In this post, I showed how sometime in fall 2010, the government tried to get the FISA Court to let it use Section 702 to spy on Americans. Specifically, it defined one of the terms used in its application (presumably its targeting certification) “to include US persons,” which Bates took to understand as a request to undertake the “intentional acquisition of communications of US persons reasonably believed to be located outside the United States.”
In addition to the big dump of 702 related documents released last week, Charlie Savage liberated some of the documents pertaining to upstream surveillance from 2011. One of the documents included a set of questions John Bates asked on November 7, in advance of approving the new minimization procedures. And one of the questions is one I asked — and for the same reason — in my post on Rosemary Collyer’s recent upstream opinion: how you define an “active user.”
The Court’s Memorandum defined “active user” to be “the individual using the electronic communications account/address/identifier to interact with his/her Internet service provider.” See Oct. 3, 2011 Memorandum Opinion at 35 n. 34 (emphasis added). However, the amended minimization procedures state that NSA will identify and segregate through technical means MCTs where “the active user of the transaction (i.e., the electronic communications account/address/identifier used to send or receive the Internet transaction to or from a service provider) is reasonably believed to be located in the United States; or the location of the active user is unknown.” See Section 3(b)(5)(a). Please confirm that NSA’s “technical means” for identification and segregation will focus on the location of the individual using the account.
Taken in the wake of the government’s 2010 effort to target a group that includes Americans, the importance of the answer is obvious. If, for example, the active user of a selector is the targeted group rather than a specific individual, then the Americans that are part of that targeted group would also have their communications collected and those communications wouldn’t get segregated as a result. For example, if the NSA were targeting the encryption keys that ISIS uses, and an American were also using that key to talk to other Americans, that communication would be collected but not segregated. So Bates, a year after backing the government down off its effort to use 702 to spy on Americans only to find that the government had been collecting on Americans for 4 years, seemed to be trying to make sure that the government didn’t achieve the same goal via different means.
Except, nowhere in the public record, did he explicitly force the government to integrate this focus on individual users into the minimization procedures. In his November 30, 2011 opinion approving the new MCT scheme, he cited of the requirement that MCTs including the communications of possible US persons get segregated, he added “the [user of]” to the language he cited from the minimization procedures.
Under the amended NSA minimization procedures, NSA must segregate and restrict access to certain portions of its upstream collection following acquisition.3 Section 3(b)(5)(a) requires NSA to
take reasonable steps post-acquisition to identify and segregate through technical means Internet transactions that cannot be reasonably identified as containing single, discrete communications where: the active user of the transaction (i.e., the [user of] the electronic communications account/address/identifier used to send or receive the Internet transaction to or from a service provider) is reasonably believed to be located in the United States; or the location of the active user is unknown.
But he didn’t specify that that user had to be an individual. In the same passage, he cited what are probably the responses to his November 7 questions, without citing the language used to respond to him.
Then, in restating the requirement to segregate such communications, Bates cited to his earlier opinion, but not the page he cited in his question invoking “individual” users.
Unlike the measures previously proposed by the government for MCTs, the new procedures require NSA, following acquisition, to identify and segregate the two categories of Internet transactions that are most likely to contain discrete wholly domestic communications and non-target communications to or from United States persons or persons located in the United States: (1) those as to which the “active user” is located inside the United States; and (2) those as to which the location of the active user is unknown. See Amended NSA Minimization Procedures at 4 (§ 3(b)(5)(a)); see also Oct. 3 Opinion at 37-41.
And neither the September 2012 opinion authorizing the next year’s certificates and clearing the government of ongoing violation of 1809(a)(2) doesn’t appear to mention active users.
I raised this issue with respect to Collyer’s opinion because, if the government can treat a group as a target and the group’s communication methods as a facility, then upstream surveillance will still collect entirely domestic communications that will newly be available via back door search (though in reality, NSA never fully implemented the scheme laid out in the 2011 opinion). Yet nowhere is this made clear.