Posts

The Klayman Hearing: Everyone Can Stand If DOJ Has the Backbone

/2 Comments/in /by

Update: See this post, which explains that I’m wrong about the timing of Verizon’s different approach to production than AT&T. And that difference precedes Verizon’s withdrawal from the FBI call record program in 2009 — it goes back to 2007.

I’m finally getting around to listening to the Klayman v. Obama hearing from the other day, which you can listen to here. I’ll have more to say on it later. But my impression is that — because of the incomplete reporting of a bunch of NSA beat reporters — Klayman may be improperly thrown out on standing because he is only a Verizon cell customer, not a Verizon landline customer.

Back on June 14, 2013, the WSJ reported that Verizon Wireless and T-Mobile don’t turn over records under the phone dragnet, but that the government obtains those records anyway as they travel across the domestic backbone, largely owned by AT&T and Verizon Business Services.

The National Security Agency’s controversial data program, which seeks to stockpile records on all calls made in the U.S., doesn’t collect information directly from T-Mobile USA and Verizon Wireless, in part because of their foreign ownership ties, people familiar with the matter said.

The blind spot for U.S. intelligence is relatively small, according to a U.S. official. Officials believe they can still capture information, or metadata, on 99% of U.S. phone traffic because nearly all calls eventually travel over networks owned by U.S. companies that work with the NSA.

[snip]

Much of the U.S.’s telecom backbone is owned by two companies: AT&T and Verizon Business Network Services Inc., a U.S. subsidiary of Verizon Communications that it views as a separate network from its mobile business. It was the Verizon subsidiary that was named in the FISA warrant leaked by NSA contractor Edward Snowden to the Guardian newspaper and revealed last week.

When a T-Mobile or Verizon Wireless call is made, it often must travel over one of these networks, requiring the carrier to pay the cable owner. The information related to that transaction—such as the phone numbers involved and length of call—is recorded and can then be passed to the NSA through its existing relationships.

Then, on February 7, 2014, the WSJ (and 3 other outlets) reported something entirely different — that the phone dragnet only collects around 20% of phone records (others reported the number to be a higher amount).

The National Security Agency’s collection of phone data, at the center of the controversy over U.S. surveillance operations, gathers information from about 20% or less of all U.S. calls—much less than previously thought, according to people familiar with the NSA program.

The program had been described as collecting records on almost every phone call placed in the U.S. But, in fact, it doesn’t collect records for most cellphones, the fastest-growing sector in telephony and an area where the agency has struggled to keep pace, the people said.

Over the course of 8 months, the WSJ’s own claim went from the government collecting 99% of phone data (defined as telephony) to the government collecting 20% (probably defining “call data” broadly to include VOIP), without offering an explanation of what changed. And it was not just its own earlier reporting with which WSJ conflicted; aspects of it also conflicted with a lot of publicly released primary documents about what the program has done in the past. Nevertheless, there was remarkably little interest in explaining the discrepancy.

I’m getting a lot closer to being able to explain the discrepancy in WSJ’s reporting. And if I’m right, then Larry Klayman should have standing (though I’m less certain about Anna Smith, who is appealing a suit in the 9th Circuit).

I’m fairly certain (let me caveat: I think this is the underlying dynamic; the question is the timing) the discrepancy arises from the fact that, for the first time ever, on July 19, 2013 (a month after the WSJ’s first report) the FISA Court explicitly prohibited the collection of Cell Site Location Information.

Furthermore, this Order does not authorize the production of cell site location information (CSLI).

We’ve learned several details since February that puts this in context.

First, the NSL IG Report revealed that one of the three providers who had been part of FBI’s onsite call records access from 2003 to 2006 did not renew the contract for that program in 2009.

Company A, Company B, and Company C are the three telephone carriers described in our Exigent Letters Report that provided telephone records to the TCAU in response to exigent letters and other informal requests between 2003 and 2006. As described in our Exigent Letters Report, the FBI entered into contracts with these carriers in 2003 and 2004, which required that the communication service providers place their employees in the TCAU’s office space and give these employees access to their companies’ databases so they could immediately service FBI requests for telephone records. Exigent Letters Report, 20. As described in the next chapter, TCAU no longer shares office space with the telephone providers. Companies A and C continue to serve FBI requests for telephone records and provide the records electronically to the TCAU. Company B did not renew its contract with the FBI in 2009 and is no longer providing telephone records directly to the TCAU. Company B continues to provide telephone records in response to NSL requests issued directly by the field without TCAU’s assistance.

The original WSJ, in retrospect, makes it fairly clear that Company B is Verizon (though I believe it provides the wrong explanation otherwise for Verizon’s inability to provide records, that it was partly foreign owned–though admittedly it only claims to be providing part of the explanation).

Unlike Sprint and AT&T, [Verizon Wireless and T-Mobile] also don’t perform classified work for the government. Such contracts require secure facilities that make cooperating with NSA programs simpler, people familiar with the matter said.

Verizon Associate General Counsel Michael Woods’ response to questions at a hearing earlier this year made it even more clear. He said that Verizon does not keep call detail records — as distinct from billing records — long at all (and they only keep billing records on the landline side for 18 months).

The contract with TCAU, the NSL IG Report (and the earlier Exigent Letters report) makes clear, would require providers to keep records for longer to facilitate some bells and whistles. That’s a big part of what the “make cooperating with NSA programs simpler” is likely about. Therefore, Verizon must be the provider that stopped retaining records in 2009 for the purpose of the government (It also just so happens to be the provider that doesn’t need the government cash as part of its business model). I suspect that TCAU remains closely related to Hemisphere, which may be why when I asked FBI about its participation in that unclassified project, FBI refused to comment at all.

If all that’s right, then AT&T and Sprint retain their call detail records because they have signed a contract with the government to do so. Verizon does not.

That means, at least since 2009, Verizon has been relying on actual call detail records to fulfill its obligations under Section 215, not a database that makes it easier to pull out precisely what the government wants (indeed, I suspect the end of the contract created the problems where Verizon was providing entirely foreign calls along with its domestic calls starting with the May 29, 2009 order).  The business records that Verizon had on hand was a CDR that, in the case of cell phones, necessarily included CSLI.

Verizon is still (the Verizon-specific language remains in the dragnet orders, and they challenged the first order after Leon’s decision in this case) providing records of landline calls that traverse its backbone.

But when FISC made it a violation — rather than just overproduction they otherwise would have and have, in both this and other programs, approved — to provide CSLI, and made that public, it gave Verizon the opportunity to say it had no way to provide the cell data legally.

That’s sort of what the later WSJ report says, though it doesn’t explain why this would be limited in time or why NSA would have a problem when it collects CDRs internationally with CSLI with no problem.

Moreover, the NSA has been stymied by how to remove location data—which it isn’t allowed to collect without getting additional court approval—from U.S. cellphone records collected in bulk, a U.S. official said.

I’m not sure whether it’s the case that Verizon couldn’t very easily pull that CSLI off or not. But I do suspect — particularly for a program that offers no compensation — that Verizon no longer had a legal obligation to. (This probably answers, by the way, how AT&T and Sprint are getting paid here: they’re being paid to keep their CDRs under the old TCAU contracts with the FBI.)

The government repeats over and over that they’re only getting business records the companies already have. Verizon has made it clear it doesn’t have cell call detail records without the location attached. And therefore, I suspect, the government lost its ability to make Verizon comply. That is also why, I suspect, the President claims he needs new legislation to make this happen: because he needs language forcing the providers to provide the CDRs in the form the government wants it in.

If I’m right, though — that the government had 99% coverage of telephony until Claire Eagan specifically excluded cell location — then Klayman should have standing. That’s because Richard Leon’s injunction not only prohibited the government from collecting any new records from Klayman, he also required the government to “destroy any such metadata in its possession that was collected through the bulk collection program.”

Assuming Verizon just stopped providing cell data in 2013 pursuant to Eagan’s order, then there would still be over 3 years of call records in the government’s possession available for search. Which would mean he would still be exposed to the government’s improper querying of his records.

It is certainly possible that Verizon stopped providing cell data once it ended its TCAU contact in 2009. If that’s the case, the government’s hasty destruction of call records in March would probably have eliminated the last of the data it had on Klayman (though not on ACLU, since ACLU is a landline customer as well as a wireless customer).

But if Verizon just stopped handing over cell records in 2013 after Claire Eagan made it impossible for the government to force Verizon to comply with such orders, then Klayman — and everyone else whose records transited Verizon’s backbone — should still have standing.

Update: I provided this further explanation to someone via email.

I should have said this more clearly in the post. But the only way everyone is correct: including WSJ in June, Claire Eagan’s invocation of “substantially all” in July, the PRG’s claims they weren’t getting as much as thought in December, and WSJ’s claims they weren’t much at all in February, is if Verizon shut down cell collection sometime during that period. The July order and the aftermath would explain that.

I suspect the number is now closer to 50-60% of US based telephony records within the US (remember, on almost all international traffic, there should be near duplication, because they’re collecting that at scale offshore), but there’s also VOIP and other forms of “calls” and texts that they’re not getting, which is how you get down to the intentionally alarmist 20%. One reason I think Comey’s going after Apple is because iMessage is being carved out, and Verizon is already pissed, so he needs to find a way to ensure that Apple doesn’t get a competitive advantage over Verizon by going through WiFi that may not be available to Verizon because it is itself the backbone. But if you lose both Verizon’s cell traffic AND any cell traffic they carry, you lose a ton of traffic.
That gets you to the import of the FBI contract. It is a current business purpose of AT&T and Sprint to create a database that they can charge the FBI to use to do additional searching, including location data and burner phones and the like. AT&T’s version of this is probably Hemisphere right now (thus, in FBI-speak, TCAU would be Hemisphere), meaning they also get DEA and other agencies to pay for it. In that business purpose, the FBI is a customer of AT&T and Sprint’s business decision to create its own version of the NSA’s database, including all its calls as well as things like location data the FBI can get so on individualized basis.
Verizon used to choose to pursue this business (this is the significance, I think, of the government partially relying on a claim to voluntary production, per Kris). In 2009, they changed their business approach and stopped doing that. So they no longer have a business need to create and keep a database of all its phone records.
What they do still have are SS7 routing records of all traffic on their backbone, which they need to route calls through their networks (which is what AT&T uses to build their database). That’s the business record they use to respond to their daily obligations.
But there seem to be two likely reasons why the FISC can’t force Verizon to alter those SS7 records, stripping the CSLI before delivering it to the government. First, there is no means to compensate the providers under Section 215. That clearly indicates Congress had no plan to ask providers to provide all their records on a daily basis. But without compensation, you can’t ask the providers to do a lot of tweaking.
The other problem is if you’re asking the providers to create a record, then you’re getting away from the Third Party doctrine, aren’t you? In any case, the government and judges have repeated over and over, they can only get existing business records the providers already have. Asking Verizon to do a bunch to tweak those records turns it into a database that Verizon has created not for its own business purpose, but to fulfill the government’s spying demands.
I think this is the underlying point of Woods’ testimony where he made it clear Verizon had no intent of playing Intelligence agent for the government. Verizon seems to have made it very clear they will challenge any order to go back into the spying for the government business (all the more so after losing some German business because of too-close ties to the USG). And since Verizon is presumably now doing this for relatively free (since 2009, as opposed to AT&T and Sprint, who are still getting paid via their FBI contract), the government has far less ability to make demands.
This is also where I think the cost from getting complete coverage comes from. You have to pay provider sufficiently such that they are really doing the database-keeping voluntarily, which presumably gets it well beyond reasonable cost compensation.
Update: One final point (and it’s a point William Ockham made a billion years ago). The foreign data problem Verizon had starting in 2009 would be completely consistent with a shift from database production to SS7 production, because SS7 records are going to have everything that transits the circuit.

Hospital Hero Jack Goldsmith, the Destroyer of the Internet Dragnet, Authorized the Internet Dragnet

/22 Comments/in , /by

As I noted earlier, I think the re-release of Jack Goldsmith’s May 6, 2004 OLC memo authorizing Stellar Wind is meant to warn Congress that the Executive does not believe it needs any Congressional authorization to spy on every American — just in time for the USA Freedom Act debate in the Senate. This is exactly parallel to similar provocations during the Protect America Act debate. In the past, such provocations led Congress to capitulate to Executive branch demands to tailor the program to their wishes.

That earlier post, however, implied that this warning pertains primarily to the phone dragnet.

It doesn’t. The warning also applies to the Internet dragnet (and I suspect that stories about the heroic hospital heroes shutting down the Internet dragnet have been dramatically overblown).

One of the very few things — aside from the name STELLAR WIND, over and over, as well as references to content collection that could have been released after President Bush admitted to that part of the program in 2005, and the title Secretary of Defense — that has been newly revealed is this bit of the Table of Contents (here’s the previous release for comparison).

Screen Shot 2014-09-06 at 1.05.11 PM

 

It shows that the memo discusses content, discusses telephony metadata, discusses something else, then concludes that content and metadata are both kosher under the Fourth Amendment. That already makes it clear that part IV is about metadata. The last sentence of the first full paragraph on page 19 does, too. Page 7 makes it clear that Fourth Amendment analysis applies to “both telephony and e-mail.” Much later in the memo, it becomes clear this section — pages 96 to 100 — deals with Internet metadata.

In fact, the only substantive newly unredacted parts of the memo appear on 101 (PDF 69) and then from 106 to 108.

All of this new information makes it clear that Goldsmith asserted that Smith v. Maryland applied for metadata — and applied to both phone and Internet metadata. Remarkably, in that analysis, the government keeps at least one paragraph addressing phone metadata hidden, but reveals the analysis at 106-7 (PDF 74-75) that applies to Internet. (Goldsmith’s claim that Internet users can get providers to turn off spam, at the bottom of 107, is particularly nice.)

In perhaps the most interesting newly released passage (out of the roughly 5 pages that got newly released!), Goldsmith absolves himself of examining what procedures the government was using in its “metadata” collection.

As for meta data collection, as explained below, we conclude that under the Supreme Court’s decision in Smith v. Maryland, 442 U.S. 735 (1979), the interception of the routing information for both telephone calls and e-mails does not implicate any Fourth Amendment interests.85

85 Although this memorandum evaluates the STELLAR WIND program under the Fourth Amendment, we do not here analyze the specific procedures followed by the NSA in implementing the program.  (101/PDF 69)

I find this utterly damning, given that we know that, for the following 5 years, the government would lie to FISC about whether their “metadata” contained content. Even the OLC opinion built in the Executive’s ability to collect content in the guise of metadata!

In any case, what is clear — again, just in time to impact the debate over USA Freedom, for which prospective call record collection might or might not be limited to telephone content — is that rather than legally shutting down the Internet dragnet in 2004, Jack Goldsmith authorized it.

And that authorization remains in place, telling the Executive it can collect Internet (and phone) “metadata” whether or not FISC or Congress rubberstamps it doing so. Not only that, but telling the Executive this analysis holds regardless of how inadequate their procedures are in implementing this program to ensure that no content gets swept up in the guise of metadata (which of course is precisely what occurred).

So the Administration, in releasing this “newly unredacted” memo did one thing. Tell Congress it will continue to collect phone and Internet “metadata” on its own terms, regardless of what Congress does.

Only one thing could alter this analysis of course: if the Courts decide that Smith v. Maryland doesn’t actually permit the government to collect all metadata, plus some content-as-metadata, in the country, if they say the Executive can’t actually collect “everything there is to know about everybody and have it all in one big government cloud,” as 2nd Circuit Judge Gerard Lynch described the implications of what we now know to be Goldsmith’s logic on Tuesday. But the courts are going to stop analyzing this question as soon as Congress passes USA Freedom Act. Moreover, the last check on the program — the unwillingness of providers to break the law — will be removed by the broad immunity provision included in the bill.

Not only didn’t Jack Goldsmith heroically legally shut down the Internet dragnet in 2004 (clearly President Bush did make several modifications; we just still don’t know what those are). But he provided a tool that is likely proving remarkably valuable as the Executive gets Congress and privacy NGOs to finish signing off on their broad authority.

The hospital heroes may have temporarily halted the conduct of the Internet dragnet — even while telling Colleen Kollar-Kotelly she had to rubber stamp ignoring the letter of the law because Congress couldn’t know about the dragnet — but they didn’t shut it down. Here it is, legally still operating, just in time to use as a cudgel with Congress.

Update: One other thing other reporting on this is missing — and not for the first time — is that whatever change they made to the Internet dragnet, it was by no means the only change after the hospital confrontation. They also took Iraqi targeting out (in some way). And there was a later April 2 modification that appears to have nothing to do with NSA at all (I have my theories about this, but they’re still theories). So it is too simple to say the hospital confrontation was exclusively about the Internet dragnet — the public record already makes clear that’s not the case.

“What Else Haven’t You Let Us Know?” 2nd Circuit Asks DOJ

/14 Comments/in /by

Well into today’s argument over ACLU v. Clapper, the ACLU’s challenge to the government’s phone dragnet, one of the judges — Robert Sack — pointed out the discussion we’re having all stems from documents the government was forced to release after the Edward Snowden leaks.

It was itself telling — not least because DOJ Civil Division AAG Stuart Delery at times proclaimed not to know the answers to the questions the judges posed, questions I know the answer to. For example, Delery claimed, at first, not to know of instances when the FISA Court ruled more harshly than the government; and when he ultimately did admit to those instances, he didn’t admit that some of them involved systematic abuses. He also dodged questions about whether the government could get financial records, which we know they do (and James Cole has testified they could).

It was all the more telling, however, given that two of the judges on the panel — Gerard Lynch and Sack — had ruled against the government in Amnesty v. Clapper, ACLU’s challenge to the Section 702 program. As you’ll recall, to get SCOTUS to overturn that ruling, DOJ lied to the Supreme Court about what kind of notice it gave to defendants under Section 702. Snowden’s leaks led to a change in DOJ’s notice policy to actually come closer — but not actually match –what DOJ had claimed before SCOTUS (they’re still not giving notice to all defendants). At one point, Lynch said something like, “We weren’t as familiar [with 702] as the Supreme Court thought we should have been.”

These judges have reason to be skeptical about DOJ’s claims about their own surveillance programs. Which is probably why Sack asked (after 1:36), “That’s what you’ve let us know. What else haven’t you let us know?”

Much of the hearing went like I expected. ACLU’s Alex Abdo argued both that the court has the authority to overturn the dragnet based on statutory grounds, but also that it’s not reasonable and therefore constitutional. He used Obama’s decision to change the program to argue that the Administration recognizes that the program, as currently constituted, is not reasonable. To support an argument the program is reasonable, DOJ’s Delery claimed Congress had ratified it by reauthorizing it twice. On rebuttal, Abdo noted that Congress had never seen the legal basis (because there was none, until 2013) before they allegedly “ratified” the program.

Delery’s arguments were even weaker than I had expected. He argued that the courts can’t intrude here because the political branches had worked out reasonable limits for this program, pointing to the minimization procedures required by the statute. Except that — as he admitted later — the FISA Court had largely influenced the minimization procedures for the program. If a Court set the minimization procedures that make it reasonable, then can’t a court rule on whether that’s a proper balance?

Not to mention, the statute only requires FBI have minimization procedures, not NSA, so the minimization procedures in the statute are proof the government is actually using the statute with an agency Congress did not envision using it.

Abdo returned to the centrality of minimization procedures in his closing words. He noted that if, as the government claims, Section 215 is authorized by Smith v. Maryland, then, minimization procedures are constitutionally superfluous.

The minimization procedures that the government relies on would be constitutionally superfluous if Smith governed this case. They could collect the records without any of those protections in place. They could store all of them indefinitely. They could query them for any reason or no reason at all. And they could build the dossiers that they disclaim building in this case with no constitutional restrictions. A final point is that the government tries to explain why it’s only asking for a narrow ruling from this court. But the legal theories that it advances are a roadmap to a world in which the government routinely collects vast quantities of information about Americans who have done absolutely nothing wrong. I don’t think that’s the world that Congress envisioned when it enacted Section 215. And it’s certainly not the world that the framers envisioned when they crafted the Fourth Amendment.

But that would bring us to the scenario laid out by Judge Lynch (see from 59:00 to 1:06:50), in which the government could get anything held by a third party about everyone just because it could. The same argument applies to bank records and credit card records, Lynch walked Delery through the implications patiently.

… You can collect everything there is to know about everybody and have it all in one big government cloud.

[snip]

I just don’t understand an argument as to what’s so special about telephone records that makes them so valuable, so uniquely interactive or whatever, that the same arguments you’re making don’t apply to every record in the hands of a third party business entity of every American’s everything.

As far as we know, the government has already done this with financial records, in part under Section 215, which is one of the reasons Obama won’t back off this challenge; even under USA Freedom, the government can continue to obtain Western Union’s records. Add in the EO 12333 collections, and the government is well on its way to the nightmarish scenario both Lynch and Abdo laid out.

In any case, Judge Lynch (more likely his clerks) seems to have done his homework. He seems to have a sense not only where this could go, but where it already has. And while he repeatedly talked about narrow rulings — if I had to guess, I think he might prefer to rule the “relevant” interpretation Bates-stamped by the FISA Court unconstitutional than ruling the entire program so — he gets that this program is a constitutional atrocity.

The question is whether he can write a ruling that will withstand SCOTUS review, this time.

Leahy’s Freedom Act May Not Change Status Quo on Records Other than Call Records

/2 Comments/in /by

Update: According to the DOJ IG NSL Report released today, the rise in number of Section 215 orders stems from some Internet companies refusing to provide certain data via NSL; FBI has been using Section 215 instead. However they’re receiving it now, Internet companies, like telephone companies, should not be subject to bulk orders as they are explicitly exempted. 

WaPo’s MonkeysCage blog just posted a response I did to a debate between H.L. Pohlman and Gabe Rottman over whether Patrick Leahy’s USA Freedom includes a big “backdoor” way to get call records. The short version: the bill would prevent bulk — but not bulky — call record collection. But it may do nothing to end existing programs, such as the reported collection of Western Union records.

In the interest of showing my work, he’s a far more detailed version of that post.

Leahy’s Freedom still permits phone record collection under the existing authority

Pohlman argues correctly that the bill specifically permits the government to get phone records under the existing authority. So long as it does so in a manner different from the Call Detail Record newly created in the bill, it can continue to do so under the more lenient business records provision.

To wit: the text “carves out” the government’s authority to obtain telephone metadata from its more general authority to obtain “tangible things” under the PATRIOT Act’s so-called business records provision. This matters because only phone records that fit within the specific language of the “carve out” are subject to the above restrictions on the government’s collection authority.  Those restrictions apply only “in the case of an application for the production on a daily basis of call detail records created before, on, or after the date of the application relating to an authorized investigation . . . to protect against international terrorism.”

This means that if the government applies for a production order of phone records on a weekly basis, rather than on a “daily basis,” then it is falls outside the restrictions. If the application is for phone records created “before, on, [and] after” (instead of “or after”) the date of the application, ditto. If the investigation is not one of international terrorism, ditto.

However, neither Pohlman nor Rottman mention the one limitation that got added to USA Freedumber in Leahy’s version which should prohibit the kind of bulk access to phone records that currently goes on.

Leahy Freedom prohibits the existing program with limits on electronic service providers

The definition of Specific Selection Term “does not include a term that does not narrowly limit the scope of the tangible things … such as–… a term identifying an electronic communication service provider … when not used as part of a specific identifier … unless the provider is itself a subject of an authorized investigation for which the specific selection term is used as the basis of production.”

In other words, the only way the NSA can demand all of Verizon’s call detail records, as they currently do, is if they’re investigating Verizon. They can certainly require Verizon and every other telecom to turn over calls two degrees away from, say, Julian Assange, as part of a counterintelligence investigation. But that language pertaining to electronic communication service provider would seem to prevent the NSA from getting everything from a particular provider, as they currently do.

So I think Rottman’s largely correct, though not for the reasons he lays out, that Leahy’s Freedom has closed the back door to continuing the comprehensive phone dragnet under current language.

But that doesn’t mean it has closed a bunch of other loopholes Rottman claims have been closed.

FISC has already dismissed PCLOB (CNSS) analysis on prospective collection 

For example, Rottman points to language in PCLOB’s report on Section 215 stating that the statutory language of Section 215 doesn’t support prospective collection. I happen to agree with PCLOB’s analysis, and made some of the same observations when the phone dragnet order was first released. More importantly, the Center for National Security Studies made the argument in an April amicus brief to the FISC. But in an opinion released with the most recent phone dragnet order, Judge James Zagel dismissed CNSS’ brief (though, in the manner of shitty FISC opinions, without actually engaging the issue).

In other words, while I absolutely agree with Rottman’s and PCLOB’s and CNSS’ point, FISC has already rejected that argument. Nothing about passage of the Leahy Freedom would change that analysis, as nothing in that part of the statute would change. FISC has already ruled that objections to the prospective use of Section 215 fail.

Minimization procedures may not even protect bulky business collection as well as status quo

Then Rottman mischaracterizes the limits added to specific selection term in the bill, and suggests the government wouldn’t bother with bulky collection because it would be costly.

The USA Freedom Act would require the government to present a phone number, name, account number or other specific search term before getting the records—an important protection that does not exist under current law. If government attorneys were to try to seek records based on a broader search term—say all Fedex tracking numbers on a given day—the government would have to subsequently go through all of the information collected, piece by piece, and destroy any irrelevant data. The costs imposed by this new process would create an incentive to use Section 215 judiciously.

As I pointed out in this post, those aren’t the terms permitted in Leahy Freedom. Rather, it permits the use of “a person, account, address, or personal device, or another specific identifier.” Not a “name” but a “person,” which in contradistinction from the language in the CDR provision — which replaces “person” with “individual” — almost certainly is intended to include “corporate persons” among acceptable SSTs for traditional Section 215 production.

Like Fedex. Or Western Union, which several news outlets have reported turns over its records under Section 215 orders.

FISC already imposes minimization procedures on most of its orders

Rottman’s trust that minimization procedures will newly restrain bulky collection is even more misplaced. That’s because, since 2009, FISC has been imposing minimization procedures on Section 215 collection with increasing frequency; the practice grew in tandem with greatly expanded use of Section 215 for uses other than the phone dragnet.

While most of the minimization procedure orders in 2009 were likely known orders fixing the phone dragnet violations, the Attorney General reports covering 2010 and 2011 make it clear in those years FISC modified increasing percentages of orders by imposing minimization requirements and required a report on compliance with them

The FISC modified the proposed orders submitted with forty-three such applications in 2010 (primarily requiring the Government to submit reports describing implementation of applicable minimization procedures).

The FISC modified the proposed orders submitted with 176 such applications in 2011 (requiring the Government to submit reports describing implementation of applicable minimization procedures).

That means the FISC was already requiring minimization procedures for 176 orders in 2011, only 5 of which are known to be phone dragnet orders. Read more →

Did ACLU and EFF Just Help the NSA Get Inside Your Smart Phone?

/10 Comments/in /by

EFF ACLUThe ACLU and EFF normally do great work defending the Fourth Amendment. Both have fought the government’s expansive spying for years. Both have fought hard to require the government obtain a warrant before accessing your computer, cell phone, and location data.

But earlier this week, they may have taken action that directly undermines that good work.

On Wednesday, both civil liberties organizations joined in a letter supporting Patrick Leahy’s version of USA Freedom Act, calling it a necessary first step.

We support S. 2685 as an important first step toward necessary comprehensive surveillance reform. We urge the Senate and the House to pass it quickly, and without
making any amendments that would weaken the important changes described above.

ACLU’s Laura Murphy explained why ACLU signed onto the bill in a column at Politico, analogizing it to when, in 2010, ACLU signed onto a bill that lowered, but did not eliminate,  disparities in crack sentencing.

Reform advocates were at a crossroads. Maximalists urged opposition despite the fact the bill would, in a very real way, make life better for thousands of people and begin to reduce the severe racial and ethnic inequality in our prison system. Pragmatists, fearing that opposition to the bill would preclude any reform at all, urged support.

It was a painful compromise, but the ACLU ultimately supported the bill. It passed, astoundingly, with overwhelming support in both chambers.

And then something amazing happened. Conservative lawmakers, concerned about government waste, increasingly came to the table to support criminal justice reform. Liberals realized they could vote their conscience on criminal justice without accusations of being “soft on crime.” It has not been easy and there have been many steps backward, but in recent years, we’ve seen greater public opposition to mandatory minimum sentences and real movement on things like reducing penalties for low-level drug offenses.

The analogy is inapt. You don’t end crack disparities by increasing the number of coke dealers in jail. But Leahy’s USA Freedom Act almost certainly will increase the number of totally innocent Americans who will be subjected to the full brunt of NSA’s analytical authorities indefinitely.

That’s because by outsourcing to telecoms, NSA will actually increase the total percentage of Americans’ telephone records that get chained on; sources say it will be more “comprehensive” than the current dragnet and Deputy NSA Director Richard Ledgett agrees the “the actual universe of potential calls that could be queried against is [potentially] dramatically larger.” In addition, the telecoms are unlikely to be able to remove all the noisy numbers like pizza joints — as NSA currently claims to — meaning more people with completely accidental phone ties to suspects will get sucked in. And USA Freedom adopts a standard for data retention — foreign intelligence purpose — that has proven meaningless in the past, so once a person’s phone number gets turned over to the NSA, they’ll be fair game for further NSA spying, the really invasive stuff, indefinitely.

But that’s not the reason I find ACLU and EFF’s early support for USA Freedom so astounding.

I’m shocked ACLU and EFF are supporting this bill because they don’t know what the NSA will be permitted to do at the immunized telecoms. They have blindly signed onto a bill permitting “connection chaining” without first understanding what connection chaining entails.

As I have reported extensively, while every witness who has talked about the phone dragnet has talked about chaining on phone calls made — all the calls Anwar al-Awlaki made, all the calls those people made — the language describing this chaining process has actually been evolving. Dianne Feinstein’s Fake FISA Fix last fall allowed the NSA to chain on actual calls — as witnesses had described — but also on communications (not just calls) “to or from any selector reasonably linked to the selector.” A February modification and the last two dragnet orders permitted NSA to chain on identifiers “with a contact and/or connection” with the seed, making it clear that a “connection” is something different than a “contact.” The House bill USA Freedumber adopted the same language in a legislative report. Leahy’s bill adopts largely the same language for chaining.

(iii) provide that the Government may require the prompt production of call detail records—

(I) using the specific selection term that satisfies the standard required under subsection (b)(2)(C)(ii) as the basis for production; and

(II) using call detail records with a direct connection to such specific selection term as the basis for production of a second set of call detail records;

Now, it’s possible that this language does nothing more than what NSA illegally did until 2009: chain on both the identifier itself, but also on identifiers it has determined to be the same person. Back in 2009, NSA referred to a separate database to determine these other identifiers. Though that’s unlikely, because the bill language suggests the telecoms will be identifying these direct connections.

It’s possible, too, that this language only permits the telecoms to find “burner” phones — a new phone someone adopts after having disposed of an earlier one — and chain on that too.

But it’s also possible that this language would permit precisely what AT&T does for DEA in its directly analogous Hemisphere program: conduct analysis using cell site data. The bill does not permit NSA to receive cell site data, but it does nothing to prohibit NSA from receiving phone numbers identified using cell site data. When Mark Warner asked about this, Ledgett did not answer, and James Cole admitted they could use these orders (with FISC approval) to get access to cell location.

It’s possible, too, that the telecoms will identify direct connections using other data we know NSA uses to identify connections in EO 12333 data, including phone book and calendar data.

The point is, nobody in the public knows what “connections” NSA will be asking its immunized telecom partners to make. And nothing in the bill or even the public record prohibits NSA from asking telecoms to use a range of smart phone information to conduct their analysis, so long as they only give NSA phone identifiers as a result.

In response to questions from Senators about what this means, Leahy’s office promised a letter from James Clapper’s office clarifying what “connections” means (No, I don’t remember the part of Schoolhouse Rock where those regulated by laws get to provide “clarifications” that don’t make it into the laws themselves). That letter was reported to be due on Tuesday, by close of business — several days ago. It hasn’t appeared yet.

I asked people at both EFF and ACLU about this problem. EFF admitted they don’t know what this language means. ACLU calls the language “ambiguous,” but based on nothing they were able to convey to me, insists getting smart phone data under the guise of connection chaining would be an abuse. ACLU also pointed to transparency provisions in the bill, claiming that would alert us if the NSA starting doing something funky with its connection language; that of course ignores that “connection chaining” is an already-approved process, meaning that existing processes won’t ever be need to be released. It also ignores that the Administration has withheld what is probably a directly relevant phone dragnet opinion from both ACLU and EFF in their dragnet FOIA.

I get Laura Murphy’s point about using USA Freedom to start the process of reform. But what I don’t understand is why you’d do that having absolutely no idea whether that “reform” codifies the kind of warrantless probable cause-free access to device data that ACLU and EFF have fought so hard to prevent elsewhere.

ACLU and EFF are supposed to be leaders in protecting the privacy of our devices, including smart phones. I worry with their embrace of this bill, they’re leading NSA right into our smart phones.

Did They Call Wiley Gill “Mohammed Raghead” Before Claiming Videogame Was a Flight Simulator?

/7 Comments/in /by

The ACLU is suing the Federal Government for the standards it uses in Suspicious Activity Reports, which can record completely innocent actions. A lot of people are citing James Prigoff — an 86-year old photographer and retired business executive, who got tracked to his Sacramento, CA home for taking a picture of a well-known Boston landmark.

But given the denials about the tracking of Muslims in response to the Intercept story on NSA’s surveillance of 5 Muslim leaders, the SAR complaint of of Wiley Gill, a convert to Islam, deserves as much attention.

Gill describes how the cops in Chico, CA, had been tracking him both online and at the local mosque, when they invented the pretense of a domestic violence complaint to search his home without a warrant. They found something on video games loaded on his computer and deemed it a flight simulator.

The SAR was created on or about May 23, 2012, and purports to document an encounter between Mr. Gill and the Chico Police Department (“CPD”) on or about May 20, 2012. The SAR states that a CPD officer was investigating a domestic violence incident and believed the suspect may have fled into Mr. Gill’s residence. The SAR states that this was later discovered to be unfounded. It acknowledges that the CPD officer searched Mr. Gill’s home. The SAR asserts that Mr. Gill’s computer displayed a screen titled something to the effect of “Games that fly under the radar,” which appeared to be a “flight simulator type of game.” The SAR concludes by describing Mr. Gill’s “full conversion to Islam as a young WMA [white, male adult],” “pious demeanor,” and “potential access to flight simulators via the internet” as “worthy of note.”

Admittedly, the bias inherent to Gill’s SAR came from local cops, not the FBI or NSA. But I’d be willing to bet it responded to alerts (FBI and DHS both release them) about white converts to Islam.

The Intercept story, remember, described an internal document referring to targets as “Mohammed Raghead.” NSA has disclaimed any tie to that — even more aggressively than FBI did its own totally racist documents.

And while I presume whatever alerts to local cops led them to track Gill’s non-suspicious behavior said nothing explicitly racist, at some point the system reinforces a system under which Muslims get tracked, and others do not.

Center for Democracy and Technology’s James Dempsey on “the Wall,” Then and Now

/1 Comment/in /by

Remember “the wall” that used to separate intelligence from criminal investigations and was used as an excuse for intelligence agencies not sharing intelligence they were permitted to share before 9/11?

It was demolished in 2001 — when the PATRIOT Act explicitly permitted what had been permitted before, sharing of intelligence information with the FBI — and 2002 — when the FISA Court of Review overruled presiding FISA Judge Royce Lamberth’s efforts to sustain some Fourth Amendment protections in criminal investigations using minimization procedures.

Nevertheless, the specter of a wall that didn’t prevent the Intelligence Committee from discovering 9/11 rising again is one of the things lying behind PCLOB’s weak recommendations on back door searches in its report on Section 702.

Of particular note, that’s what the Center for Democracy and Technology’s James Dempsey cites in his squishy middle ground recommendation on back door searches.

It is imperative not to re-erect the wall limiting discovery and use of information vital to the national security, and nothing in the Board’s recommendations would do so. The constitutionality of the Section 702 program is based on the premise that there are limits on the retention, use and dissemination of the communications of U.S. persons collected under the program. The proper mix of limitations that would keep the program within constitutional bounds and acceptable to the American public may vary from agency to agency and under different circumstances. The discussion of queries and uses at the FBI in this Report is based on our understanding of current practices associated with the FBI’s receipt and use of Section 702 data. The evolution of those practices may merit a different balancing. For now, the use or dissemination of Section 702 data by the FBI for non-national security matters is apparently largely, if not entirely, hypothetical. The possibility, however, should be addressed before the question arises in a moment of perceived urgency. Any number of possible structures would provide heightened protection of U.S. persons consistent with the imperative to discover and use critical national security information already in the hands of the government.546 

546 See Presidential Policy Directive — Signals Intelligence Activities, Policy Directive 28, 2014 WL 187435, § 2, (Jan. 17, 2014) (limiting the use of signals intelligence collected in bulk to certain enumerated purposes), available at http://www.whitehouse.gov/the-press-office/2014/01/17/presidential-policy-directive-signals-intelligence-activities.  [my emphasis]

Dempsey situates his comments in the context of the “wall.” He then suggests there are two possible uses of back door searches: “national security matters,” and non-national security matters, with the latter being entirely hypothetical, according to what the FBI self-reported to PCLOB.

Thus, he’s mostly thinking in terms of “possible structures [that] would provide heightened protection of US. persons,” to stave off future problems. He points to President Obama’s PPD-28 as one possibility as a model.

But PPD-28 is laughably inapt! Not only does the passage in question address “bulk collection,” which according to the definition Obama uses and PCLOB has adopted has nothing to do with Section 702. “[T]he Board does not regard Section 702 as a ‘bulk’ collection program,” PCLOB wrote at multiple points in its report.

More troubling, the passage in PPD-28 Dempsey cites permits bulk collection for the following uses:

(1) espionage and other threats and activities directed by foreign powers or their intelligence services against the United States and its interests;

(2) threats to the United States and its interests from terrorism;

(3) threats to the United States and its interests from the development, possession, proliferation, or use of weapons of mass destruction;

(4) cybersecurity threats;

(5) threats to U.S. or allied Armed Forces or other U.S or allied personnel;

(6) transnational criminal threats, including illicit finance and sanctions evasion related to the other purposes named in this section;

Ultimately, this represents — or should — an expansion of permissible use of Section 702 data, because its discussion of  terrorism and cybersecurity do not distinguish between those with an international nexus and those without. And the discussion of transnational crime might subject any petty drug dealer selling dope from Mexico to foreign intelligence treatment.

That this is what passes for the mushy middle on PCLOB is especially curious given that Dempsey was one of the first PCLOB member to express concern about back door searches. He did so in November’s Section 215 hearing, and even suggested limiting back door searches to foreign intelligence purposes (which is not the standard for FBI, in any case) was inadequate. Nevertheless, in last week’s report, he backed only very weak protections for back door searches, and did so within the context of national security versus non-national security, and not intelligence versus crime.

Now, I don’t mean to pick on Dempsey exclusively — I’ll have a few more posts on this issue. And to be clear, Dempsey does not represent CDT at PCLOB; he’s there in his private capacity.

But I raised his affiliation with CDT because in that capacity, Dempsey was part of an amicus brief, along with representatives from ACLU, Center for National Security Studies, EPIC, and EFF, submitted in the In Re Sealed Case in 2002, in which the FISA Court of Review reversed Lamberth and permitted prosecutor involvement in FISA warrants. That brief strongly rebuts the kind of argument he adopted in last week’s PCLOB report.

Read more →

The Delayed “Imminence” of Anwar al-Awlaki’s Killing

/33 Comments/in /by

As a number of people have noted (Jen Daskal is one), the OLC memo released yesterday doesn’t describe what the government considers an imminent threat.

Meanwhile, Ben Wittes is unexpectedly spending his time writing interesting posts about why imminence is in there in the first place, and not mocking the NYT editorial calling for a drone and/or targeted killing court.

Wittes writes.

I think the source of law for imminence in Holder’s speech, in the white paper, and in this memo is a presidential covert action finding. That is, I think the president, in issuing whatever finding gave rise to the killing of Al-Aulaqi, limited the authorization to situations involving imminent threats. This invocation was prudential, not legally required by any other source of law, but it operates as law for the executive branch.

There are a few pieces of evidence—not conclusive, but suggestive—supporting this view:

The most important is that memo—by omission—excludes the other major possibilities. If the imminence requirement is not there because of constitutional separation of powers, international law, or the constitutional rights of the targets, it’s got to be coming from somewhere. Internal executive branch law is one of the few remaining possibilities.

Moreover, it’s the only obvious possibility I can think of that would leave so little footprint in the memo. Indeed, if the imminence discussion is present but redacted, that suggests that the very source of law is classified. That is consistent with its appearance in a finding. Alternatively, if the reason the discussion seems to be missing is that it isn’t there at all, that is also consistent with its originating in a finding. After all, if we assume that imminence is only a requirement because the president said it’s a requirement, it follows that the concept means—at least in this context—whatever the president wants it to mean.

I’m not sure I buy that there is no legal reason for imminence, but I do agree it is relatively absent in what we have of the July 16, 2010 memo.

As it happens, in my thinking about the absence of a discussion of imminence in this memo, I have started comparing what’s in the white paper but not the OLC memo (I have already noted that the desultory treatment of why Courts couldn’t review the assassination is not in the OLC memo).

Remember, there are two possible explanations for why something would be in the White Paper (dated November 8, 2011, over a month after Awlaki was killed) but not in the July 16, 2010 OLC memo we got yesterday. First, those missing elements could be in the first OLC memo, from February 2010. Section VI of yesterday’s memo cites from and appears to repeat the analysis from that other memo. And that’s precisely where the reference to “imminent” is.

The task before OLC in February 2010 was likely somewhat different than the task in July 2010, because not only did OLC have to come up with an argument for killing an American going forward, but it likely felt some urgency to justify the attack on Awlaki attempted on Christmas Eve 2009, which was by all reports conducted under Article II justification. Dana Priest’s report that Awlaki was on the JSOC kill list probably created real urgency in January and February to provide this justification. Both the fact that that strike was attempted under solely Presidential authority, and that it was done without prior OLC review would raise the importance of arguing that Awlaki, in the wake of early December 2009 revelations that he had been in contact with Nidal Hasan, was an imminent threat.

The other possibility is that the emphasis on imminence came after the OLC memo, and DOJ added it into the white paper either for what was intended to be public (or at least Congressional) consumption, or to deal with developments that occurred between the time David Barron finished the memo in July 2010 and the time the government killed Awlaki 14 months later.

Meanwhile, I’ve been puzzling over something that appears in the white paper that we know can’t appear in either OLC memo: the citation to John Brennan’s September 16, 2011 speech on “Strengthening our Security by Adhering to our Values and Laws.” This sentence of that speech was cited: “The United States does not view our authority to use military force against al-Qa’ida as being restricted solely to ‘hot’ battlefields like Afghanistan.” That is, unless I’m mistaken, the only reference to a source that post-dates the OLC memo that authorized Awlaki’s killing.

As it turns out, that sentence introduces a discussion that leads to a treatment of the government’s definition of “imminence.”

The United States does not view our authority to use military force against al-Qa’ida as being restricted solely to “hot” battlefields like Afghanistan.  Because we are engaged in an armed conflict with al-Qa’ida, the United States takes the legal position that —in accordance with international law—we have the authority to take action against al-Qa’ida and its associated forces without doing a separate self-defense analysis each time.  And as President Obama has stated on numerous occasions, we reserve the right to take unilateral action if or when other governments are unwilling or unable to take the necessary actions themselves.

That does not mean we can use military force whenever we want, wherever we want. International legal principles, including respect for a state’s sovereignty and the laws of war, impose important constraints on our ability to act unilaterally—and on the way in which we can use force—in foreign territories.

Others in the international community—including some of our closest allies and partners—take a different view of the geographic scope of the conflict, limiting it only to the “hot” battlefields.  As such, they argue that, outside of these two active theatres, the United States can only act in self-defense against al-Qa’ida when they are planning, engaging in, or threatening an armed attack against U.S. interests if it amounts to an “imminent” threat.

In practice, the U.S. approach to targeting in the conflict with al-Qa’ida is far more aligned with our allies’ approach than many assume.  This Administration’s counterterrorism efforts outside of Afghanistan and Iraq are focused on those individuals who are a threat to the United States, whose removal would cause a significant – even if only temporary – disruption of the plans and capabilities of al-Qa’ida and its associated forces.  Practically speaking, then, the question turns principally on how you define “imminence.”

We are finding increasing recognition in the international community that a more flexible understanding of “imminence” may be appropriate when dealing with terrorist groups, in part because threats posed by non-state actors do not present themselves in the ways that evidenced imminence in more traditional conflicts.  After all, al-Qa’ida does not follow a traditional command structure, wear uniforms, carry its arms openly, or mass its troops at the borders of the nations it attacks.  Nonetheless, it possesses the demonstrated capability to strike with little notice and cause significant civilian or military casualties.  Over time, an increasing number of our international counterterrorism partners have begun to recognize that the traditional conception of what constitutes an “imminent” attack should be broadened in light of the modern-day capabilities, techniques, and technological innovations of terrorist organizations.

At a minimum, Brennan’s speech might suggest the imminence analysis is in the OLC memos, to the extent it is, because our allies would insist on it. But even while he does that — and purportedly cedes to the international view on the battlefield that would 2 weeks later take Awlaki’s life — he suggests the definition is changing.

Remember, too, that Assassination Drone Czar Brennan would have been the one to conduct the final review of the standards laid out before okaying the killing of Awlaki, the one to decide he was still an imminent threat 21 months after he was first targeted. So Brennan’s depiction of a changing standard of imminence is quite interesting, given that either by this time, or 2 weeks later, he would have signed off on the imminence of the threat Awlaki posed.

I raise Brennan not just because I find it significant that the white paper relied on this as a “source” of authority to kill Awlaki over a year after OLC had judged it. But the reliance on the speech also suggests that the white paper emphasis on imminence might post-date both OLC’s memos on Awlaki.

And there is one obvious thing that emphasized imminence — and the potential role of judges — that post-dated the OLC memo, though not by much. Around July 1, Nasir al-Awlaki’s father retained ACLU and Center for Constitutional Rights to represent him in a challenge to Awlaki’s targeting. The very same day OLC issued its memo, Treasury named Awlaki a Special Designated Terrorist, which required the ACLU and CCR to request permission to represent Awlaki’s father to avoid being charged with material support for terrorism.

In their suit — filed August 30 — they asked for,

a declaration from this Court that the Constitution and international law prohibit the government from carrying out targeted killings outside of armed conflict except as a last resort to protect against concrete, specific, and imminent threats of death or serious physical injury; and an injunction prohibiting the targeted killing of U.S. citizen Anwar Al-Aulaqi outside this narrow context.

That is, the ACLU/CCR suit emphasizing imminence almost certainly would have raised the stakes for it, if it wasn’t already a government standard.

In September, the government moved to dismiss the suit, arguing (as they did in the white paper but not the July 2010 OLC memo) that the courts had no role in reviewing this issue…

The Judiciary is simply not equipped to manage the President and his national security advisors in their discharge of these most critical and sensitive executive functions and prescribe ex ante whether, where, or in what circumstances such decisions would be lawful. Whatever the limits of the political question doctrine, this case is at its core.

… And arguing that the courts couldn’t determine whether someone was an imminent threat.

For example, even assuming for the sake of argument that plaintiff has appropriately described the legal contours of the President’s authority to use force in a context of the sort described in the Complaint, the questions he would have the court evaluate—such as whether a threat to life or physical safety may be “concrete,” “imminent,” or “specific,” or whether there are “reasonable alternatives” to force—can only be assessed based upon military and foreign policy considerations, intelligence and other sources of sensitive information, and real-time judgments that the Judiciary is not well-suited to evaluate.

See also this post for the choose your own adventure novel the government laid out to cover Awlaki’s killing.

Whatever the government argued in February 2010, its arguments to combat this suit in September 2010 required the government to deal with imminence directly, whether or not they did extensively in February or July 2010. And then, just weeks before they killed Awlaki (it having been a year since the most recent publicly claimed attack the government claimed Awlaki had a role in), the Administration publicly advocated a very flexible notion of imminence.

Clearly, the government nodded to imminence before the Nasir al-Awlaki suit, at least by a few weeks. But certainly, the government’s successful attempt at avoiding court review relied on certain arguments that show up in more prominent form in November 2011 then it does in July 2010.

Again, I’m agnostic whether the government emphasized imminence to explain the (under the standard as written, because the government did not believe Awlaki to be operational on that day) illegal strike against Awlaki from December 24, 2009, or whether they increased their focus on imminence in response to CCR and ACLU. But I think either might be a likely explanation.

“Trap and Trace Confidentiality” and National Dragnets

/5 Comments/in /by

As a number of outlets are reporting, ACLU liberated some emails catching Florida cops agreeing to lie about the Stingray devices used to capture suspects.

As you are aware for some time now, the US Marshalls and I believe FDLE have had equipment which enables law enforcement to ping a suspects cell phone and pin point his/her exact location in an effort to apprehend suspects involved in serious crimes. In the past, and at the request of the U.S. Marshalls, the investigative means utilized to locate the suspect have not been revealed so that we may continue to utilize this technology without the knowledge of the criminal element. In reports or depositions we simply refer to the assistance as “received information from a confidential source regarding the location of the suspect.” To date this has not been challenged, since it is not an integral part of the actual crime that occurred.

The email goes on to instruct that “it is unnecessary to provide investigative means to anyone outside of law enforcement.”

But i’m most interested in the subject line for this email: “Trap and Trace Confidentiality.”

That seems to confirm what ACLU and WSJ have reported earlier this month. Law enforcement are obtaining location data under Pen Register or Trap and Trace orders, meaning they’re claiming that location data are simply metadata.

That (and the arrogant parallel construction) is problematic for a lot of reasons, but given two developments on the national dragnet, I think we should be newly concerned there, too.

As I have noted, several months after NSA’s Pen Register/Trap and Trace authority was shut down, FBI still had an active PRTT program from which NSA was obtaining data.

PRTT2

 

And not only does it seem that the government plans to resume some kind of PRTT dragnet, but there’s reason to believe they’re still hiding one.

The thing is, I have perhaps mistakenly always assumed these PRTT programs involved the collection of Internet metadata off telecom backbones. While I’m sure they collect large amounts of Internet metadata somehow, I realize now that they might also be operating (or planning to operate) large scale PRTT location programs. Remember, too, that Ron Wyden was asking provocative questions about the intelligence community’s use of cell location data just days before this classification guide.

Mind you, the Quartavious decision might make that impossible now.

But given the USM apparently concerted effort to hide the fact that PRTT equates to cell location orders, we should at least consider whether the government operates more systematic location programs.

Richard Posner Prepares to Overrule the Intent of Congress, and Other FISA in Court Stories

/4 Comments/in /by

While the focus on NSA related issues will be on Washington DC today, with activist events, a debate at Brookings, and a Senate Intelligence Committee hearing, yesterday it was in several courtrooms.

In Chicago DC, Richard Posner reportedly seemed intent on finding a way to overturn Sharon Johnson Coleman’s order that Adel Daoud’s lawyers should be able to review the FISA materials leading to the investigation into him. It seems Posner is not all that interested in Congress’ intent that, in some cases, defendants would be able to review FISA warrants.

While she also reportedly seemed inclined to overturn Coleman’s decision, Ilana Diamond Rovner at least recognized the clear intend of Congress to permit reviews in some circumstances.

Another of the appeals court panelists, Judge Ilana Diamond Rovner, added that Coleman appeared to have “discarded” applicable FISA law and come up with her own justification for opening the records.

Rovner noted in a question for Ridgway that when Congress enacted the FISA law in the 1970s, it could have clearly indicated defense attorneys should never get access to the records. But it didn’t do that, she said.

“Can you give me any scenario where disclosure (to the defense) would be necessary?” Rovner asked.

“It would be a rare circumstance,” Ridgway, the assistant U.S. attorney, responded.

As I noted, the Defense made a very good argument that Congress intended review in such cases as this one.

Perhaps most stunning, however, is the way everyone but a big team of government prosecutors got booted from the court room.

As the arguments concluded, Judge Richard Posner announced the public portion of the proceedings had concluded and ordered the stately courtroom cleared so the three-judge panel could hold a “secret hearing.” Daoud’s attorney, Thomas Anthony Durkin, rose to object, but Posner did not acknowledge him. Deputy U.S. marshals then ordered everyone out – including Durkin, his co-counsel and reporters.

Only those with the proper security clearance — including U.S. Attorney Zachary Fardon, his first assistant, Gary Shapiro, and about a dozen FBI and U.S. Department of Justice officials – were allowed back in the courtroom before it was locked for the secret session.

Durkin, a veteran Chicago lawyer, said outside the courtroom he was not notified in advance that there would be a secret hearing and called the move unprecedented.

“Not only do I not get to be there, but I didn’t even get to object,” Durkin said. “I had to object over the fact that I couldn’t even make an objection.”

I suspect Posner used the period to conduct his own review of the FISA materials, substituting his judgment for Coleman’s, so as to uphold DOJ’s flawless record of never having their FISA worked checked.

But don’t worry: NSA  defenders will point to this and claim has been thoroughly vetted.

Meanwhile, in Oregon, where Mohamed Osman Mohamud is challenging what increasingly looks like his discovery off a back door search, the government appears to have argued that there is a foreign intelligence exception to the Fourth Amendment.

Assistant U.S. Attorney Ethan Knight countered that the government has court-approved procedures in place that were followed with respect to Mohamud’s case. Warrants are not required under an exception for foreign intelligence, he argued.

“The reality is when you peel back the layers of hyperbole, what would be unprecedented is if this court were to grant the defendant’s motion,” Knight said.

He also pushed back against a wider examination of the program, saying that it was “not the time or place or even arguably the branch of government” for the broader debate.

Granted, this is not much more extreme than the argument the government made in its filings (as summarized by ACLU’s Jameel Jaffer), that Americans may have no privacy interest in international communications.

In  support of the law, the government contends that Americans who make phone calls or sends emails to people abroad have a diminished expectation of privacy because the people with whom they are communicating – non-Americans abroad, that is – are not protected by the Constitution.

The government also argues that Americans’ privacy rights are further diminished in this context because the NSA has a “paramount” interest in examining information that crosses international borders.

And, apparently contemplating a kind of race to the bottom in global privacy rights, the government even argues that Americans can’t reasonably expect that their international communications will be private from the NSA when the intelligence services of so many other countries – the government doesn’t name them – might be monitoring those communications, too.

The government’s argument is not simply that the NSA has broad authority to monitor Americans’ international communications. The US government is arguing that the NSA’s authority is unlimited in this respect. If the government is right, nothing in the Constitution bars the NSA from monitoring a phone call between a journalist in New York City and his source in London. For that matter, nothing bars the NSA from monitoring every call and email between Americans in the United States and their non-American friends, relatives, and colleagues overseas.

The legal record on this is specific. While FISC found there was a warrant exception for “foreign” communications in Yahoo’s challenge of the Protect America Act, the FISA Court of Review’s decision was more narrow, finding only that there was a special need for the information before it, and also finding there were adequate protections for Americans (protections the government has been abrogating since the start of these warrantless programs). So while I will have to check the record, it appears that the line attorneys are going beyond what the appellate record (such as the FISCR decision can be called an appellate record) holds.