Latest FISA Court Order Details Why NSA Didn't Get Any 702 Requests Approved Last Year

from the hint:-a-datacenter's-worth-of-noncompliance dept

The latest document dump by the Office of the Director of National Intelligence (ODNI) -- which contains several documents pried loose by an ACLU FOIA lawsuit -- explains why the NSA ran through the entirety of 2016 without an approved Section 702 request from the FISA court. The short answer is a whole lot of noncompliance. So's the long answer:

After submitting its 2016 Certifications in September 2016, the Department of Justice and ODNI learned, in October 2016, about additional information related to previously reported compliance incidents and reported that additional information to the FISC. The NSA also self-reported the information to oversight bodies, as required by law. These compliance incidents related to the NSA’s inadvertent use of U.S. person identifiers to query NSA’s “upstream” Internet collection acquired pursuant to Section 702.

Pursuant to statutory requirements, the FISC was required to complete its review of the 2016 Certifications within 30 days of submission. See 50 U.S.C. § 1881a(i)(1)(B). Thus, the FISC had until October 26, 2016, to issue an order concerning the 2016 Certifications. However, after the October 2016 report to the FISC regarding improper queries, the FISC twice extended its time to consider the 2016 Certifications – first until January 31, 2017, and then until April 28, 2017 – in order to receive additional information about the compliance incidents and the Government’s plan to address them. See April 2017 Opinion at 3-4. The previous year’s certifications remained in effect during these extension periods.

Of note here is the fact that the court allowed 2015's certifications to remain in place despite even more reports of noncompliance by the NSA. Section 702 has been steadily abused, inadvertently or deliberately, since its inception in 2008 as part of the FISA Amendments Act.

Because the court was extremely hesitant to approve new searches under this authority, the agency apparently undertook a comprehensive overhaul of the program. The end result was the shutdown of the "about" collection -- an upstream dragnet for email communications that tended to grab a bunch of US persons' communications -- ones the NSA supposedly couldn't figure out how to separate from its non-domestic data.

The latest FISC opinion [PDF] -- roughly a month old at this point -- finally gives the NSA a 702 court order it can include in its next transparency report. The opinion doesn't spend much time chastising the agency for its long-running compliance issues but at least provides more examples of how little the NSA has done to prevent internal abuse of its collections. This abuse also includes the FBI, which has access to the NSA's raw, unminimized 702 data.

Since 2011, minimization procedures have prohibited use of U.S.-person identifiers to query the results of upstream Internet collection under Section 702. The October 26, 2016 Notice informed the Court that NSA had been conducting such queries in violation of that prohibition, with much greater frequency than had previously been disclosed to the Court… The government reported that the NSA IG and OCO were conducting other reviews covering different time periods, with preliminary results suggesting that the problem was widespread during all periods under review.

At the October 26, 2016 hearing, the Court ascribed the government's failure to disclose those IG and COO reviews at the October 4, 2016 hearing to an institutional "lack of candor" on part and emphasized that "this is a very serious Fourth Amendment issue."

Some of the compliance issues could be traced back to the NSA's querying system, which seemed built to ensure as many compliance issues as possible.

The January 3, 2017 Notice stated that "human error was the primary factor" in these incidents, but also suggested that system design issues contributed. For example, some systems that are used to query multiple datasets simultaneously required to "opt-out" of querying Section 702 upstream Internet data rather than requiring an affirmative "opt-in," which, in the Court's view, would have been more conducive to compliance.

The report also details further issues with the NSA and its data-sharing, including a heavily-redacted retelling of compliance issues at the FBI concerning dissemination of unminimized US persons' info (including to government contractors). While steps have now been put in place to prevent a recurrence, the court notes the government has routinely dragged its feet providing notice of misuse of surveillance databases.

Too often, however, the government fails to meet its obligation to provide prompt notification to the FISC when non-compliance is discovered. For example, it is unpersuasive to attribute -- even "in part" -- an eleven-month delay in submitting a preliminary notice to efforts to develop remedial steps… when the purpose of a preliminary notice is to advise the Court while investigation or remediation is still ongoing… The Court intends to monitor closely the timeliness of the government's reporting of non-compliance regarding Section 702 implementation.

And so it goes for 99 pages. Multiple compliance violations, multiple promises to do better next time by the government, and a handful of mild admonitions by the FISA judge. The most useful thing to come of this is the voluntary step the NSA took to end its "about" collection program, thus narrowing the number of incidentally-collected US persons' communications. While the court approves of this move, its approval means very little should the NSA decide to revive the program. Considering its lengthy run of compliance issues, it seems unlikely the agency will be in any hurry to defend a rollback of its rollback in a court that's heard about nothing but misuse and abuse of domestic communications for most of the last decade.

Filed Under: abuse, fisa court, fisc, nsa, section 702, surveillance

From The Unsealed 'Jewel v. NSA' Transcript: The DOJ Has Nothing But Contempt For American Citizens

from the and-[local]-god-help-you-if-you're-a-foreign-citizen dept

With some of the proceedings unsealed in the EFF's long-running Jewel vs. NSA lawsuit, more details can finally be exposed. Not that what's already been exposed hasn't been damning enough. Over the past several months, the DOJ has run interference for the NSA, traveling from courtroom to courtroom, destroying and saving (or at least pretending to...) collected data amongst a flurry of contradictory orders.

Not that it ultimately mattered. The NSA just kept destroying relevant evidence, claiming the system was too complex to do anything with but allow to run its course. Evidence would be destroyed at the 5-year limit, no matter what preservation orders were issued. The NSA, of course, has a vested interest in destroying evidence that its 215 and 702 programs collect the data and communications of Americans. Thanks to Snowden's leaks, it can no longer pretend it doesn't. But despite this, the DOJ still claims Section 702 targets only foreigners and American suspects located outside of the US.

The mock concern about compliance with court orders was a hustle. The DOJ wants as much evidence that might be useful to plaintiffs gone as swiftly as possible. Thanks to the unsealing of Jewel court documents, the EFF can now relate that the DOJ's efforts went much further than simply letting aged-off collections expire. It also actively tried to change the historical record of the Jewel case, as Mike covered here recently.

Citing classification concerns, the DOJ sought to editorialize its statements to the court, removing them (not redacting them) from the public record… and it didn't want anyone to find out. Take a moment to soak in the audacity of this request, made by the US government in a federal court.

If the judge had sided with the DOJ, there's a good chance some of the transcript embedded below would have gone missing… forever. Even after the documents were eventually unsealed, whatever the government had managed to convince the court was "classified" would no longer exist -- despite the fact that one week earlier these statements were made in an open court room.

It's likely that the judge's decision to notify the plaintiffs changed the DOJ's mind about retconning its own statements. It's a good thing nothing's missing. What's in there is terrible. The DOJ basically mounts the argument that no plaintiff should ever have standing to challenge either the Section 215/501 or 702 programs, unless they are Verizon Business customers… and even then they should only be able to challenge the former. (Apologies for the all caps, but that's the way the court transcribed it.)

AND WE SET THIS FORTH, AGAIN, FOR THIS COURT IN OUR MOST RECENT FILING IN WHICH THE DNI ASSERTED THE STATES SECRET PRIVILEGE AND EXPLAINED TO THE COURT THAT NOTWITHSTANDING ALL THESE TERRIBLE DISCLOSURES THAT OCCURRED OVER THE PAST YEAR -- IN FACT, THIS IS THE ONE YEAR ANNIVERSARY -- DISCLOSURES THAT WE ARE CONVINCED THAT HAVE SERIOUSLY HARMED THE NATIONAL SECURITY OF THIS COMPANY, WE HAVE CONTINUED TO PROTECT THE IDENTITY OF PARTICULAR TELECOMMUNICATION CARRIERS THAT ARE ALLEGED TO HAVE ASSISTED THE NSA, NOT ONLY IN THE SECTION 215 PROGRAM, WHICH WAS AT ISSUE IN THE CASES YOU CITED, BUT ALSO IN THE PRESIDENT'S SURVEILLANCE PROGRAM, ACTIVITIES WHICH ARE AT ISSUE IN JEWEL AND SHUBERT, AS WELL.

SO WE HAVE NOT CONCEDED THAT STANDING COULD BE FOUND BASED ON THE MERE EXISTENCE OF THE BULK TELEPHONY META DATA PROGRAM, IF THAT IS YOUR QUESTION.

Got that, citizens? Because we have made the choice to protect telcos withhold information, you will only have standing to challenge these programs under very narrow circumstances. The government is looking out for the best interests of its partners in surveillance. The rights of citizens are much further down the list.

And while acknowledging that it has withheld info on the telephony metadata program, the DOJ's lawyers simultaneously claim the plaintiffs should have been prevented from amending their case to include the recent Section 702 revelations, because that program has supposedly been out in the open and fully transparent since 2008.

SO I HARDLY KNOW WHERE TO BEGIN. BUT I WILL START WITH THIS. FIRST OF ALL, THE CONTENTION THAT 702 DID NOT EXIST WHEN THE COMPLAINT WAS FILED IS A FALSEHOOD. 702 WAS ENACTED IN 2008, IN JULY OF 2008, AS PART OF THE FISA ACT AMENDMENTS OF 2008.

NOT ONLY DID IT EXIST BEFORE THIS COMPLAINT WAS FILED, THE JEWEL PLAINTIFFS KNEW ABOUT IT, BECAUSE IT'S PRECISELY WHY THEY FILED SUIT. THAT LEGISLATION CREATED IMMUNITY FOR THE TELECOMMUNICATION COMPANIES.

THE ACLU OVER IN NEW YORK, KNEW QUITE WELL IT EXISTED. THEY FILED A COMPLAINT, I THINK, THE DAY IT WAS ENACTED INTO LAW. AND THAT MADE A LOT OF HEADLINES, AND IT WAS LITIGATED. AND IT WAS ALL, ALL PUBLIC. NO SECRET PROGRAM. AND IT WAS OUT THERE. SO THAT STATEMENT IS JUST NOT TRUE.

THE SECOND THING THAT'S NOT TRUE IS HER PROGRAM DESCRIPTION. 702 IS A PUBLIC STATUTORY PROGRAM. IF YOU LOOK AT THE AMNESTY INTERNATIONAL DECISION, IT DETAILS HOW THAT PROGRAM OPERATES. AND SO THAT IS THE SOURCE OF WHAT SHOULD BE THE COURT'S UNDERSTANDING FOR THIS PROGRAM AND HOW IT OPERATES.

Completely disingenuous. The program was never "out in the open." It protected telcos and helped codify warrantless wiretapping, but there was never any indication given that it also allowed the NSA to tap into the internet backbone and siphon off communications of Americans. And it certainly wasn't presented as a tool to be used as an untargeted dragnet.

This is only a small part of a document the DOJ wanted to selectively edit and present later as an untouched factual record of a federal hearing. The government claims no one has standing because everything related to the NSA's programs is "rank speculation" -- basically pretending the "terrible disclosures" never happened. In the same breath, it claims the programs have always been transparent and completely above board, therefore no one should be able to amend their complaints when additional info is exposed by leakers.

The government not only wants it both ways, but it has the breathtaking gall to ask to touch up its talking points after delivering them. After a dozen attempts to wrap up this post with something that pithily highlights the anger the government's editing attempt (and the horrible arguments contained in the transcript) has generated in me, I'm left with little more than this: FUCK THE DOJ -- it and every agency it oversees.

It witholds information about the companies involved in its dragnet surveillance programs, covers up everything else and pretends unauthorized disclosures "don't count," at least not when it comes to citizens being granted standing. It could easily clear up this "rank speculation," but it would rather shelter telcos from irate customers and give itself an easy way to get lawsuits dismissed. Then it spins everything around and claims the plaintiffs are misrepresenting the programs to the court -- something the DOJ has actually done itself -- and should not be allowed to amend complaints to reflect additional evidence gleaned from leaked documents.

Hey, I'm sorry the leaks have made it harder for these agencies to do whatever the hell they want, but they are all part of a government that's supposed to be accountable to the citizens picking up the check. But when faced with unhappy citizens and their diminished rights, all the DOJ's lawyers can say is that the public doesn't know shit and has no right to question the government's activities.

The government has somehow managed to come to a conclusion others reached weeks ago -- there's more than one leaker out there. GOOD. Burn it down. In the DOJ's hands, the government isn't by or for the people. It's despite the people. The DOJ can't be trusted to protect the balance between privacy and security. As it sees it, what the public doesn't know will likely hurt it, and it's damned if it's going to allow citizens to seek redress for their grievances.

Filed Under: 4th amendment, contempt, doj, jewel v. nsa, nsa, privacy, section 702, section 215, surveillance