Yesterday, I noted that the subject of Edward Snowden’s emailed question to NSA’s Office of General Counsel pertained to one of the under-reported themes of his leaks, the way NSA uses EO 12333 to collect data on Americans that either clearly was or might have been covered by stricter laws passed by Congress. I also noted how unbelievably shitty the NSA training programs released to ACLU and EFF are, particularly the way seemingly outdated documents that remain in effect appear to allow spying on Americans prohibited by statute.

I’d like to return to the precise language Snowden used to refer to this email exchange (and a thus-far unreleased exchange he claims to have had with NSA’s Compliance folks).

Today’s release is incomplete, and does not include my correspondence with the Signals Intelligence Directorate’s Office of Compliance, which believed that a classified executive order could take precedence over an act of Congress, contradicting what was just published. 

I suggested yesterday that this was likely a conflict over whether EO 12333 superseded laws passed by Congress, including but not limited to FISA.

But note: Snowden says he asked about a “classified” EO.

EO 12333 is unclassified.

So there are two possibilities. First, that there’s a classified EO — one that remains classified  — that we don’t know about, one Congress may not even be fully cognizant of (on the premise that this EO supersedes the law).

That’s possible. But EO 12333 is the only EO referenced in USSID 18’s list of references.

The other possibility is far more interesting.

As I noted, the documents laying out the core regulations governing NSA conflict badly, largely because many of the documents are very dated, and have been (or should have been) superseded by recent laws (like the FISA Amendments Act) and court decisions (like John Bates’ 2011 ruling on upstream collection).

Of particular interest is NSA/CSS Policy 1-23 (starting at PDF 110). That policy is interesting, first of all, because it was first issued on March 11, 2004 by Michael Hayden. That is, this policy dates to the very day when Michael Hayden agreed to continue the illegal wiretap program even as half of DOJ threatened to quit.

The policy was updated twice, once to make what were considered minor adjustments in policy in 2007, and once in 2009 to incorporate FISA Amendments Act changes. Thus, the policy at least purports to fully incorporate FAA. The 2009 reissue — and its classified annex — is considered among the signature authorizing milestones according to a timeline leaked by Snowden, above, and the only one that mentions a classified annex.

But — as I noted yesterday — the policy still relies on (and incorporates) a classified annex to EO 12333 that was written in 1988 (though the document itself bears the March 11, 2004 date). And among other things, that now declassified annex permits the collection of US person data for 90 days so long as the Attorney General certifies that person is a foreign agent.

with specific prior approval by the Attorney General based on a finding by the Attorney General that there is probable cause to believe the United States person is an agent of a foreign power and that the purpose of the interception or selection is to collect significant foreign intelligence. Such approvals shall be limited to a period of time not to exceed ninety days for individuals and one year for entities.

That is, NSA/CSS Policy 1-23, and the 25 year old classified annex to EO 12333 that was still classified and in place in April of last year (and for all we know, still today), permits wiretapping Americans on the very same terms the government used under the illegal wiretap program: AG approval for 90-day periods.

It also includes authority to do precisely what NSA tried to legalize in Dianne Feinstein’s FakeFiSAFix last year: wiretapping non-resident aliens who enter the US for 72 hours.

It permits the interception and dissemination of “Illicit Communications,” which I suspect would include encrypted communications.

It lays out a very broad definition of “significant foreign intelligence,” which as applied would mean the NSA could keep everything that might feasibly be helpful for foreign intelligence purposes (which is the standard we understand them to use).

[A]ny deliberate interception, selection or use of a selection term shall be deemed to constitute electronic surveillance; and “significant foreign intelligence” shall mean not only those items of information that are in themselves significant, but also items that are reasonably believed, based on the experience of the United States Signals Intelligence System, when analyzed together with other items, to make a contribution to the discovery of “significant foreign intelligence.” ,

It also includes language on dissemination that would seem to permit the government to disseminate communications it obtained from NatSec journalists.

the communication or information indicates that the United States person is engaged in the unauthorized disclosure of classified national security information;

In short, the now declassified classified annex to EO 12333 seems to permit a number of things — including wiretapping of Americans without a warrant — that FISA would seem to prohibit.

If this is the classified (annex to an) Executive Order that Snowden referred to , it would mean even NSA’s compliance people were suggesting this language took precedence over FISA as recently as April of last year.

As I noted, both PCLOB and HPSCI were pushing — as recently as a late March — to force the Agencies to update their decades old implementation procedures for EO 12333, which this would seem to include this classified annex.

This document was declassified and released on November 18 of last year, less than a week after DiFi’s FakeFISAFix passed through the Senate Intelligence Committee. It was released along with some far more interesting documents (including several pertaining to the Internet Dragnet). Given that only one or two other people have even read the other documents associated with this release, I suspect almost no one read this annex. But it seems to have made quite clear that in implementing EO 12333, NSA created loopholes in the laws passed by Congress.

The same loopholes that almost led half of DOJ to quit in 2004.