Posts

Leahy-Lee versus USA Lip Service: An Improvement, But Still a Domestic-as-Foreign Surveillance Bill

/2 Comments/in /by

Patrick Leahy and Mike Lee have introduced their version of Section 702 reauthorization, which like HJC they also call USA Liberty and like that bill doesn’t improve liberty. For convenience and because I refuse to use Orwellian terms to whitewash surveillance, I’ll refer to them going forward as Leahy-Lee and USA Lip Service, respectively.

Leahy-Lee is an improvement on USA Lip Service.

Leahy-Lee’s warrant requirement is real

That’s true, first of all, because the warrant requirement to access content via back door searches is real. The bill requires a probable cause warrant for both foreign intelligence and criminal purposes. And because it is a meaningful warrant requirement, the count of how many warrants are obtained will also be real.

The bill permits searches on (and with AG-plus-designates approval, access to) metadata-plus. Like USA Lip Service, the bill doesn’t define the expanded definition of metadata, though it appears to permit the same location-based access that USA Lip Service does.

The bill is silent on whether metadata from searches can be the sole evidence in the warrant application to FISC, which may water down the warrant requirement dramatically.

Leahy-Lee doesn’t sunset the prohibition on about collection

Also unlike USA Lip Service, Leahy-Lee does not sunset the prohibition on about collection.

There are two areas where USA Lip Service is different in ways that may make it better.

USA Lip Service may not track White House unmasking

First, in a report on the number of unmaskings, USA Lip Service requires reports on the number of unmaskings by any “element of the Federal Government.”

(3) The number of—

(A) United States persons whose information is unmasked pursuant to the procedures adopted under subsection (e)(4) of such section;

(B) requests made by an element of the Federal Government, listed by each such element, to unmask information pursuant to such subsection; and

(C) requests that resulted in the dissemination of names, titles, or other identifiers potentially associated with individuals pursuant to such subsection, including the element of the intelligence community and position of the individual making the request.

Leahy-Lee only requires reporting under clause B from the IC.

(B) requests made by an element of the intelligence community, listed by each such element, to unmask information pursuant to such subsection;

That may have the effect of missing any unmasking done at the White House. I don’t much care about this stuff, but for Republicans that do, it’s an interesting omission in the Senate bill.

Leahy-Lee doesn’t limit use of information to 702 certificates

Perhaps most interesting, Leahy-Lee doesn’t have language that was added in the manager’s amendment of USA Lip Service, which would restrict the use of information collected under Section 702 to topics generally covered by the known certificates for it: terrorists, spies, proliferation, nation-state hacking, and other critical infrastructure issues.

(2) LIMITATION ON USE OF CERTAIN EXCEPTED QUERIED INFORMATION.—No information accessed or disseminated pursuant to section 702(j)(2)(D)(iv), or evidence derived therefrom, may be received in evidence or otherwise used pursuant to paragraph (1), except—

(A) with the prior approval of the Attorney General; and

(B) in a proceeding or investigation in which the information or evidence is directly related to and necessary to address a specific threat of—

(i) an act of terrorism specified in clauses (i) through (iii) of section 2332b(g)(5)(B) of title 18, United States Code;

(ii) espionage (as used in chapter 37 of title 18, United States Code);

(iii) proliferation or use of a weapon of mass destruction (as defined in section 2332a(c) of title 18, United States Code);

(iv) a cybersecurity threat (as defined in section 101(5) of the Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 1501(5)) from a foreign country;

(v) incapacitation or destruction of critical infrastructure (as defined in section 1016(e) of the USA PATRIOT Act (42 16 U.S.C. 5195c(e))); or

(vi) a threat to the armed forces of the United States or an ally of the United States or to other personnel of the United States Government or a government of an ally of the United States.

Leahy-Lee still permits the collection of entirely domestic communications

The difference is important because Leahy-Lee does nothing to stop the known collection of entirely domestic communications, which I have reported involves the collection of Tor and (probably) VPN traffic. At least under HJC, that information can’t be used for many of the domestic crime purposes explicitly laid out in the SSCI bill, including murder, child porn, human trafficking (presumably including sex work), and narcotics trafficking. But Leahy-Lee would permit those uses.

Leahy rolled out his bill with this erroneous statement from Liza Goitein.

Elizabeth Goitein, co-director of the Brennan Center’s Liberty and National Security Program, said:  “This bill fixes the most serious problem with Section 702 surveillance today: the government’s ability to read Americans’ e-mails and listen to their telephone calls without a warrant,” and called the legislation “a very promising development in the reform debate.”

This is false. Leahy-Lee still permits the government to access (and with DIRNSA approval, retain) the entirely domestic communications of the 430,000 Americans that use Tor each day. Perhaps that’s why Leahy had Goitein make the comment, because he surely knows this is false.

ACLU comes out in support of a bill they admit is constitutionally deficient

And Goitein’s Brennan Center is not the only NGO supporting this bill. ACLU released a statement that can only be described as schizophrenic in support of the bill. While ACLU’s legislative counsel, Neema Singh Guliani, thankfully makes none of the errors that Goitein makes, she nevertheless admits that 702 remains constitutionally problematic.

“While this bill does not address all the constitutional concerns with Section 702, it represents an important step forward from the dismal status quo. The ACLU supports this bill, and urges Congress to ensure its reforms become law.”

And the statement goes on to lay out, correctly, several advantages of the Wyden-Paul bill, including ensuring that defendants (and affected people, like lawyers from ACLU working with targeted clients internationally) get notice and can challenge collection.

The ACLU urges improvements to the bill that would require a court order to access metadata collected under Section 702, narrow collection, and ensure the government provides appropriate notice.

Congress is currently considering several bills in advance of the Section 702 reauthorization deadline. Sens. Ron Wyden (D-Ore.) and Rand Paul (R-Ky.) have introduced S.1997, the USA Rights Act, which completely closes the backdoor search loophole, ends the collection of known domestic communications, and takes steps to ensure that the government provides notice to individuals who have Section 702 information used against them. The ACLU supports this bill.

I’m very confused — and, as a member, gravely concerned — about why the ACLU would adopt such a schizophrenic strategy, and why it would lobby in favor of things that its other lawyers are litigating against.

ACLU risks losing the ability to sue on these issues in the future if it remains on this bill (which is one reason I was so glad they didn’t back USA Freedom in 2015). And if they can’t sue, than we can’t fix the issues that ACLU, in its statement, lays out as problems in Leahy-Lee.

The Intelligence Community Continues to Pretend Ignorance of Its Deliberate 702 Spying

/2 Comments/in /by

As I noted in an update to this post, over the last several months, the Brennan Center has led an effort among privacy organizations to get the Intelligence Community to provide the transparency over its Section 702 surveillance that it dodged under the USA Freedom Act. On October 29, 2015, it send James Clapper a letter asking for:

  • A public estimate of the number of communications or transactions involving American citizens and residents subject to Section 702 surveillance on a yearly basis.
  • The number of times each year that the FBI uses a U.S. person identifier to query databases that include Section 702 data, and the number of times the queries return such data.
  • Policies governing agencies’ notification of individuals that they intend to use information “derived from” Section 702 surveillance in judicial or administrative proceedings.

On December 23, Privacy Officer Alex Joel responded on behalf of Clapper, largely dodging the requests but offering to have a meeting at which he could further dodge the request. Then yesterday, Brennan replied, calling out some of those dodges and posing new questions in advance of any meeting.

While the reply asks some worthwhile new questions, I wanted to look at some underlying background to the response Joel and ODNI gave.

The number of communications or transactions involving American citizens and residents subject to Section 702 surveillance on a yearly basis

In response to Brennan’s request for the number of US persons sucked up in 702, Joel points back to the PCLOB 702 report (which was far more cautious than the earlier 215 report) and its report on the status of recommendations from January 2015 and basically says, “we’re still working on that.” Brennan deemed the response non-responsive and noted that the IC is still working on 4 of PCLOB’s 5 recommendations 18 months after they issued it.

I would add one important caveat to that: PCLOB’s fifth recommendation was that the government provide,

the number of instances in which the NSA disseminates non-public information about U.S. persons, specifically distinguishing disseminations that includes names, titles, or other identifiers potentially associated with individuals.

We’ve just learned — through curiously timed ODNI declassification — that the numbers FBI gives to Congress on 702 dissemination are dodgy, or at least were dodgy in 2012, in part because they had been interpreting what constituted US person information very narrowly. For whatever reason, PCLOB didn’t include FBI in this recommendation, but they should be included, especially given the issues of notice to defendants dealt with below.

More importantly, there’s something to remember, as the IC dawdles in its response to this recommendation. In 2010, John Bates issued a ruling stating that knowingly collecting US person content constituted an illegal wiretap under 50 USC 1809(a). Importantly, he said that if the government didn’t know it was conducting electronic surveillance, that was okay, but it shouldn’t go out of its way to remain ignorant that it was doing so.

When it is not known, and there is no reason to know, that a piece of information was acquired through electronic surveillance that was not authorized by the Court’s prior orders, the information is not subject to the criminal prohibition in Section 1809(a)(2). Of course, government officials may not avoid the strictures of Section 1809(a)(2) by cultivating a state of deliberate ignorance when reasonable inquiry would likely establish that information was indeed obtained through unauthorized electronic surveillance.

The following year, Bates held that when it collected entirely domestic communications via upstream Section 702 collection, that collection was intentional (and therefore electronic surveillance), not incidental, though Clapper’s lawyer Bob Litt likes to obfuscate on this point. The important takeaway, though, is that the IC can illegally collect US person data so long as it avoids getting affirmative knowledge it is doing so, but it can’t be too obvious in its efforts to remain deliberately ignorant.

I’d say 18 months begins to look like willful ignorance.

The number of times each year that the FBI uses a U.S. person identifier to query databases that include Section 702 data, and the number of times the queries return such data

Brennan asked for solid numbers on back door searches, and Joel pointed to PCLOB’s recommendations that pertain to updated minimization procedures, a totally different topic.

And even there Joel was disingenuous in a way that the Brennan letter did not note.

Joel asserts that “with the recent reauthorization of the 702 Certification … this recommendation 2 [has] been implemented.” The recommendation included both additional clarity in FBI’s minimization procedures as well as further limits on what non-national security crimes FBI can use 702 data for.

Back in February 2015, Bob Litt revealed the latter information, what FBI could use 702 data for:

crimes involving death, kidnapping, substantial bodily harm, conduct that is a specified offense against a minor as defined in a particular statute, incapacitation or destruction of critical infrastructure, cyber security, transnational crimes, or human trafficking.

But after Litt made that disclosure, and either after or during the process of negotiating new 702 certificates, the ODNI released updated minimization procedures. But they where the MPs for 2014, not 2015! (See this post for a discussion of new disclosures in those documents.) Joel’s answer makes clear that FBI’s minimization procedures were updated significantly in the 2015 application beyond what they had been in 2014 (because that’s the only way they could have not fulfilled that recommendation last January but have since done so).

In other words, Joel answers Brennan’s question by boasting about fulfilling PCLOB’s recommendations, but not Brennan’s answer. But even there, if ODNI had just released the current FBI MPs, rather than year-old ones, part of Brennan’s questions would be answered — that is, what the current practice is.

I think the recent new disclosures about the limits on FBI’s very limited disclosure reporting (at least until 2012) provide some additional explanation for why FBI doesn’t count its back door searches. We know:

  • At least until 2012, it appears FBI did not consider reports based off the content of a message (“about”) not including the US person mentioned, certain kinds of identifiers (probably including phone numbers and Internet identifiers), or metadata to be sharing non-public US person information.
  • At least until the most recent certification, FBI was permitted to use metadata to analyze communications and transfer “all such metadata to other FBI electronic and data storage systems for authorized and foreign intelligence purposes” (page 11) without marking it as disseminated Section 702 data (footnote 2). This likely increases the chance that FBI does not treat metadata derived from Section 702 — and analysis integrating it and other data — to be 702 derived (especially given its apparent belief that such metadata does not equate to person identifying information).
  • FBI’s databases surely include redundant information for people whose communications are collected — either as target or incidentally — under both Section 702 and traditional FISA (and possibly even under Title III warrants). If, as Charlie Savage reported last year, FBI is now acquiring raw EO 12333 data, it may be in the same databases as well. This is undoubtedly even more true with respect to metadata. Given known practice on the NSA side, FBI likely uses the multiple designations to avoid disclosure rules.

In other words, there is a great deal of room to launder where data comes from, particularly if it has been used for metadata link analysis as an interim step. To try to count the specifically Section 702 queries, even just of content, though all the more so of metadata, would require revealing these overlaps, which FBI surely doesn’t want to do.

Policies governing agencies’ notification of individuals that they intend to use information “derived from” Section 702 surveillance in judicial or administrative proceedings

All that’s also background to Brennan’s request for information about notice to defendants. Joel pretty much repeated DOJ’s unhelpful line, though he did direct Brennan to this OLC memo on notice to those who lose clearance. Not only does that memo reserve the right to deem something otherwise subject to FISA’s notice requirements privileged, it also cites from a 1978 House report excluding those mentioned in, but not a party to, electronic surveillance from notice.

[A]s explained in a FISA House Report, “[t]he term specifically does not include persons, not parties to a communication, who may be mentioned or talked about by others.”

That, of course, coincides with one of the categories of people that it appears FBI was not counting in FISA dissemination reports until at least 2012 (and, of course, metadata does not count as electronic surveillance).

All of which is to say this appears to hint at the scope of how FBI has collected and identified people using 702 derived data that nevertheless don’t get 702 notice.

None of that excuses ODNI for refusing to respond to these obvious questions. But it does seem to indicate that the heart of FBI’s silence about its own 702 practices has a lot to do with its ability to arbitrage the multiple authorities it uses to spy.

The Continuing Myth about USA Freedom Transparency

/3 Comments/in /by

Summary: This is a response to an Elizabeth Goitein claim that USA Freedom would provide detailed reporting on FISA programs. That’s false. As I show below, the only three kinds of collection for which reasonably real numbers will be reported are Individual FISA orders, NSLs (though FBI refuses to count those accurately), and the new CDR provision (though it will be presented as foreign collection even though it will be domestic). On everything else, the reporting will be excepted away beyond usefulness. Further, both PRTT and traditional 215 will likely get reported only as “fewer than 500,” a significant regression from current reporting.

In a piece at Just Security, Brennan Center’s Elizabeth Goitein bemoans what she claims as a distraction from passing the USA Freedom Act in the form of ISIS.

Then came ISIS. Following the group’s capture of territory in Iraq, its beheading of two American journalists, and its calls for followers to launch attacks in the US, some American lawmakers claimed it would be irresponsible to ratchet back surveillance authorities in the face of a new terrorist threat. 

I’m skeptical that USAF was going to pass anyway, and equally skeptical the Republicans are really responding to ISIS and not improving GOP Senate chances.

But I’m more interested in Goitein’s portrayal of the bill.

To her credit, she limits her most aggressive claims that the bill would end bulk collection to the phone dragnet. Though she claims continuation of the financial dragnets would be a misreading of the bill.

The bill also would prohibit bulk collection of other types of transactional data, although the wording of these bans is susceptible to distorted readings, as some have observed.

That’s something on which we can fairly disagree. In my opinion, this language does nothing to limit the financial dragnet.

(i) means a term that specifically identifies a person, account, address, or personal device, or another specific identifier, that is used by the Government to narrowly limit the scope of tangible things sought to the greatest extent reasonably practicable, consistent with the purpose for seeking the tangible things; 

As I’ve noted, permitting “person” as a selector permits the use of “Western Union.” And the language “to the greatest extent reasonably practicable, consistent with the purpose for seeking the tangible things” closely resembles claims we’ve seen in released applications and orders. I would be fairly shocked if the applications for the Western Union dragnet didn’t say — as NSA said of the phone dragnet — that FBI required all foreign money transfers to be able to track such transfers. If so, then FISC has already bought off on the government’s claim that the existing financial dragnets are as narrowly limited as “reasonably practicable, consistent with the purpose for seeking the tangible things.” If so — and given public FISC releases, this is actually not a distorted reading in the least — then this bill will not affect the existing dragnets in the least. 

Still, I commend Goitein for exercising far more caution than other USAF supporters have in the past about the extent of the bill.

But Goitein’s claims about the transparency required under the bill are simply wrong.

The USA Freedom Act also would require more detailed statistical reporting by the government on the number of people affected by specific surveillance authorities –including, for most FISA programs, a separate tally of U.S. persons affected. These numbers give meaning to abstract legal interpretations. It’s clear that the FISC endorsed a broad interpretation of the term “relevance,” but only the numbers can tell us exactly how broad.

This bill will be less than useless in helping us understand how broadly the government is collecting; it will be counter-productive.

Here’s what, to the best of my understanding, we’ll actually get:

Individual orders (Titles I, III, 703, 704): We’ll get a “good faith” estimate of how many individuals are targeted. The government won’t reveal the split of this targeting. That will likely hide that much of its “targeting” consists of obtaining already collected data. The government won’t reveal that it does not use 703. At all.

702: We’ll get the number “1” for total orders, and something like 90,000 for targets. We’ll get a grossly misrepresentative number for number of people located in the US collected under PRISM, because the government will not be required to count IPs in the US as someone in the US. We’ll also get a certificate saying it cannot estimate whether more than 56,000 US persons are collected in upstream every year (because if the government did so it would then be illegal). We’ll get numbers like NSA 100 and CIA 1000 for back door searches, but we will get nothing on FBI back door searches, which can be done with no suspicion of wrong-doing. This leaves out 56,000 or more Americans affected via upstream, probably 100s of 1000s under an IP dodge, and probably 10s of 1000s affected in back door searches, and that’s assuming the DNI doesn’t use a Certificate to refuse to report all people affected by PRISM. Update: See this post for something else that may be hidden — non-communication cloud data.

Title IV (PRTT): We’ll start with a number like 140, as currently counted this would show as something like 300 targets, 70 of whom are named US persons who got their phone or email records collected. But this may not count US persons who have their email records collected, because the government won’t have to treat a US IP as a US person. It also won’t count the people sucked up in Stingray use, as that is not counted as a communication collected. That’ll ensure the number is fewer than 500, meaning that’s the only number we’ll get, which is far worse then reporting we currently get. Moreover, if as I suspect any bulkier PRTT program collects location, it will show only something like 4 al Qaeda related targets (because location data is not a communication). And the government can issue a claim that it can’t count those in the US (because if it did so it’d be illegal). One way or another, this will leave out hundreds of thousands, and perhaps millions, of affected Americans. 

Traditional 215: Under current counting we’d get a number like 210 orders, targeting 800 targets. Here’s how it’ll break out in this reporting:

Exotic Internet requests (currently the majority of 215 orders): These are in the US, but they won’t be counted as such because they’re FBI orders and FBI is exempted from counting that. I suspect they’re also exempted even more generally from total persons affected counts as subscriber session time (see below regarding the definition of communications collected), though that’s a guess. Update: see this post for more on this language.

Less exotic Internet orders: These won’t have to be reported as US persons either, because the government doesn’t have to treat US IPs as US location.

Known non-financial dragnets: Under current counting this would probably count as roughly 24 orders (assuming 6 programs with 90 day renewals), with 4 targets — the al Qaeda groups included — each. Under USAF reporting, none of the individuals affected by the known bulk non-communications dragnets — which we know to include financial records and purchase records and which may include travel records — will get reported because the bill doesn’t require non-communications 215 orders to be individualized.

Having exempted almost every known kind of 215 order from individualized reporting, it’ll bring the total number affected well under 500, meaning that’s all we’ll get for persons affected, a far worse report than we currently get. This will definitely leave out millions of affected Americans, and will present the false impression that most 215 orders affect foreigners. 

New-Fangled 215: For CIA and NSA — which are unlikely to use this provision — the government will have to report the targets, plus the people within 2 degrees sucked in with those targets. For FBI, which is likely to collect this data now that it doesn’t require ingesting all the phone records in the US and because FBI has far more liberal sharing rules, it’ll probably report 300 targets, and a total of 3 million people affected. But those won’t be identified as Americans because the FBI is exempted from that. Moreover, since this will bring the number under 500, that’s all we’ll get for targets (though not persons affected). This will probably hide hundreds of thousands of Americans affected.

Update, 10/5: See this post for one other thing USAF may hide: cloud-related metadata that might be used for connection chaining.

NSLs: This bill provides slightly more breakout on US/non-US NSL reporting, though that has largely been available via IG report (plus, FBI refuses to count it accurately), except for subscriber data.

To sum up, what USAF effectively does is require reporting on the number of people affected by surveillance programs, and for most requires a break-out of the number of US persons affected. But then it uses the following exemptions to hide by far the bulk of the US persons affected — and in most cases, the number of persons affected — by surveillance:

  • 603(b)(2): Only a phone number registered in the US provides a reasonable basis that a person is located in the US. Thus all bulky Internet collection in the US can and will be hidden as foreign collection.
  • 603(e)(2): For several target and affected numbers, DNI will report numbers under 500 as fewer than 500. This will result in significantly less granular reporting than we currently have for some authorities, especially PRTT and 215.
  • 603(e)(3): If records are held by FBI or queries are conducted for them, 702 back door searches, communications-related traditional 215 orders, and newfangled 215 results don’t have to report on US persons affected. FBI will effectively be even more of a black hole where reporting goes to die than it already is.
  • 603(e)(4): DNI can certify that it can’t report on the 702 and PRTT Americans caught in the dragnet. Unless they use the IP dodge, they’ll almost certainly do this because if they admit this is US person collection, it’ll become illegal.
  • 603(g)(3): The definition of “individual whose communications were collected,” on which non back door 702, PRTT, and both traditional and newfangled 215 individualized reporting is based, would (according to my reading–lawyers should definitely check this) exclude:
    • Any location data (tracking devices are excluded)
    • Any financial, purchase, or other non-communication record (they are non-communication)
    • Any subscriber to an electronic computer service who is not a party to a communication who has had only her call records or session times collected [(B)(ii) excludes subparagraph (C) of 2703(c)(2)]

That is, after requiring reporting for most FISA reports, it then exempts virtually all of it from reporting.

Psyche!

This is not serious transparency reporting. Rather, it’s a hoax, at best reporting knowingly false information, but usually creating nothing but propaganda creating a grossly misleading description of what collection occurs.

Updated 10/4 with summary and some clarifications.