements. While much of it remains redacted, there's still enough exposed that indicates the program was like many others the NSA has pursued: expansive, intrusive, done without oversight… and ultimately mostly useless.

In 2004, the F.B.I. looked at a sampling of all the tips to see how many had made a “significant contribution” to identifying a terrorist, deporting a terrorism suspect, or developing a confidential informant about terrorists.

Just 1.2 percent of the tips from 2001 to 2004 had made such a contribution. Two years later, the F.B.I. reviewed all the leads from the warrantless wiretapping part of Stellarwind between August 2004 and January 2006. None had proved useful.

Not that this lack of results kept those writing the report from celebrating the "successes" the FBI apparently couldn't find. Of course, there's nothing to be gleaned from this information because those have been completely redacted.

What is clear is that the program quite possibly did more harm than good. The NSA was sweeping up an unprecedented amount of information but -- because of its secret origins -- was mostly unable to share with the CIA or FBI. In particular, the warrantless wiretapping the NSA engaged in couldn't be passed on to the FBI until leaked details finally forced legislators to act on this apparent breach of Americans' privacy -- which they did by codifying the NSA's actions, making them perfectly -- and retroactively -- legal. Even then, it still posed problems for the FBI.

F.B.I. agents were asked to scrutinize phone numbers deemed suspicious because of information from the program. But the agents were not told why the numbers had been deemed suspicious, only “not to use the information in legal or judicial proceedings.”

That made some agents uncomfortable, and it was not clear how such mysterious leads fit into their rules for investigations.

The FBI, which is now heavily engaged in the management of parallel construction for law enforcement Stingray usage, found itself in the awkward position of disguising the origin of intelligence it hadn't specifically asked for, as well as having the NSA tell it what it could and couldn't say in front of judges. This would include applications made to the FISA court.

We asked [DOJ intelligence counsel James] Baker whether he thought the restrictions on the use of Stellar Wind-derived leads disseminated to field offices, as described above, were sufficient to guard against including Stellar Wind information in FISA applications. Baker stated that his experience with FBI record-keeping practices did not give him a high degree of confidence that such separation could be consistently maintained. In addition, Baker believed that the nature of FBI international terrorism investigations would make it difficult to track Stellar Wind-derived information. According the FBI OGC, Baker did not share with the FBI his concerns about whether its record-keeping practices would keep Stellar Wind information from being used in FISA applications.

Rather than disconnect the FBI from the influx of questionably-obtained NSA "tips," the administration worked with the DOJ to make it easier for the agency to find something to do with intelligence passed on by the NSA.

The Justice Department created the new type of investigation, initially called a “threat assessment,” which could be opened with lower-grade tips. Agents now use them tens of thousands of times a year.

Questionable "intel" leads to even more questionable not-quite-investigations. As can be seen by the FBI's own conclusions, about the only thing Stellar Wind did for it was increase the number of man hours wasted running down the NSA's "leads."

As for the FISA court, there's a good reason it's been perceived as a "rubber stamp" for NSA requests. Bush's secret executive authorizations were disclosed to FISA Judge Royce Lamberth by Bush himself. Further orders for these collections were routed only through Lamberth, and his successor, Colleen Kollar-Kotelly.

This belated admission (which did nothing to halt the collections) was prompted by none other than James Baker, who stumbled across a clumsy attempt at parallel construction.

[Baker] came across “strange, unattributed” language in an application for an ordinary surveillance warrant and figured it out, then insisted on telling Judge Lamberth.

Another FISA court judge did discover the NSA's Stellar Wind program, although to him it appeared to be an extensive string of telephone metadata abuses by the NSA. Judge Reggie Walton threatened to shut down the Section 215 collection entirely in 2009, concerned about the agency's deliberate misleading of the court on the program's inner workings and its extent. As Marcy Wheeler points out, these weren't technically "abuses." They were just Stellar Wind collections that failed to be properly obscured when placed in front of a FISA judge other than Colleen Kollar-Kotelly.

I have long scoffed at the claim that the phone dragnet violations discovered in 2009 were accidental. It has always been clear they were, instead, features of Stellar Wind that NSA simply never turned off, even though they violated the FISC orders on it.

The Stellar Wind IG Report liberated by Charlie Savage confirms that.

It describes that numbers were put on an alert list and automatically chained.

"An automated process was created to alert and automatically chain new and potential reportable telephone numbers using what was called an “alert list.” Telephone numbers on the alert list were automatically run against incoming metadata to look for contacts. (PDF 31)"

This was precisely the substance of the violations admitted in 2009.

Kollar-Kotelly, on the other hand, was much more indulgent when responding to NSA requests, allowing the agency to recast the low bar of pen register orders as justifying bulk email metadata collections obtained through Stellar Wind -- something she did a few years before the NSA allowed Stellar Wind to bleed into its Section 215 collections.

The documents don't restore any faith in the "oversight" of the NSA's activities. Instead, it shows two presidents acting in secrecy to permit the surveillance of American citizens and involved agencies covering it up with parallel construction, intense secrecy, manipulation of oversight bodies and several very questionable legal theories.

Filed Under: doj, fbi, nsa, parallel construction, stellar wind, surveillance

Documents Released In Silk Road Case Add More Evidence To The 'Parallel Construction' Theory

from the it's-not-HOW-we-got-it,-it's-what-we-HAVE dept

Ever since the government first declared it had located the Silk Road server linked to Dread Pirate Roberts (allegedly Ross Ulbricht) thanks to a leaky CAPTCHA, there have been questions about the plausibility of this explanation. Ulbricht's attorneys suggested it wasn't the FBI, but rather the NSA, who tracked the alleged Silk Road mastermind down. This suggested parallel construction, something federal agencies have done previously to obscure the origin of evidence and something the FBI actively encourages local law enforcement agencies to do when deploying cell tower spoofers.

Technical documents filed in response to discovery requests seem to solidify the parallel construction theory. Brian Krebs at Krebs on Security and Robert Graham at Errata Security have both examined the government's filings (the Tarbell Declaration [pdf]) and noted that what the government said it did doesn't match what's actually on display.

Krebs' article quotes Nicholas Weaver, a researcher at the International Computer Science Institute at Berkeley, who points out that where the FBI agents say they found the leak doesn't mesh with the server code and architecture.

“The IP address listed in that file — 62.75.246.20 — was the front-end server for the Silk Road,” Weaver said. “Apparently, Ulbricht had this split architecture, where the initial communication through Tor went to the front-end server, which in turn just did a normal fetch to the back-end server. It’s not clear why he set it up this way, but the document the government released in 70-6.pdf shows the rules for serving the Silk Road Web pages, and those rules are that all content – including the login CAPTCHA – gets served to the front end server but to nobody else. This suggests that the Web service specifically refuses all connections except from the local host and the front-end Web server.”

Translation: Those rules mean that the Silk Road server would deny any request from the Internet that wasn’t coming from the front-end server, and that includes the CAPTCHA.

Weaver says that FBI agents would have been served nothing at all when attempting to access the server without using Tor. The server simply wasn't leaking into the open web. The more likely explanation is that the FBI contacted the IP directly and accessed a PHPMyAdmin page.

Robert Graham's analysis of the documents notes something slightly different than Weaver, but still arrives at the same conclusion.

Brian Krebs quotes Nicholas Weaver as claiming "This suggests that the Web service specifically refuses all connections except from the local host and the front-end Web server". This is wrong, the web server accept all TCP connections, though it may give a "403 forbidden" as the result.

Even with this detail being off, the parallel construction theory still fits. Graham notes that the Tarbell Declaration (the filing that contains the official explanation of how the Silk Road server was accessed) is noticeably light on supporting documentation -- like screenshots, packet logs or code snippets.

Now that the government has been forced to hand over more technical documentation, it's original story is falling apart.

Since the defense could not find in the logfiles where Tarbell had access the system, the prosecutors helped them out by pointing to entries that looked like the following:

199.170.71.133 - - [11/Jun/2013:16:58:36 +0000] "GET / HTTP/1.1" 200 2616 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36"

199.170.71.133 - - [11/Jun/2013:16:58:36 +0000] "GET
/phpmyadmin.css.phpserver=1&lang=en&collation_connection=utf8_general_ci&token=451ca1a827cda1c8e80d0c0876e29ecc&js_frame
=right&nocache=3988383895 HTTP/1.1" 200 41724 "http://193.107.86.49/" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.110 Safari/537.36"

However, these entries are wrong. First, they are for the phpmyadmin pages and not the Silk Road login pages, so they are clearly not the pages described in the Tarbell declaration. Second, they return "200 ok" as the error code instead of a "401 unauthorized" login error as one would expect from the configuration. This means either the FBI knew the password, or the configuration has changed in the meantime, or something else is wrong with the evidence provided by the prosecutors.

The NSA as the purposefully-missing link makes sense. First off, Ulbricht's back end server was located in Iceland. Graham points out basic authentication was provided by this server via Port 80. If the NSA was monitoring traffic in and out of Iceland (as it is legally able to do), it could easily have captured a password for this server.

Furthermore, the front end server (located in Germany -- also within the NSA's established dragnet) would return "forbidden" errors when accessed outside of Tor, but would not when accessing PHP files (as Weaver noted). To get to the admin page, other possibly non-NSA-related tactics could have been used. (Graham suggests a couple of different methods well within the FBI's technical grasp and abilities -- "scanning the entire Internet for SSL servers, then searching for the string "Silkroad" in the resulting webpage" or doing the same but correlating the results with traffic traveling across the Tor onion connection.) However, none of the above is suggested by Tarbell's recounting of the events. In fact, the official narrative is vague enough that almost any explanation could fit.

Tarbell doesn't even deny it was parallel construction. A scenario of an NSA agent showing up at the FBI offices and opening a browser to the IP address fits within his description of events.

Graham calls the declaration from Special Agent Tarbell "gibberish" (and points out that Ulbricht's opsec "sucks"). Ulbricht's legal team is still pushing for the government to explain why its declaration doesn't match the details it's handed over during discovery. A new filing by his attorney, Joshua Horowitz, isn't much kinder, calling the declaration "implausible." [pdf link] The presiding judge has given the government until the end of Monday to respond to Horowitz's filing… if it wants to. [pdf link]

Defendant has submitted a declaration from Joshua Horowitz in support of his motion and request for an evidentiary hearing.

If the Government has any response to the factual statements (and/or relevance of the factual statements) asserted therein, it should file such response by C.O.B., October 6, 2014 (if possible).

The government may not feel compelled to respond. A filing from earlier in September (but added to the docket on Oct. 1st) suggests it's pretty much done discussing Ulbricht's "NSA boogeyman." [pdf link]

In light of these basic legal principles, the Government objects to the September 17 Requests as a general matter on the ground that no adequate explanation has been provided as to how the requested items are material to the defense. Most of the requests appear to concern how the Government was able to locate and search the SR Server. Yet the Government has already explained why, for a number of reasons, there is no basis to suppress the contents of the SR Server:

(1) Ulbricht has not claimed any possessory or property interest in the SR Server as required to establish standing for any motion to suppress;
(2) the SR Server was searched by foreign law enforcement authorities to whom the Fourth Amendment does not apply in the first instance;
(3) even if the Fourth Amendment were applicable, its warrant requirement would not apply given that the SR Server was located overseas; and
(4) the search was reasonable, given that the FBI had reason to believe that the SR Server hosted the Silk Road website and, moreover, Ulbricht lacked any expectation of privacy in the SR Server under the terms of service pursuant to which he leased the server.

Particularly given these circumstances, it is the defendant’s burden to explain how the contents of the SR Server were supposedly obtained in violation of the defendant’s Fourth Amendment rights and how the defendant’s discovery requests are likely to vindicate that claim. The defense has failed to do so, and the Government is unaware of any evidence – including any information responsive to the defense’s discovery requests – that would support any viable Fourth Amendment challenge. Instead, the defense’s discovery requests continue to be based on mere conjecture, which is neither a proper basis for discovery nor a proper basis for a suppression hearing.

The response document notes that it has already responded with several documents, won't be responding to a host of other requests, but most tellingly, says the government is "not aware" of any supporting documentation for Agent Tarbell's declaration. (As noted by Robert Graham, the declaration as written is "impossible to reconstruct," with the lack of technical details being a large part of that.)

5. The name of the software that was used to capture packet data sent to the FBI from the Silk Road servers.

Other than Attachment 1, the Government is not aware of any contemporaneous records of the actions described in paragraphs 7 and 8 of the Tarbell declaration. (Please note that Attachment 1 is marked “Confidential” and is subject to the protective order entered in this matter.)

6. A list of the “miscellaneous entries” entered into the username, password, and CAPTCHA fields on the Silk Road login page, referenced in the SA Tarbell’s Declaration, at ¶ 7.

See response to request #5.

7. Any logs of the activities performed by SA Tarbell and/or CY-2, referenced in ¶ 7 of SA Tarbell’s Declaration.

See response to request #5.

8. Logs of any server error messages produced by the “miscellaneous entries”referenced in SA Tarbell’s Declaration.

See response to request #5.

9. Any and all valid login credentials used to enter the Silk Road site.

See response to request #5.

10. Any and all invalid username, password, and/or CAPTCHA entries entered on the Silk Road log in page.

See response to request #5.

11. Any packet logs recorded during the course of the Silk Road investigation, including but not limited to packet logs showing packet headers which contain the IP address of the leaked Silk Road Server IP address [193.107.86.49].

See response to request #5.

Parallel construction matters, but the government claims it doesn't. It will probably continue to declare it a non-issue so long as the courts agree that Ulbricht's Fourth Amendment rights weren't violated. Ulbright's Fourth Amendment defense is admittedly a disaster, making claims that have nearly no chance of holding up under judicial scrutiny. The Silk Road indictment is a lousy test case for challenging parallel construction.

But parallel construction spills over into purely domestic investigations where Fourth Amendment rights are supposedly guaranteed. As long as the "expectation of privacy" isn't violated -- according to the government's definition of what does and doesn't enjoy this "expectation" -- the origin of the evidence isn't really up for discussion, according to the government's own filing. And what the government says here is that what was ultimately obtained matters more than how it was obtained. Parallel construction covers up invasive surveillance and investigative tactics, providing courts with evidence that looks clean but was illicitly gathered.

Filed Under: captcha, christopher tarbell, doj, fbi, investigation, parallel construction, ross ulbricht, silk road
Companies: silk road

NSA Makes Metadata (Including Info On Americans) Available To Domestic Law Enforcement Via 'Google-Like' Search

from the easy-peasy dept

The latest report from The Intercept on documents obtained from Ed Snowden (and, yes, they make it clear that these are from Snowden, rather than the purported "second leaker") is about a "Google-like" search engine that the NSA built, called ICREACH, which lets the NSA share a massive trove (at least 850 billion) of "metadata" records not just with others in the NSA or CIA, but with domestic law enforcement and other government agencies including the FBI and the DEA. The database includes records collected via Executive Order 12333, which we recently noted a State Department official revealed as the main program via which the NSA collects its data (and which is not subject to oversight by Congress).

While data collected under 12333 is supposed to be "minimized" to ditch information on "US Persons" we've already noted how backdoor searches get around that. Further, as this report reminds everyone, while "minimized" the NSA still keeps the data, and if someone (say, the DEA or FBI) wants to dig deeper, they can "un-minimize" the data.

However, the documents make clear that it is not only data about foreigners’ communications that are available on the system. Alexander’s memo states that “many millions of…minimized communications metadata records” would be available through ICREACH, a reference to the process of “minimization,” whereby identifying information—such as part of a phone number or email address—is removed so it is not visible to the analyst. NSA documents define minimization as “specific procedures to minimize the acquisition and retention [of] information concerning unconsenting U.S. persons”—making it a near certainty that ICREACH gives analysts access to millions of records about Americans. The “minimized” information can still be retained under NSA rules for up to five years and “unmasked” at any point during that period if it is ever deemed necessary for an investigation.

In other words, there's a decent chance that the FBI and DEA can easily surf through these hundreds of billions of records, and "unmask" people if need be, and then make use of the infamous parallel construction to hide how they first decided to focus on a particular individual or group.

In practice, this could mean that a DEA agent identifies an individual he believes is involved in drug trafficking in the United States on the basis of information stored on ICREACH. The agent begins an investigation but pretends, in his records of the investigation, that the original tip did not come from the secret trove. Last year, Reuters first reported details of parallel construction based on NSA data, linking the practice to a unit known as the Special Operations Division, which Reuters said distributes tips from NSA intercepts and a DEA database known as DICE.

Tampa attorney James Felman, chair of the American Bar Association’s criminal justice section, told The Intercept that parallel construction is a “tremendously problematic” tactic because law enforcement agencies “must be honest with courts about where they are getting their information.” The ICREACH revelations, he said, “raise the question of whether parallel construction is present in more cases than we had thought. And if that’s true, it is deeply disturbing and disappointing.”

And yes, this is "just metadata" but as the Intercept report notes, the NSA's own notes relating to this project reveal just how valuable metadata can be, including noting that it "has been a contribution to virtually every successful rendition of suspects and often, the deciding factor."

An NSA memo noted that PROTON could identify people based on whether they behaved in a “similar manner to a specific target.” The memo also said the system “identifies correspondents in common with two or more targets, identifies potential new phone numbers when a target switches phones, and identifies networks of organizations based on communications within the group.” In July 2006, the NSA estimated that it was storing 149 billion phone records on PROTON.

According to the NSA documents, PROTON was used to track down “High Value Individuals” in the United States and Iraq, investigate front companies, and discover information about foreign government operatives. CRISSCROSS enabled major narcotics arrests and was integral to the CIA’s rendition program during the Bush Administration, which involved abducting terror suspects and flying them to secret “black site” prisons where they were brutally interrogated and sometimes tortured. One NSA document on the system, dated from July 2005, noted that the use of communications metadata “has been a contribution to virtually every successful rendition of suspects and often, the deciding factor.”

Remember Michael Hayden gleefully admitting that the US kills people based on metadata? Well, now it turns out that we "rendition" them on metadata as well. Oh, and contrary to earlier claims about how just a few NSA analysts could examine the metadata, it now looks like tons of other government agencies, including the FBI and DEA have pretty free license to scour the data as well.

Filed Under: dea, fbi, icreach, metadata, nsa, parallel construction, search engine