Documents Show FISA Court Refusing To Grant FBI's Requests To Scoop Up Communications Along With Phone Metadata

from the rubber-stamp-runs-dry dept

A handful of FOIA documents [PDF] obtained by EPIC (Electronic Privacy Information Center) are shedding some new light on the FISA court and its relationship with the FBI. The good news is that the court is not quite the rubber stamp it's often been portrayed as. Even though a vast majority of requests are improved, there appears to be a significant amount of modification happening behind the scenes.

The documents reveal that the Foreign Intelligence Surveillance Court (FISA) told the FBI several times between 2005 and 2007 that using some incidental information it collected while monitoring communications in an investigation — specifically, numbers people punch into their phones after they’ve placed a call — would require an explicit authorization from the court, even in an emergency.

The FBI wanted to trap these digits using its pen register orders, which are only supposed to provide numbers called and received. This additional information had been considered "content," as these post-cut-through digits could reveal details such as credit card info or social security numbers.

The FBI's collection of content -- along with the call metadata it was actually authorized to receive -- appears to have continued until a FISA judge finally asked it what it was doing with this "incidentally collected" content. The DOJ, of course, argued that is was entitled to this information.

In May 2006, the government told the court that it had the authority to collect that sensitive information, and would “in some cases … specifically seek authority for secondary orders requiring a service provider to provide all dialing, routing, addressing or signaling information transmitted by a target telephone, which, in light of technological constraints, may include content and non-content digits alike,” the report continues.

It also claimed that, although it specifically sought to collect this info with modified pen register orders, it was only accessed for a limited number of reasons: national security, emergencies, exigent circumstances, etc. The FISA court doesn't appear to have believed the FBI's claims that it was seeking this information just to use it only in the rarest of circumstances.

The court “had made modifications to the government’s proposed pen register orders,” reads the biannual report to Congress obtained by EPIC. “Although the [FISA Court] has authorized the government to record and decode all post-cut-through digits dialed by the targeted telephone, it has struck the language specifically authorizing the government to make affirmative investigative use of possible content” unless permission is specifically granted by the court.

This pushback wasn't just limited to the nation's most secret court. The FBI also met resistance at local levels when trying to scoop up content with its metadata.

In July 2006, a magistrate judge in Texas denied an application for a pen register because filtering technology would not eliminate the additional content information.

This lower-level refusal was addressed by the FISA court, which asked the FBI how it expected this magistrate's refusal to affect its FISA court requests. The FBI replied it no longer had to worry about it as revisions to the US Patriot Act had given it permission to collect it all -- even stuff the agency treated as content when crafting its altered pen register requests.

This failed to move the court. It also failed to alter the FBI's tactics. The FBI continued to submit requests for post-cut-through content and the court, quite frequently, continued to strip this part of the agency's request from its approved orders. After several years, this became standard operating procedure for the FISA court, which instituted a blanket refusal on FBI requests for post-cut-through content, even for "emergency" reasons. This resistance is likely what prompted the FBI to turn something it wasn't being allowed to obtain into formal agency policy by 2011.

The new documents shed some new, somewhat surprising, light on the inner workings of the mostly-opaque FISA court, showing that it is not always inclined to give the government what it wants. It also shows the government doesn't seem to handle rejection very well, having to be told "no" repeatedly before the message sinks in.

Filed Under: fbi, fisa, fisa court, fisc, mass surveillance, metadata, requests, rubber stamp, surveillance

Armored Vehicle Request Documents Show Local Law Enforcement Still Looking To Bring The (Drug) War To Your Doorstep

from the You-Get-An-MRAP!-And-You-Get-An-MRAP!-EVERYONE-GETS-AN-MRAP! dept

Molly Redden and Mother Jones have acquired a stash of armored vehicle request documents from police departments all over the nation. The requests are tied to the Department of Defense's 1033 program, in which military hand-me-downs are given to basically any law enforcement agency that asks for them, whether or not these agencies actually need them.

Most of the documents contain some sort of pitch detailing the "need" for an armored vehicle, like the ever-popular MRAP (Mine-Resistant Armored Protected vehicle). Some of the pitches mention terrorism. Others simply state that potential terrorist targets reside in their jurisdiction. A great deal of them mention HIDTAs (High-Intensity Drug Trafficking Area). As Redden points out, only 17% of the nation's counties are actually federally-recognized HIDTAs, but that doesn't stop requesting agencies from suggesting they too are in the midst of constant, dangerous drug trafficking.

Fully a quarter of the 465 requests projected using the vehicles for drug enforcement. Almost half of all departments indicated that they sit within a region designated by the federal government as a High Intensity Drug Trafficking Area.

Very few mention any real reasons an armored vehicle might be useful.

By contrast, out of the total 465 requests, only 8 percent mention the possibility of a barricaded gunman. For hostage situations, the number is 7 percent, for active shooters, 6 percent. Only a handful mentioned downed officers or the possibility of terrorism.

Given that the Military Vehicle Request: Short Form only contains three lines for "Special Considerations," law enforcement agencies have been submitting a variety of non-sequiturs as justifications for armored vehicle procurement.

The City of El Segundo is located in Southwest Los Angeles County and home to numerous Aerospace businesses such as Northrop Grumman, Raytheon, Aerospace Corp and the Los Angeles Air Force Base. Our tactical team is in dire need of a armored vehicle for operational use.

Former Crystal Cathedral, Congresswoman Loretta Sanchez' office and the largest mosque west of the Mississippi are all located in our City. We are also just one mile south of Disney resort area and are the fist ones in to support Anaheim PD with any riots/issues there.

Dewey Beach has been consistently in the top 10 beaches in the U.S. It covers 1 sq mile, which during summer months explodes in excess of 30,000 in Population. The potential to need an Armored Tactical Vehicle is probable.

Others are more succinct, if less clear, in their specifications.

We have a Tactical Response Team and are trying to get the equipment to have a good and affective team.

[Side note: there are plenty of misspellings and grammatical errors in the requests. No one expects police officials to be English professors, but a perusal of a few dozen of the request forms finds the only thing deployed more than these agencies' SWAT teams are their extraneous apostrophes.]

Armored Personnel carrier sought for tactical Operations
Not tracked vehicle - form will not allow me to un-select it

I would like to get a vehicle that is available on the west coast.

But, for the most part, the requests are shot full of drug hysteria. Any agency not presiding over an HIDTA tends to make tenuous claims about actual HIDTAs located miles away somehow wreaking drug-related havoc in its own community simply by being approximately adjacent. If a highway runs through an area on its way to an actual drug-trafficking area, the agencies residing miles away along the same highway claim to be adversely affected simply because they're "connected" by a road.

Some requests even launch into short but graphic depictions of the communities they serve.

Hartford has roughly 120,000 permanent residents and over 500,000 during buissness hours. The city is plagued by gun and drug violence.

Many more agencies request armored vehicles using little more than "but this other agency has one!" as justification.

And in a sign of just how commonplace the use of military grade vehicles has become, multiple departments pointed out that they did not have an armored vehicle as a reason they ought to get one. One department stressed that the closest armored truck was 30 minutes away. "That's an astonishing claim," Eastern Kentucky’s [professor Peter] Kraska says. "Do we have to have a full SWAT team with an armored personnel carrier ready to be deployed in a response time of 10 minutes in every community in the country? Because obviously, that would be very disturbing."

In addition, there are a surprising number of unofficial email addresses being used on the requisition forms.


Other documents contain Gmail, Yahoo and personal ISP-provided email addresses. On one hand, it's somewhat amusing to see that an AOL email address has been used to acquire military equipment. On the other hand, the use of personal email accounts is just one more method public officials use to keep their public-related emails out of the hands of the public.

The collected documents show one thing: the government is still more than willing to hand out military vehicles to participate in local agencies' drug wars. While not every request resulted in an acquisition, nearly every request was added to the "priority" waiting list to be provided with a vehicle once one became available.

On one hand, yay recycling, but on the other, there's police militarization, which shows no signs of slowing. Vehicles used in actual wars are coming back home to be deployed against civilians. SWAT teams generally don't need too much encouragement in the "aggression" department and packing them up in a military vehicle only encourages a warrior mindset that's completely out of step with what many SWAT teams do these days: warrant service. The 466 request forms portray the country as wholly under the sway of dangerous drug traffickers, with the occasional sovereign citizen/rural-weirdos-with-guns thrown in for good measure.

The few, scattered terrorism-oriented requests are even worse, as they use anything that might draw a crowd as justification for armored response vehicles -- covering everything from an annual "Pumpkinfest" to a public beach.

The simple fact is that if you give law enforcement the option, they'll take the most intimidating thing they can acquire. And thanks to the federal government's wide variety of terrorism/drug-related grant programs, these vehicles can not only be had, but for little to no cost to the requesting agency. That's really the only barrier to entry, and the government has helpfully removed it.

Filed Under: 1033, armored vehicles, dod, mrap, police, police militarization, requests

Champion Of The People: Verizon Complains Exigent Circumstances Order Inadequate For Info Requested; Hands Over Info Anyway

from the rolling-over-to-push-back dept

Given how often major telcos and wireless service providers have willingly provided intelligence and law enforcement agencies with way more than they've asked for, the following shouldn't come as much of a surprise.

The back story is this: In July 2008, an FBI agent had his gun and cellphone stolen from his "official" vehicle. The search for the missing items involved Verizon. In an application for a court order authorizing the release of cell site location info, it's noted that the service provider performed the most futile of gestures on behalf of itself. (Link to PDF.)

As part of its ongoing investigation, and in a further attempt to locate THE LOADED SERVICE WEAPON, shortly after 4:00 a.m. on Friday, July 24, 2008, the FBI requested on an emergency basis that the Carrier disclose the SUBJECT TOWER/SECTOR and MSC RECORDS generate between Thursday, July 24 2008 at 2:00 p.m. and Friday, July 25, 2008 at 4:00 a.m. The FBI did so on the theory that THE LOADED SERVICE WEAPON might well be in the same location as SUBJECT WIRELESS TELEPHONE with which it had been reported stolen on Nostrand Avenue.

Along with this request, the FBI submitted a written "Law Enforcement Exigent Circumstances Consent Form" filled out by Agent Julian, to whom the SUBJECT WIRELESS TELEPHONE belonged, authorizing the Carrier, among other things, to disclose the SUBJECT AND MSC RECORDS generated between Thursday, July 24, 2008 at 2:00 p.m. and Friday, July 25, 2008 at 4:00 a.m.

Although the Carrier agreed to, and did, provide the requested SUBJECT AND MSC RECORDS to the FBI on an emergency basis in light of the exigent circumstances, the Carrier informed the FBI that the "Law Enforcement Exigent Circumstances Consent Form" submitted by Agent Julian provided insufficient authority to release the requested information, and directed the FBI to seek a subsequent court order authorizing the release of the information.

It's something of an anomaly to see a major carrier stand up to the government, but Verizon certainly chooses its battles very weirdly. To begin with, the phone in question belonged to the person making the request. (More likely belonged to the FBI but was issued to Agent Julian.) That it would attempt to deny a subscriber access to his own records is bizarre, especially considering its open sharing of data on millions of people with the NSA and countless law enforcement agencies -- all of whom use the Third Party Doctrine as an all-access pass to as much info as possible.

What makes this utterly ridiculous is the fact that Verizon handed over the information before complaining about the exigent circumstances order. As for why it asked that an official court order be acquired, one can only assume that news of the immunity granted by the 2008 FISA Amendments Act (enacted roughly two weeks earlier) hadn't reached these particular employees yet. In the unlikely event that Agent Julian brought a lawsuit against Verizon for revealing his cell site info to Agent Julian on the basis of an inadequate exigent circumstances request, the company would have been insulated.

And so, the court did order, with a straight face, that Verizon hand over the records it had already handed over, even though the request noted that these records had only allowed the FBI to recover the gun (and also noted that the FBI already had the info it was seeking). I's dotted and asses covered, everyone involved returned to the investigation already in progress, except for Verizon, which presumably filed the new paperwork demanding the information it had already turned over the FBI, with the old paperwork it had complied with, even though it belatedly felt that it probably shouldn't have.

The ultimate irony here is that Verizon will work harder to keep someone from accessing their own records than it will to prevent the government from accessing metadata from all of its subscribers.

Filed Under: exigent circumstances, fbi, privacy, requests
Companies: verizon

Is It Good For Business To Say No To Gov't Requests For Info?

from the people-respect-that dept

Chris Soghoian recently gave a talk where he reminded companies that it actually can be good for business to say "no" when the government comes asking for info. He ran through a variety of scenarios (many covered here on Techdirt) when certain companies stood up to government requests and said no. When the news was later revealed, companies that have stood up to government requests often get very good press, while those who gave in, get really bad press. Of course, I think Chris may be overselling the case here, as it's not clear that the short burst of good PR from these situations really had a lasting impact. But, it is certainly one reason (among many) that companies shouldn't just roll over every time the government comes calling.

Filed Under: government, info, requests