Targeting Terrorists Based on Their (?!?) Sorority Membership

Identity IntelligenceAs part of my continuing obsession with the way NSA tracks identities, I wanted to take a close look at one slide released by the NYT with its facial recognition story the other day. It tracks all the kinds of data the NSA and its Five Eyes partners try to collect on targets (and I’m sure they aspire to this level of detail primarily with targets).

It’s useful because it offers a list of the kinds of financial records the NSA might use. These range from Hawalas and farm cooperatives to scholarships, retirement accounts, and health/medical accounts.

At one level, these record types are uninteresting. Journalists search out some of the same information to do their reporting. Of course, the NSA has more legal authority to obtain these records.

At another level, this slide seems to serve primarily as a brainstorming document, invoking all the potential identity types for a range of NSA’s potential targets. Some potential targets’ “cohabitants” would be boarders; others’ would be servants. You’d learn about some targets by accessing their game rentals; you’d learn about others by tracking their half-siblings.

And perhaps that’s the mindset that led to the sheer diversity of types of targets envisioned in this slide. Perhaps whatever contractor made it works largely for corporate clients and most of the categories came from an existing presentation or experience base.

Sorority MembershipStill. I was rather amused that a dragnet the US largely justifies in the name of counterterrorism includes sorority membership among the identity characteristics they collect.

It’s not entirely inconceivable that an NSA target would be a sorority member (she could work for a targeted company, after all). It’s just so far down the realm of likelihood that I can’t imagine NSA tracking someone’s sorority — unless their targeting were far broader than they claim.

Why Is DOJ Hiding Three Phone Dragnet Orders in Plain Sight?

The ACLU and EFF FOIAs for Section 215 documents are drawing to a head. Later this week, EFF will have a court hearing in their suit. And last Friday, the government renewed its bid for summary judgment in the ACLU case.

Both suits pivot on whether the government’s past withholdings on Section 215 were in good faith. Both NGOs are arguing they weren’t, and therefore the government’s current claims — that none of the remaining information may be released — cannot be treated in good faith. (Indeed, the government likely released the previously sealed NSA declaration to substantiate its claim that it had to treat all documents tying NSA to the phone dragnet with a Glomar because of the way NSA and DOJ respectively redact classification mark … or something like that.)

But the government insists it is operating in good faith.

Instead, the ACLU speculates, despite the government’s declarations to the contrary, that there must be some non-exempt information contained in these documents that could be segregated and released. In an attempt to avoid well-established law requiring courts to defer to the government’s declarations, especially in the area of national security, the ACLU accuses the government of bad faith and baldly asserts that the government’s past assertions regarding segregability—made before the government’s discretionary declassification of substantial amounts of information regarding its activities pursuant to Section 215— “strip the government’s present justifications of the deference due to them in ordinary FOIA cases.” ACLU Br. at 25. The ACLU’s allegations are utterly unfounded. For the reasons set forth below, the government’s justifications for withholding the remaining documents are “logical and plausible,”

EFF and ACLU have focused closely on a August 20, 2008 FISC order describing a method to conduct queries; I have argued it probably describes how NSA makes correlations to track correlations.

The government is refusing to identify 3 orders it has already identified

But — unless I am badly mistaken, or unless the government mistakenly believes it has turned over some of these orders, which is possible! — I think there are three other documents being withheld (ones the government hasn’t even formally disclosed to EFF, even while pretending they’ve disclosed everything to EFF) that raise questions about the government’s good faith even more readily: the three remaining phone dragnet Primary Orders from 2009. All three have been publicly identified, yet the government is pretending they haven’t been. They are:

BR 09-09, issued on July 8, 2009. Not only was this Primary Order identified in paragraph 3 of the next Primary Order, but it was discussed extensively in the government’s filing accompanying the end-to-end report. In addition, the non-approval of one providers’ metadata  (I increasingly suspect Sprint is the provider) for that period is reflected in paragraph 1(a) of that next Primary Order.

BR 09-15, issued on October 30, 2009. The docket number and date are both identified on the first page of this supplemental order.

BR 09-19, issued on December 16, 2009. It is mentioned in paragraph 3 of the next Primary Order. The docket number and the date are also referred to in the documents pertaining to Sprint’s challenge recently released. (See paragraph 1 and paragraph 5 for the date.)

Thus, the existence of all three Primary Orders has been declassified, even while the government maintains it can’t identify them in the context of the FOIAs where they’ve already been declassified.

The government has segregated a great deal of the content of BR 09-09

The government’s withholding of BR 09-09 is particularly ridiculous, given how extensively the end-to-end motion details it. From that document, we learn:

  • Pages 5-7 approve a new group for querying. (see footnote 2)
  • Pages 9-10 require those accessing the dragnet be briefed on minimization procedures tied to the dragnet (see PDF 22); this is likely the language that appears in paragraph G of the subsequent order. This specifically includes technical personnel. (see PDF 49)
  • Pages 10-11 require weekly reporting on disseminations. (see PDF 23) This is likely the information that appears in paragraph H in the subsequent order.
  • Page 12 affirmatively authorizes the data integrity search to find “certain non user specific numbers and [redacted] identifiers for purposes of metadata reduction and management” (see footnote 19 and PDF 55)
  • Page 8 and 13-14 lay out new oversight roles, especially for DOJ’s National Security Division (see PDF 22); these are likely the requirements laid out in paragraphs M through R in subsequent orders. Those same pages also require DOJ to share the details of NSD’s meeting with NSA in new FISC applications. (see PDF 23)
  • BR 09-09 included the same reporting requirements as laid out in BR 09-01 and BR 09-06 (see PDF 5)
  • Pages 16 -17 also included these new reporting requirements: (see PDFs 6 and 29 – 30)
    • a full explanation of why the government has permitted dissemination outside NSA of U.S. person information in violation of the Court’s Orders in this matter;
    • a full explanation of the extent to which NSA has acquired call detail records of foreign-to-foreign communications from [redacted] pursuant to orders of the FISC, and whether the NSA’s storage, handling, and dissemination of information in those records, or derived therefrom, complied with the Court’s orders; and
    • either (i) a certification that any overproduced information, as described in footnote 11 of the government’s application [i.e. credit card information), has been destroyed, and that any such information acquired pursuant to this Order is being destroyed upon recognition; or (ii) a full explanation as to why it is not possible or otherwise feasible to destroy such information.
  • BR 09-09 specifically mentioned that NSA had generally been disseminating BR FISA data according to USSID 18 and not the more restrictive dissemination provisions of the Court’s Orders. (see footnote 12)
  • BF 09-09 approved Chief, Information Sharing Services, the Senior Operations Officer, the Signals Intelligence
    Directorate (So) Director, the Deputy Director of NSA, and the Director of NSA to authorize US person disseminations. (see footnote 22 and PDF 28)

Significant parts of at least 13 pages of the Primary Order (the next Primary Order is 19 pages long) have already been deemed segregable and released. Yet the government now appears to be arguing, while claiming it is operating in good faith, that none of these items would be segregable if released with the order itself!

Wildarse speculation about why the government is withholding these orders

Which raises the question of why. Why did the government withhold these 3 orders, alone among all the known regular Primary Orders from the period of EFF and ACLU’s FOIAs? (See this page for a summary of the known orders and the changes implemented in each.)

The reason may not be the same for all three orders. BR 09-09 deals with two sensitive issues — the purging of credit card information and tech personnel access — that seem to have been resolved with that order (at least until the credit card problems returned in March 2011).

But there are two things that all three orders might have in common.

First, BR 09-09 deals closely with dissemination problems — the ability of CIA and FBI to access NSA results directly, and the unfettered sharing of information within NSA. BR 09-15 lays out new dissemination rules, with the supplement in November showing NSA to still be in violation. So it’s likely all 3 orders deal with dissemination violations (and therefore with poison fruit of inappropriate dissemination that may still be in the legal system), and that the government is hiding one of the more significant aspects of the dragnet violations by withholding those orders.

I also think it’s possible the later two (potentially all three, but more likely the later two) orders combine the phone and Internet dragnets. That’s largely because of timing: A June 22, 2009 order — the first one to deal with the dissemination problems formally addressed in BR 09-09 — dealt with both dragnets. There is evidence the Internet dragnet data got shut down (or severely restricted) on October 30, 2009, the date of BR 09-15. And according to the 2010 John Bates Internet dragnet opinion, NSA applied to restart the dragnet in late 2009 (so around the time of BR 09-19). So I think it possible the later orders, especially, deal with both programs,  thereby revealing details about the legal problems with PRTT the government would like to keep suppressed. (Note, if BR 09-15 and BR 09-19 are being withheld because they shut down Internet production, it would mean all three orders shut down some production, as BR 09-09 shut down one provider’s telephone production.)

Another possibility has to do with the co-mingling of EO 12333 and Section 215 data. These three orders all deal with the fact that providers (at least Verizon, but potentially the other two as well) had included foreign-to-foreign phone records along with the production of their domestic ones.That’s the reason production from one provider got shut down in BR 09-09. And immediately after the other withheld records, the Primary Orders always included a footnote on what to do with EO 12333 data turned over pursuant to BR FISA orders (see footnote 7 and footnote 10 for examples). Also, starting in March 2009, the Orders all contain language specifically addressing Verizon. So we know the FISC was struggling to come up with a solution for the fact that NSA had co-mingled data obtainable under EO 12333 and data the telecoms received PATRIOT Act orders from. (I suspect this is why Sprint insisted on legal cover, ultimately demanding the legal authorization of the program with the December order.) So it may be that all these orders reveal too much about the EO 12333 dragnet — and potential additional violations — to be released.

Whatever the reason, there is already so much data in the public domain, especially on BR 09-09, it’s hard to believe withholding it is entirely good faith.

NSA Is Still Hiding Where They’re Hiding the Internet Dragnet

On Friday, ACLU got a mystery declaration in their FOIA lawsuit for Section 215 records: a declaration from NSA Deputy Associate Director for Policy and Records Diane Janosek. It was filed back on February 8, 2013, along with a bunch of FBI declarations, though it was not reflected in the docket. In it, Janosek basically explains why certain documents pertaining to the phone dragnet were effectively being Glomared because they revealed the NSA’s involvement in the phone dragnet. It was just handed over, presumably because the claim it classified anymore is so nonsensical.

Still, there are details, particularly pertaining to the Internet dragnet program, that I find to be of particular interest.

The declaration invokes the Internet dragnet in a footnote, noting that several of the documents being withheld pertain to that too.

PRTT Footnote

It notes that “several” of the documents also address the Internet metadata. We’ve seen a number of these: PATRIOT-Reauthorization notices to Congress, some training programs, a few FISC documents from 2009, as well as the opinions from Colleen Kollar-Kotelly and John Bates authorizing bulk collection under Section 402.

The footnote notes that “NSA’s PR/TT FISA program” was discontinued. Immediately thereafter, there’s a full redacted sentence, followed by a partially redacted sentence making it clear that some similar source of collection remains active.

Several pages later, there’s a similar reference explaining why NSA can’t disclose the PRTT program even though it has been discontinued.

Similarly, while NSA no longer collects NSA metadata pursuant to section 402 of the FISA, the Agency does [over a line redacted].

In other words, the NSA argued they couldn’t reveal the defunct Internet dragnet because it still collects Internet metadata, just via other means.

Which is why I’m interested in another redaction, in a paragraph full of the things they’re trying to hide: the types of metadata they get, that “records of our adversaries’ communications are vulnerable to NSA collection operations,” and that they were collecting under USA PATRIOT [redacted].

Hidden Authority

I think it’s possible that redaction hides the new authority under which they’re conducting Internet dragnet. FISA Amendments Act (or FAA) wouldn’t seem to fit. EO 12333 might.

Mind you, all that’s separate (maybe) from the question of whether FBI has its own PRTT program it feeds to the NSA, as NSA’s own classification guide indicated it did.

One thing is fairly clear: the Internet dragnet isn’t dead. It moved somewhere or somewheres. We just don’t know where yet.

Does NSA Consider Facial Matches “Connections”?

James Risen and Laura Poitras have a new Snowden story on the many ways the NSA collects and matches images.

While once focused on written and oral communications, the N.S.A. now considers facial images, fingerprints and other identifiers just as important to its mission of tracking suspected terrorists and other intelligence targets, the documents show.

“It’s not just the traditional communications we’re after: It’s taking a full-arsenal approach that digitally exploits the clues a target leaves behind in their regular activities on the net to compile biographic and biometric information” that can help “implement precision targeting,” noted a 2010 document.

One N.S.A. PowerPoint presentation from 2011, for example, displays several photographs of an unidentified man — sometimes bearded, other times clean-shaven — in different settings, along with more than two dozen data points about him. These include whether he was on the Transportation Security Administration no-fly list, his passport and visa status, known associates or suspected terrorist ties, and comments made about him by informants to American intelligence agencies.

You can sort of map out where the NSA is getting its photos from the non-denials Vanee Vines gave NYT. For example, she did not deny that NSA collects images off Facebook. She also did not deny NSA is collecting iris scans.

She added that the N.S.A. did not have access to photographs in state databases of driver’s licenses or to passport photos of Americans, while declining to say whether the agency had access to the State Department database of photos of foreign visa applicants. She also declined to say whether the N.S.A. collected facial imagery of Americans from Facebook and other social media through means other than communications intercepts.

Perhaps most interesting, the story describes the “identity intelligence” analysts who map all these pieces together.

The agency has created teams of “identity intelligence” analysts who work to combine the facial images with other records about individuals to develop comprehensive portraits of intelligence targets.

We’ve know they do this. Here’s how Snowden described it to the EU.

It has been reported that the NSA’s XKeyscore for interacting with the raw signals intercepted by mass surveillance programs allow for the creation of something that is called “fingerprints.”

I’d like to explain what that really means. The answer will be somewhat technical for a parliamentary setting, but these fingerprints can be used to construct a kind of unique signature for any individual or group’s communications which are often comprised of a collection of “selectors” such as email addresses, phone numbers, or user names.

This allows State Security Bureaus to instantly identify the movements and activities of you, your computers, or other devices, your personal Internet accounts, or even key words or other uncommon strings that indicate an individual or group, out of all the communications they intercept in the world are associated with that particular communication. Much like a fingerprint that you would leave on a handle of your door or your steering wheel for your car and so on.

[snip]

This provides a capability for analysts to do things like associate unique identifiers assigned to untargeted individuals via unencrypted commercial advertising networks through cookies or other trackers — common tracking means used by businesses everyday on the Internet — with personal details, such as individuals’ precise identity, personal identity, their geographic location, their political affiliations, their place of work, their computer operating system and other technical details, their sexual orientation, their personal interests, and so on and so forth. There are very few practical limitations to the kind of analysis that can be technically performed in this manner, short of the actual imagination of the analysts themselves.

While the NYT raises a slew of questions (starting with, again, why the NSA was purportedly unable to ID the Tsarnaevs via facial recognition, given that this program was expanded in the wake of the UndieBomb attack).

But I’m particularly interested in whether photo information gets used as part of the government’s correlations process: its chaining of people who know each other. Because, now that the phone dragnet authorizes chaining on “connections” in addition to actual phone calls, the photos on a smart phone would provide really useful ways of chaining people (it’d be easy to map the photo metadata, without having to do facial recognition).

Is part of the NSA’s move to have telecoms do this chaining — which civil liberties NGOs cheered so loudly — an effort to get to the photos we all keep in our cell phones?

EFF Accuses the Government of Spoliation of Evidence

I’ve written about these accusations in the past. EFF got a preservation order in its NSA lawsuits back in 2008. Only after the government asked for permission to destroy phone dragnet data earlier this year did they learn the government has been destroying data relevant to their various suits for years.

But now they’ve written an aggressive motion asking for sanctions.

There is now no doubt that the government defendants have destroyed evidence relevant to plaintiffs’ claims. This case concerns the government’s mass seizure of three kinds of information: Internet and telephone content, telephone records and Internet records. The government’s own declarations make clear that the government has destroyed three years of the telephone records it seized between 2006 and 2009; five years of the content it seized between 2007 and 2012; and seven years of the Internet records it seized between 2004 and 2011, when it claims to have ended those seizures.
By destroying this evidence, the government has hindered plaintiffs’ ability to prove with governmental evidence that their individual communications and records were collected as part of the mass surveillance, something the government has vigorously insisted that they must do, even as a threshold matter. Although plaintiffs dispute that the showing the government seeks is required, the government’s destruction of the best evidence that plaintiffs could use to make such a showing is particularly outrageous.

[snip]

This is spoliation of evidence. A litigant has a clear legal duty to preserve evidence relevant to the facts of a case pending consideration by the court, and that duty requires preservation of all relevant evidence, defined as anything that is likely to lead to the discovery of admissible evidence. This duty is subject only to practical considerations, none of which the government has ever raised. Any private litigant who engaged in this behavior would be rightly sanctioned by the court; indeed many have been severely sanctioned for failure to preserve evidence in far less egregious circumstances.
This court has the power to order a broad range of remedies for spoliation, up to and including terminating sanctions. Plaintiffs here seek more modest relief: that the government be subject to an adverse inference that the destroyed evidence would have shown that the government has collected plaintiffs’ communications and communications records. Plaintiffs also request that the Court set a prompt hearing date on this matter in order to halt any ongoing destruction.

My favorite part — being  a bit of a timeline wonk — is the timeline showing all the broad claims the government made to ensure state secrets would cover even activities authorized by FISA, interspersed with what data the NSA was destroying when.

Then there’s this lesson in warrantless wiretapping.

The government overreaches in trying to limit plaintiffs’ complaint. For example, the government tries to use the fact that plaintiffs often characterize the surveillance as “warrantless” as indicating that the complaint doesn’t reach surveillance conducted under the FISC. But this characterization is absolutely true even as to the FISC-authorized surveillance. Whatever the legal import of the FISC orders, they are unequivocally not full Fourth Amendment warrants, and the surveillance conducted under them is “warrantless.” Thus, this court was exactly correct in July 2013 when it stated that Plaintiffs’ claim is “that the federal government . . . conducted widespread warrantless dragnet communications surveillance of United States citizens following the attacks of September 11, 2001.”

Given all the things the government destroyed here — such as the US person phone data collected without requisite First Amendment review, the Internet metadata that included content, and the US person communications collected under upstream collection, the EO 12333 collected metadata mingled with the PATRIOT authorized data  — they might well rather give EFF standing without all that data.

We shall see. But it does make some nice Friday afternoon reading.

 

Snowden: “A Classified Executive Order”

NSA Authorities TimelineYesterday, I noted that the subject of Edward Snowden’s emailed question to NSA’s Office of General Counsel pertained to one of the under-reported themes of his leaks, the way NSA uses EO 12333 to collect data on Americans that either clearly was or might have been covered by stricter laws passed by Congress. I also noted how unbelievably shitty the NSA training programs released to ACLU and EFF are, particularly the way seemingly outdated documents that remain in effect appear to allow spying on Americans prohibited by statute.

I’d like to return to the precise language Snowden used to refer to this email exchange (and a thus-far unreleased exchange he claims to have had with NSA’s Compliance folks).

Today’s release is incomplete, and does not include my correspondence with the Signals Intelligence Directorate’s Office of Compliance, which believed that a classified executive order could take precedence over an act of Congress, contradicting what was just published. 

I suggested yesterday that this was likely a conflict over whether EO 12333 superseded laws passed by Congress, including but not limited to FISA.

But note: Snowden says he asked about a “classified” EO.

EO 12333 is unclassified.

So there are two possibilities. First, that there’s a classified EO — one that remains classified  — that we don’t know about, one Congress may not even be fully cognizant of (on the premise that this EO supersedes the law).

That’s possible. But EO 12333 is the only EO referenced in USSID 18’s list of references.

USSID 18 References

The other possibility is far more interesting.

As I noted, the documents laying out the core regulations governing NSA conflict badly, largely because many of the documents are very dated, and have been (or should have been) superseded by recent laws (like the FISA Amendments Act) and court decisions (like John Bates’ 2011 ruling on upstream collection).

Of particular interest is NSA/CSS Policy 1-23 (starting at PDF 110). That policy is interesting, first of all, because it was first issued on March 11, 2004 by Michael Hayden. That is, this policy dates to the very day when Michael Hayden agreed to continue the illegal wiretap program even as half of DOJ threatened to quit.

The policy was updated twice, once to make what were considered minor adjustments in policy in 2007, and once in 2009 to incorporate FISA Amendments Act changes. Thus, the policy at least purports to fully incorporate FAA. The 2009 reissue — and its classified annex — is considered among the signature authorizing milestones according to a timeline leaked by Snowden, above, and the only one that mentions a classified annex.

But — as I noted yesterday — the policy still relies on (and incorporates) a classified annex to EO 12333 that was written in 1988 (though the document itself bears the March 11, 2004 date). Read more

NSA’s Training Programs Are a Mess

OGC Questions
In addition to the way NSA claims to be operating under EO 12333 at times when it might be operating under some law passed by Congress, there’s another reason why Snowden’s question to NSA’s Office of General Counsel is worthwhile (though I doubt it’s why he asked).

NSA’s training programs — at least as released to ACLU and EFF under FOIA — are a horrible contradictory mess.

Two training programs closely related to the one he emailed in response to got released last year (though neither appears to be the training program in question): A “Core Intelligence Oversight Training” dating to sometime in 2009 or later, and this Office of General Counsel Powerpoint that is referred to as a Cryptological School Course, from which the image above was taken. (Side note: I repeat what I have said in the past: from a training methodology standpoint, these “training programs” are unbelievably shitty, which is particularly notable given that DOD does pay for a lot of state-of-the-art training programs on other topics.)

The Core Intelligence Oversight Training isn’t really training at all. It’s just a reproduction of the regulations in question. It includes:

  • The 2008 update of EO 12333, but with the original 1981 date attached
  • DOD 5240 1-R, dated 1982
  • NSA/CSS Policy 1-23, issued on March 11, 2004 (interesting date to update such a policy!), and revised twice, most recently May 29, 2009; it includes an Annex that serves as a classified annex to EO 12333 that is dated April 26, 1988
  • DTM 08-052, dated Jun 17, 2009; it cites EO 12333 “as amended” but doesn’t provide any amendment date

Several of these documents purport to implement or refer to FISA, but only the NSA/CSS Policy post-dates the detailed implementation of FISA Amendments Act (and it precedes key changes to the current minimization procedures tied to FISA).

And read together, these documents are utterly confusing.

My favorite is this part of DOD 5240, which would seem to contradict James “Too Cute by Half” Clapper’s definition of collection.

Collection. Information shall be considered as “collected” only when it has been received for use by an employee of a DoD intelligence component in the course of his official duties. Thus, information volunteered to a DoD intelligence component by a cooperating source would be “collected” under this procedure when an employee of such component officially accepts, in some manner, such information for use within that component. Data acquired by electronic means is “collected” only when it has been processed into intelligible form.

But both its definition of electronic surveillance and its rules on collecting the content of Americans overseas were superseded by FAA’s requirement of an order to collect on US persons overseas (and no longer considers electronic surveillance overseas electronic surveillance).

Except as provided in paragraph C5.2.5., below, DoD intelligence components may conduct electronic surveillance against a United States person who is outside the United States for foreign intelligence and counterintelligence purposes only if the surveillance is approved by the Attorney General.

The “updated” documents don’t help either. Because NSA/CSS Policy 1-23 relies on the annex dating to 1988, it claims NSA can collect on the content of Americans with Attorney General approval for 90 days.

(4) with specific prior approval by the Attorney General based on a finding by the Attorney General that there is probable cause to believe the United States person is an agent of a foreign power and that the purpose of the interception or selection is to collect significant foreign intelligence. Such approvals shall be limited to a period of time not to exceed ninety days for individuals and one year for entities.

Remember, this is purportedly “training,” and yet I’m not clear how an NSA trainee would learn that collecting content on Americans overseas requires a FISA order.

Trainees could get that information from the 2009 Cryptological School Course, which properly defines electronic surveillance and lays out Section 703-5.

But even that training course is out of date. For example, it says NSA cannot use FAA authorities to target “anything/anyone in the US,” but upstream collection under 702 targets those using certain selectors as content in the US. And even the 2011 minimization procedures limiting upstream collection don’t require destruction of upstream communications in which all communicants are in the US.

This program also includes the oblique comment that searching in databases of raw data constitutes a “collection/targeting” activity.

To protect the privacy rights of U.S. citizens, Department of Justice has determined searches of these databases are a collection/targeting activity.

Which would seem to conflict with the definition of collection a trainee got from DOD 5240.

I realize experienced NSA professionals have a better idea of how these various regulations all fit together. And I realize some of this is controlled through access controls that ensure NSA people only access the most up-to-date rules.

But these documents are billed as training, about the core restrictions regarding their collection. And they are downright contradictory.

I don’t think that’s why Snowden asked the OGC the question he did. Though the response he got regarding precedence of the various agency directives — that “DOD and ODNI regulations are afforded similar precedence though subject matter or date could result in one having precedence over another” — would only exacerbate any confusion a trainee had.

But if the training program Snowden was using is anything like these documents, there’d be good reason to believe that inexperienced trainees were not getting a clear idea of what they were allowed to do with US person data.

Update: One more point about these training programs, especially the classified annex to EO 12333 that dates to 1988. This is a problem that both PCLOB and HPSCI have identified and tried to fix (though HPSCI did not include their bill language to do so in either the USA Freedumber or the unclassified parts of the Intelligence Authorization). This shows why it is important: because NSA people are being trained on materials that tell them they can collect US person data overseas without a FISA order.

Snowden’s Emailed Question Addresses One Abuse Revealed by His Leaks

In an effort to rebut Edward Snowden’s claims that he raised concerns via proper channels, NSA just released an email Snowden sent to NSA’s Office of General Counsel. The email reveals their own training is not clear about something central to Snowden’s leaks: whether laws passed by Congress take precedence over EO 12333.

In the email, Snowden describes a training program on USSID 18, NSA’s internal guidelines on protecting US person data. Snowden’s email reads, in part,

Hello, I have a question regarding the mandatory USSID 18 training.

The training states the following:

________

(U) The Hierarchy of Governing Authorities and Documents is displayed from the highest authority to the lowest authority as follows:

U.S. Constitution

Federal Statutes/Presidential Executive Orders (EO)

[snip]

________

I’m not entirely certain, but this does not seem correct, as it seems to imply Executive Orders have the same precedence as law. My understanding is that EOs may be superseded by federal statute, but EOs may not override statute.

An NSA lawyer wrote back (in part),

Executive Orders (E.O.s) have the “force and effect of law.” That said, you are correct that E.O.s cannot override a statute.

The NSA has not revealed whether Snowden called the lawyer with further questions, as he invited Snowden to do. Nor have they said this email to Office of General Counsel is the only email Snowden sent (only that it’s the only one he sent to OGC).

Nevertheless, the email is really suggestive, particularly as it took place when Snowden had already started downloading a slew of information.

That’s because Snowden’s documents (and documents released in response to his leaks) reveal NSA has repeatedly used EO 12333 to push the limits of laws passed by Congress, if not to evade the law altogether.

Here are just two of numerous examples:

NSA Avoids Stricter Minimization Procedures Under the Phone Dragnet: The NSA has fairly strict minimization procedures under the Section 215-authorized phone dragnet, but only NSA’s internal rules (USSID 18) for the EO 12333-authorized phone dragnet. Nevertheless, for the first 3 years of the FISA-authorized program, NSA didn’t follow their Section 215 rules, instead applying the less stringent rules of USSID 18 (effectively letting a DOD Directive supersede the PATRIOT Act). In one of their most egregious violations discovered in 2009, they watch listed 3,000 US persons without giving those people the required First Amendment review, as required by minimization procedures written to fulfill the law. But instead of purging those records upon discovery (or even stopping the watchlisting), they just moved them into the EO 12333-only category. They just kept spying on the US persons using only data collected under EO 12333.

And these 2009 violations are not isolated. At least as recently as 2011, the NSA was still engaging in this authority arbitrage; a training program from that year makes it clear NSA trained analysts to re-run queries under EO 12333, if possible, to get around the dissemination requirements of Section 215. (Update: I’m not saying this particular arbitrage is illegal; it’s not. But it does show how NSA games these authorities.)

NSA Collects US Person Content by Getting It Overseas: Because of the structure of the Internet, a great deal of US person data exists overseas. We’ve seen discussion of this US person data overseas including at least email content, address books, videocam images, and location. But because NSA collects this via dragnet, not targeted collection, it claims it is not targeting any American, even though it permits the searching of EO 12333 data for US person content, apparently without even Reasonable Articulable Suspicion. And because it is not targeting Americans under their dragnet and back door loopholes, it does not apply FISA Amendment Act restrictions on collecting US person data overseas under Sections 703, 704, and 705. Effectively, it has the ability to avoid those restrictions entirely by using EO 12333 as a dodge.

I’m not the only one concerned about this: at a hearing in February, both Dianne Feinstein and (at more length) Mark Udall raised concerns with National Security Division Assistant Attorney General John Carlin, suggesting some of this EO 12333 data should be treated according to FISA. Carlin — who is supposed to be a key player in overseeing NSA — showed no interest in doing so.

In both these questions, NSA did not allow laws to take precedence over EO 12333. On the contrary, NSA just created ways that it could apply EO 12333 and ignore the law that should have or might have applied.

Not only does Snowden’s question make it clear that the NSA doesn’t make the precedence of law over EO 12333 clear in training, but the lawyer’s response was rather ambiguous on this point as well.

One thing we’ve learned from Snowden’s leaks is that the Executive is (at a minimum) evading the intent of Congress on some of its treatment of US person data. And by releasing this email as part of a pissing contest with Snowden, NSA has made it clear that’s by design, even in their most core training program.

NSA is not telling its analysts that laws passed by Congress — even those offering protection to US person data — must take precedence over the looser protections under EO 12333. Which may be why they’re comfortable collecting so much US person data under EO 12333.

Update: According to Snowden, I’m absolutely right.

Today’s release is incomplete, and does not include my correspondence with the Signals Intelligence Directorate’s Office of Compliance, which believed that a classified executive order could take precedence over an act of Congress, contradicting what was just published. It also did not include concerns about how indefensible collection activities – such as breaking into the back-haul communications of major US internet companies – are sometimes concealed under E.O. 12333 to avoid Congressional reporting requirements and regulations.

Causing Exceptionally Grave Harm to National Security by FOIAing FOIA Process

Jason Leopold has a new article at the Guardian based off a FOIA of NSA’s FOIA process. Perhaps the funniest part of the documents he received, however, is the number of times the NSA claimed its own discussion of FOIA process — including praise for the FOIA responders! — was Top Secret, suggesting revealing details would cause exceptionally grave harm to national security.

NSA FOIA Praise

 

 

That said, I think there’s a missing piece to this puzzle (and hope Leopold pursues it when he makes his inevitable appeal of some of these redaction decisions).

On June 11, NSA’s Chief of FOIA Office Pamela Phillips raised the possibility of having “a paper or sheet of unclassified facts that could be provided to the public.” (See PDF 1) She repeated that request on June 17. (See PDF 3) I believe that is separate from the efforts to come up with a standard Glomar letter (that discussion, incidentally, is redacted in some enormously interesting ways).

But I’m particularly interested in a redaction in an email from Deputy Chief of Staff Trumbull Soule to Associate Director for Policy and Records David Sherman and then Media Leaks Task Force head and now Deputy Director of NSA Richard Ledgett, and cc’ed to Phillips and (among at least 12 others) NSA General Counsel Raj De on June 26.

That’s because that email got sent on the day after the NSA had to pull what I believe was that unclassified fact sheet, which NSA first posted on June 18, after Ron Wyden and Mark Udall wrote a letter, on June 24, to Keith Alexander noting two problems with the letter, in that it misleadingly suggested,

  • NSA had the ability to determine how many Americans had been collected under Section 702
  • NSA may not search on the records of Americans (back door searches)

In addition, the letter had a classified attachment that, I suspect, noted that John Bates’ response to the upstream problems did not require the destruction of entirely domestic communications.

NSA withdrew the fact sheet from its website sometime before 1 PM on June 25.

Now, it may just be a coinkydink that the highest level of discussion among these emails come on that particular day (though I assume NSA withheld a bunch of emails). But I do find the timing rather interesting.

What If the Democratic Response to Snowden Is to Expand Surveillance?

I got distracted reading two pieces this morning. This great Andrew O’Hehir piece, on how those attacking Edward Snowden and Glenn Greenwald ought to consider the lesson of Justice Louis Brandeis’ dissent in Olmstead.

In the famous wiretapping case Olmstead v. United States, argued before the Supreme Court in 1928, Justice Louis Brandeis wrote one of the most influential dissenting opinionsin the history of American jurisprudence. Those who are currently engaged in what might be called the Establishment counterattack against Glenn Greenwald and Edward Snowden,including the eminent liberal journalists Michael Kinsley and George Packer, might benefit from giving it a close reading and a good, long think.

Brandeis’ understanding of the problems posed by a government that could spy on its own citizens without any practical limits was so far-sighted as to seem uncanny. (We’ll get to that.) But it was his conclusion that produced a flight of memorable rhetoric from one of the most eloquent stylists ever to sit on the federal bench. Government and its officers, Brandeis argued, must be held to the same rules and laws that command individual citizens. Once you start making special rules for the rulers and their police – for instance, the near-total impunity and thick scrim of secrecy behind which government espionage has operated for more than 60 years – you undermine the rule of law and the principles of democracy.

“Our Government is the potent, the omnipresent teacher,” Brandeis concluded. “For good or for ill, it teaches the whole people by its example. Crime is contagious. If the Government becomes a lawbreaker, it breeds contempt for law; it invites every man to become a law unto himself; it invites anarchy. To declare that in the administration of the criminal law the end justifies the means — to declare that the Government may commit crimes in order to secure the conviction of a private criminal — would bring terrible retribution.”

And this more problematic Eben Moglen piece talking about how Snowden revealed a threat to democracy we must now respond to.

So [Snowden] did what it takes great courage to do in the presence of what you believe to be radical injustice. He wasn’t first, he won’t be last, but he sacrificed his life as he knew it to tell us things we needed to know. Snowden committed espionage on behalf of the human race. He knew the price, he knew the reason. But as he said, only the American people could decide, by their response, whether sacrificing his life was worth it.

So our most important effort is to understand the message: to understand its context, purpose, and meaning, and to experience the consequences of having received the communication.

Even once we have understood, it will be difficult to judge Snowden, because there is always much to say on both sides when someone is greatly right too soon.

I raise them in tandem here because both address the threat of spying to something called democracy. And the second piece raises it amid the context of American Empire (he compares the US to the Roman decline into slavery).

I raise them here for two reasons.

First, because neither directly notes that Snowden claimed he leaked the documents to give us a choice, the “chance to determine if it should change itself.”

“For me, in terms of personal satisfaction, the mission’s already accomplished,” he said. “I already won. As soon as the journalists were able to work, everything that I had been trying to do was validated. Because, remember, I didn’t want to change society. I wanted to give society a chance to determine if it should change itself.”

“All I wanted was for the public to be able to have a say in how they are governed,” he said. “That is a milestone we left a long time ago. Right now, all we are looking at are stretch goals.”

Snowden, at least, claims to have contemplated the possibility that, given a choice, we won’t change how we’re governed.

And neither O’Hehir nor Moglen contemplates the state we’re currently in, in which what we call democracy is choosing to expand surveillance in response to Snowden’s disclosures.

Admittedly, the response to Snowden is not limited to HR 3361. I have long thought a more effective response might (or might not!) be found in courts — that if, if the legal process does not get pre-empted by legislation. I have long thought the pressure on Internet companies would be one of the most powerful engines of change, not our failed democratic process.

But as far as Congress is concerned, our stunted legislative process has started down the road of expanding surveillance in response to Edward Snowden.

And that’s where I find Moglen useful but also problematic.

He notes that the surveillance before us is not just part of domestic control (indeed, he actually pays less attention to the victims of domestic surveillance than I might have, but his is ultimately a technical argument), but also of Empire.

While I don’t think it’s the primary reason driving the democratic response to Snowden to increase surveillance (I think that also stems from the Deep State’s power and the influence of money on Congress, though many of the surveillance supporters in Congress are also supporting a certain model of US power), I think far too many people act on surveillance out of either explicit or implicit beliefs about the role of US hegemony.

There are some very rational self-interested reasons for Americans to embrace surveillance.

For the average American, there’s the pride that comes from living in the most powerful country in history, all the more so now that that power is under attack, and perhaps the belief that “Us” have a duty to take it to “Them” who currently threaten our power. And while most won’t acknowledge it, even the declining American standard of living still relies on our position atop the world power structure. We get cheap goods because America is the hegemonic power.

To the extent that spying on the rest of the world serves to shore up our hegemonic position then, the average American might well have reason to embrace the spying, because it keeps them in flat screen TVs.

But that privilege is just enjoyed by some in America. Moglen, tellingly, talks a lot about slavery but says nothing about Jim Crow or the other instruments of domestic oppression that have long used authoritarian measures against targeted populations to protect white male power. American history looked at not against the history of a slavery that is past, but rather against the continuity of history in which some people — usually poor and brown and/or female — don’t participate in the American “liberty” and “privacy” Moglen celebrates, our spying on the rest of the world is more of the same, a difference in reach but not in kind. Our war on drugs and war on terror spying domestically is of a piece with our dragnet internationally, if thus far more circumscribed by law (but that law is expanding and that will serve existing structures of power!).

But there’s another reason Americans — those of the Michael Kinsley and George Packer class — might embrace surveillance. That’s the notion that American hegemony is, for all its warts, the least bad power out there. I suspect Kinsley and (to a lesser extent) Packer would go further, saying that American power is affirmatively good for the rest of the world. And so we must use whatever it takes to sustain that power.

It sounds stupid when I say it that way. I’m definitely oversimplifying the thought process involved. Still, it is a good faith claim: that if the US curtails its omnipresent dragnet and China instead becomes the dominant world power (or, just as likely, global order will dissolve into chaos), we’ll all be worse off.

I do think there’s something to this belief, though it suppresses the other alternative — that the US could use this moment to improve the basis from which US exercises its hegemony rather than accept the increasingly coercive exercise of our power — or better yet use the twilight of our hegemony to embrace something more fair (and also something more likely to adequately respond to the global threat of climate change). But I do believe those who claim US hegemony serves the rest of the world believe it fairly uncritically.

One more thing. Those who believe that American power is affirmatively benign power may be inclined to think the old ways of ensuring that power — which includes a docile press — are justified. As much as journalism embraced an adversarial self-image after Watergate, the fundamentally complicit role of journalism really didn’t change for most. Thus, there remains a culture of journalism in which it was justified to tell stories to the American people — and the rest of the world — to sustain American power.

One of those stories, for example, is the narrative of freedom that Moglen embraces.

That is, for those who believe it is worth doing whatever it takes to sustain the purportedly benign American hegemon, it would be consistent to also believe that journalists must also do whatever it takes to sustain purportedly benign system of (white male) power domestically, which we call democracy but which doesn’t actually serve the needs of average Americans.

And for better or worse, those who embrace that power structure, either domestically and/or internationally, expanding surveillance is rational, so long as you ignore the collateral damage.

Update: Tempered critique of Packer because I agree he’s not embracing this journalist as narrative teller as much.