Posts

“Only Facts Matter:” Jim Comey Is Not the Master Bureaucrat of Integrity His PR Sells Him As

/12 Comments/in , , /by

Since Jim Comey’s showy press conference yesterday, the press has rehashed Jim Comey’s carefully cultivated image as a Boy Scout, with outlet after outlet replaying the story of how he ran up some hospital steps once.

Sadly, even DOJ beat journalists seem unable to point out that that image has been carefully cultivated over years. Comey is a PR master.

But as I have written on several occasions, the story is more complicated. That’s true, first of all, because the 2004 hospital confrontation, in which Comey and a bunch of other DOJ officials threatened to quit and therefore allegedly shut down some illegal wiretap programs, did not end in March 2004. On the contrary, for the main unlawful program we know about — the Internet dragnet — that confrontation ended in July 2004 when, after some serious arm-twisting, DOJ got FISC presiding judge Colleen Kollar-Kotelly to authorize substantially the same Internet dragnet they refused to authorize themselves.  The arguments they used to pull that off are fairly breath-taking.

The hospital confrontation only served to hide illegal surveillance under a new rock

First, they told Kollar-Kotelly she had to reauthorize the dragnet because terrorists wanted to plan an election year plot; as I note below, that claim was largely based on a fabrication.

Then, they argued that the standard for approval of a bulk Pen Register/Trap and Trace order was the same (arguably lower) as any other PRTT order focused on an individual. Kollar-Kotelly, DOJ argued, had no discretion over whether or how to approve this.

DOJ told Kollar-Kotelly she had no authority to do anything but approve their expansive plan to collect Internet data from telecom switches. “[T]he Court ‘shall’ authorize a pen register … if an application brought before it complies with the requirements of the statute.” Even though, by collecting Internet metadata in bulk, the government would take away FISC’s authority to review whether the targets were agents of a foreign power, DOJ argued she had no authority to determine whether this bulk data — which she deemed an “enormous” amount — was “relevant” to the FBI’s investigations into terrorism.

And that meaning — which the government expanded even further in 2006 to claim the phone records of every single American were “relevant” to the FBI’s standing terrorism investigations — “requires no stretching of the ordinary meaning of the terms of the statute at all,” they claimed, in apparent seriousness.

DOJ further argued that’s the way the FISA court — which Congress created in 1978 to provide real judicial review while permitting the executive to keep its foreign spying secret — is supposed to work. Having FISC rubber-stamp the program they themselves had refused to authorize “promotes both of the twin goals of FISA,” DOJ argued, “facilitating the foreign-intelligence collection needed to protect American lives while at the same time providing judicial oversight to safeguard American freedoms.”

Their claim this involved oversight is especially rich given that DOJ and FISC argued then — and continued to argue at least through 2010 when John Bates would reauthorize and expand this dragnet — that the FISC had no authority to impose minimization procedures for bulk collected data, which has historically been the sole way FISC exercises any oversight. Then, during the period of the very first dragnet order, NSA “discovered” it was violating standards Kollar-Kotelly imposed on the collection (effectively, violating the minimization procedures). But in spite of the fact that she then imposed more requirements, including twice quarterly spot checks on the collection, those violations continued unabated until NSA’s Inspector General finally started, on Reggie Walton’s order, an (aborted) real review of the collection in 2009. At that point, OGC all of a sudden “discovered” that their twice-quarterly spot checks had failed to notice that every single record NSA had collected during that 5 year period had violated FISC standards.

In short, the program was never, ever, in legal compliance. That was the solution Comey achieved to the unlawful program he got shut down.

DOJ’s — Jim Comey’s — efforts to undercut FISC not only led to other really problematic FISC decisions based on this precedent (including, but not limited to, the phone dragnet in 2006 and upstream collection in 2007), but also gave illegal collection the patina of legality solely by making someone else authorize a program she couldn’t oversee.

DOJ deliberately bypassed Congress because they knew it wouldn’t approve the surveillance

Along with radically changing the nature of FISC in the wake of the hospital confrontation, DOJ — Jim Comey — affirmatively bypassed Congress because they didn’t want to tell America it was spying on them in bulk.

DOJ pointed to language showing Congress intended pen registers to apply to the Internet; they pointed to the absence of language prohibiting a pen register from being used to collect data from more than a single user, as if that’s the same as collecting from masses of people and as if that proved congressional intent to wiretap everyone.

And then they dismissed any potential constitutional conflict involved in such broad rereadings of statutes passed by Congress. “In almost all cases of potential constitutional conflict, if a statute is construed to restrict the executive, the executive has the option of seeking additional clarifying legislation from Congress,” the heroes of the hospital confrontation admitted. The White House had, in fact, consulted Majority Leader Tom DeLay about doing just that, but he warned it would be too difficult to get new legislation. So two months later, DOJ argued Congress’ prerogative as an independent branch of government would just have to give way to secrecy. “In this case, by contrast, the Government cannot pursue that route because seeking legislation would inevitably compromise the secrecy of the collection program the Government wishes to undertake.”

This was a pretty big assault on separation of powers, and not one justified by the efficacy of the program or the needs of the collection.

While I won’t go into it here, this is all about the best known part of the Stellar Wind program that was not so much “shut down” as “dumped into someone else’s legal lap.” There’s another aspect of Stellar Wind — one I don’t yet fully understand — that Comey reauthorized on his own, one that has gotten no reporting. I hope to return to this.

Comey’s DOJ lets itself be manhandled into reauthorizing torture and surveillance

There’s an intimately related effort Comey gets some credit for which in fact led to fairly horrible conclusions: torture. Jack Goldsmith, with Comey’s backing, also withdrew the shoddy John Yoo memo authorizing waterboarding and other torture (Goldsmith also prevented Yoo from retroactively authorizing more techniques).

But on July 2, 2004 — two weeks before Goldsmith left — the intelligence community found another detainee it just had to torture, Janat Gul, based on already questioned claims he wanted to plan an election year attack. They had a Principal’s Committee meeting to discuss what to do. After Jim Comey and John Bellinger left the meeting, the PC agreed to engage in torture again (though not waterboarding). Five days later Goldsmith wrote to ensure the IC knew this meant they had to follow the guidelines laid out under the original Yoo memo. By September, after Gul and some associates had been tortured extensively — each time with Dan Levin writing what I’m sure he imagined to be a soundly reviewed approval for the torture — Levin had approved waterboarding again, along with the techniques Goldsmith had prevented Yoo from retroactively and unilaterally authorizing. OLC repeatedly promised a more fulsome memo laying out the approval offered, ostensibly in reaction to an immediate need, in 2004. Jim Comey initiated that process in fall and December 2004. But in the end, the technique memos completed by Steven Bradbury in May 2005 authorized both waterboarding, as well as all the other conditions (primarily techniques use in combination) Comey seems to have tried to have set to make them impossible to use again. Comey resigned right before these memos were finalized, so it’s possible he made another — failed — attempt to prevent the illegal program by threatening to quit; he did, however, stick around for another three months before he moved onto his sinecures at Lockheed and Bridgewater.

Here’s the tragic thing about this unsuccessful effort to impose order on the torture program: it, like the Iraq War itself, was based on a fabricator.

CIA came to Comey and others, said, “this guy wants to attack the presidential elections so we need a dragnet and torture,” to which DOJ said okay.

The CIA in March 2004 received reporting from a source the torture report calls “Asset Y,” who said a known Al-Qaeda associate in Pakistan, Janat Gul — whom CIA at the time believed was a key facilitator — had set up a meeting between Asset Y and Al-Qaeda’s finance chief, and was helping plan attacks inside the United States timed to coincide with the November 2004 elections. According to the report, CIA officers immediately expressed doubts about the veracity of the information they’d been given by Asset Y. A senior CIA officer called the report “vague” and “worthless in terms of actionable intelligence.” He noted that Al Qaeda had already issued a statement “emphasizing a lack of desire to strike before the U.S. election” and suggested that since Al-Qaeda was aware that “threat reporting causes panic in Washington” and inevitably results in leaks, planting a false claim of an election season attack would be a good way for the network to test whether Asset Y was working for its enemies. Another officer, assigned to the group hunting Osama bin Laden, also expressed doubts.

[snip]

Nevertheless, the CIA took seriously Asset Y’s claim that Gul was involved in an election plot and moved quickly to gain custody of him after his arrest by Pakistan in June 2004. Even before CIA rendered Gul to its custody, Tenet started lobbying to get torture techniques reapproved for his interrogation.

On June 29, Tenet wrote National Security Adviser Condoleezza Rice seeking approval to once again use some of the techniques whose use he suspended less than four weeks earlier, in the hope of gathering information on the election season plot. “Given the magnitude of the danger posed by the pre-election plot and Gul’s almost certain knowledge of any intelligence about that plot” Tenet wrote, relying on Asset Y’s claims, “I request the fastest possible resolution of the above issues.”

[snip]

Soon after the reauthorization of the torture and the Internet dragnet, the CIA realized ASSET Y’s story wasn’t true. By September, an officer involved in Janat Gul’s interrogation observed, “we lack credible information that ties him to pre-election threat information or direct operational planning against the United States, at home or abroad.” In October, CIA reassessed ASSET Y, and found him to be deceptive. When pressured, ASSET Y admitted had had made up the story of a meeting set up by Gul. ASSET Y blamed his CIA handler for pressuring him for intelligence, leading him to lie about the meeting.

By 2005, CIA had concluded that ASSET Y was a fabricator, and Janat Gul was a “rather poorly educated village man [who is] quite lazy [who] was looking to make some easy money for little work and he was easily persuaded to move people and run errands for folks on our target list” (though the Agency wasn’t always forthright about the judgment to DOJ).

During Comey’s entire effort — to put order to the dragnet, to put order to the torture — he was in fact being led by the nose by the CIA, once again using the report of a fabricator to authorize actions the US had no business engaging in.

If that were all, I’d consider this a tragic story: poor Jim Comey trying to ensure the US does good, only to be undermined by the dishonest folks at the CIA, using asymmetric information again to ensure their ass gets covered legally.

Jim Comey refuses to review what he did in 2004 and 2005

But here’s the part that, in my opinion, makes being snookered by the CIA unforgivable. Thus far, Comey has refused to read the full Torture Report to learn how badly he got snookered, even though he promised Dianne Feinstein to do so in his confirmation process.

I am specifically intrigued by Comey’s apparent lack of curiosity about the full report because of his actions in 2005.

As these posts lay out (one, two), Comey was involved in the drafting of 2 new OLC memos in May 2005 (though he may have been ignorant about the third). The lies CIA told OLC in 2004 and then told OLC again in 2005 covering the same torture were among the worst, according to Mark Udall. Comey even tried to hold up the memo long enough to do fact gathering that would allow them to tie the Combined memo more closely to the detainee whose treatment the memo was apparently supposed to retroactively reauthorize. But Alberto Gonzales’ Chief of Staff Ted Ullyot told him that would not be possible.

Pat [Philbin] explained to me (as he had to [Steven Bradbury and Ted Ullyot]) that we couldn’t make the change I thought necessary by Friday [April 29]. I told him to go back to them and reiterate that fact and the fact that I would oppose any opinion that was not significantly reshaped (which would involve fact gathering that we could not complete by Friday).

[snip]

[Ullyot] mentioned at one point that OLC didn’t feel like it would accede to my request to make the opinion focused on one person because they don’t give retrospective advice. I said I understood that, but that the treatment of that person had been the subject of oral advice, which OLC would simply be confirming in writing, something they do quite often.

At the end, he said that he just wanted me to know that it appeared the second opinion would go [Friday] and that he wanted to make sure I knew that and wanted to confirm that I felt I had been heard.

Presuming that memo really was meant to codify the oral authorization DOJ had given CIA (which might pertain to Hassan Ghul or another detainee tortured in 2004), then further details of the detainee’s torture would be available in the full report. Wouldn’t Comey be interested in those details now?

But then, so would details of Janat Gul’s torture, whose torture was retroactively authorized in an OLC memo Comey himself bought off on. Maybe Comey has good reason not to want to know what else is in the report.

Sure, he may be doing so to prevent Jason Leopold from liberating the report via FOIA. But in doing so, he is also refusing to examine his own actions, his own willingness to reauthorize the dragnet and torture he had just shut down in the service of a lie. He is refusing to consider whether the deals he made with the devil in 2004 were unsound.

Even here, I might just consider this a tragic story, of a morally just man bested by bureaucratic forces both more sinister and dishonest than Comey.

Except for Comey’s Manichean view of the world.

His world is separated into the Good Guys who should have access to encryption and the Bad Guys who should not, the loyal people like Hillary who can be “extremely careless in their handling of very sensitive, highly classified information” with no legal consequences and the disloyal people like Thomas Drake who get prosecuted for doing the very same things.

That’s not the world where self-proclaimed Boy Scout Jim Comey assents to the reauthorization of torture and dragnets based on a fabrication with no repercussions or even soul-searching.

I mean, I get it. There is no place for Boy Scouts in the top ranks of our national security state. I get that you’re going to lose bureaucratic fights to really immoral causes and manipulative spooks. I get you’re sometimes going to get the so-called trade-off between liberty and security wrong, especially when you get lied to.

But given that reality, there is no place for pretend Boy Scouts. There is no place to pretend your world is as easy as running up some hospital steps, victory!, we’ve vanquished presidential abuses so let’s go dismantle separation of powers! That’s just naive, but in the service of the FBI Director, it legitimizes a really unjust — morally-rather-than-legally-based — method of policing.

Comey seems to believe his self-created myth at this point, and that’s a very dangerous spot for a guy deigning to be the investigator and prosecutor of who is loyal and who disloyal.

Update: Matthew Miller wrote up his criticism of Comey’s abuse of power here.

Update: Here’s an interview I did for Pacifica on the email question generally.

Domestic Collection and Stellar Wind

/2 Comments/in /by

I’m in the middle of comparing John Yoo’s May 17, 2002 letter to Colleen Kollar-Kotelly (which is largely the November 2, 2001 justification he wrote for Stellar Wind) with Jack Goldsmith’s May 6, 2004 memo on Stellar Wind, which reined in some aspects of Stellar Wind. And I realized something about the authorization process.

On page 17 of his memo, Goldsmith describes the previous opinions issued by OLC. The discussion is largely redacted, but it does describe say the October 4, 2001 memo “evaluated the legality of a hypothetical electronic surveillance program,” whereas the November 2, 2001 memo “examined the authorities granted by the President in the November 2, 2001 Authorization of STELLAR WIND and concluded that they were lawful.”

Already, that’s an interesting assertion given that the Yoo letter doesn’t do that entirely. First, at least in the letter to Kollar-Kotelly, Yoo also treated the program as hypothetical.

Electronic surveillance techniques would be part of this effort. The President would order warrantless surveillance in order to gather intelligence that would be used to prevent and deter future attacks on the United States. Given that the September 11 attacks were launched and carried out from within the United States itself, an effective surveillance program might include individuals and communications within the continental United States. This would be novel in two respects. Without access to any non-public sources, it is our understanding that generally the National Security Agency (NSA) only conducts electronic surveillance outside the United States that do not involve United States persons. Usually, surveillance of communications by United States persons within the unites states is conducted by the FBI pursuant to a warrant obtained under the Foreign Intelligence Surveillance Act (“FISA”). Second, interception could include electronic messages carried through the internet, which again could include communications within the United States involving United States persons. Currently, it is our understanding that neither the NSA nor law enforcement conducts broad monitoring of electronic communications in this matter within the United States, without specific authorization under FISA.

[snip]

Thus, for example, all communications between United States persons, whether in the United States or not, and individuals in [redacted–likely Afghanistan] might be intercepted. The President might direct the NSA to intercept communications between suspected terrorists, even if one of the parties is a United States person and the communication takes place between the United States and abroad. The non-content portion of electronic mail communications also might be intercepted, even if one of parties is within the United States, or one or both of the parties are non-citizen U.S. persons (i.e., a permanent resident alien). Such operations would expand the NSA’s functions beyond the monitoring only of international communications of non-U.S. persons. [my emphasis]

Importantly, these hypothetical descriptions come from the section of Yoo’s letter before it appears to begin tracking his earlier memo closely. So it’s unclear whether this description of Stellar Wind matches the one in the November 2 memo. It’s certainly possible that Yoo gave an incomplete version of what he had in the earlier memo or even pulled in (hypothetical) language from the October 4 memo. It’s possible, too, that language on domestic content collection reflected a retroactive review Yoo did of the first authorization. (An extended discussion of how Yoo’s early memos track the Authorizations — including discussion of another hypothetical memo Yoo wrote on September 17 — starts at PDF 361.)

Of particular interest, this hypothetical description includes the possibility of intercepting entirely domestic Internet communications (see emphasized language). We know — from the unredacted NSA Stellar Wind IG Report and even from the redacted Joint IG Report — that was something included in the first presidential Authorization, but not the subsequent ones.

The wording of the first authorization could have been interpreted to allow domestic content collection where both communicants were located in the U.S. or were U.S. persons. General Hayden recalled that when the Counsel to the Vice President pointed this out, General Hayden told him that NSA would not collect domestic communications because 1) NSA was a foreign intelligence agency, 2) NSA infrastructure did not support domestic collection, and 3) his personal standard was so high that there would be no problem getting a FISC order for domestic collection.

We also know NSA did collect some domestic collection — on about 3,000 selectors, possibly triggered to non-US persons within the US — at least until Stellar Wind got transitioned to FISA in 2009.

This is a minor, but potentially important one. Yoo was writing hypothetical authorizations for stuff the NSA later pretended not to be authorized to do, but was doing. Those earlier hypothetical authorizations didn’t go away. And therefore, no matter what the authorizations said, there’d still be that authorization sitting there.

The New Stellar Wind Language

/in /by

Charlie Savage got another drip drip drip of language declassified from the Joint IG Stellar Wind reports (his story, annotated document).

The new language reveals a bit more about what Alberto Gonzales included in his March 11, 2004 authorization that led Jim Comey to renew his resignation threat on March 16, 2004. And it reiterates a detail about the March 19, 2004 modification I’ve covered repeatedly (though leaves the other at least two March 19, 2004 modifications, as well as the April 2 one(s), entirely redacted).

One thing that did get changed on March 19 — the exclusion of the Iraq targeting John Yoo had authorized in 2003 — is now unredacted. That language only permits the use of Stellar Wind with al Qaeda, groups affiliated with al Qaeda, or “another group that [the President determines] for the purposes of this Presidential Authorization is in armed conflict with the United States and poses a threat of hostile action within the United States.” This language is precisely consistent with language in the May 6, 2004 Jack Goldsmith opinion I’ve noted before — indeed, the newly unredacted language appears unredacted in that memo (see page 16). Goldsmith situates the broader-than-al Qaeda authorization, in part, in this language in the 2001 AUMF.

The Congressional Authorization contains another provision that is particularly significant in this context. Congress expressly recognized that “the President has authority under the Constitution to take action to deter and prevent acts of international terrorism against the United Stales.” Congressional Authorization, pmbl. That provision gives express congressional recognition to the President’s inherent constitutional authority to take action to defend the United States even without congressional support.

Note, Savage misstates that the change only permits targeting “Al Qaeda, rather than allowing it to be used for other types of international counterterrorism investigations,” ignoring that the President (and Goldsmith’s subsequent OLC memo) permitted the inclusion of other international terrorist groups. That may reflect reporting that will show up in his book, but the language adopted pursuant to DOJ complaints, both in the March 19 authorization and in Goldsmith’s memo, clearly permits targeting of more than just al Qaeda at the President’s prerogative, so long as it actually has to do with “international” terrorism (Goldsmith distinguishes international terrorism from domestic in an effort to comply with the Supreme Court Keith decision, but not in a way that I believe to be adequate in logic or, since Goldsmith’s opinion, implementation).

We don’t know whether two other things newly revealed to be in the March 11, 2004 memo got changed, because we don’t see the other March 19 modifications.

First, Gonzales explicitly asserted in the March 11 authorization that Article II authority “displace[s] the provisions of law, including the Foreign Intelligence Surveillance Act and chapter 119 of Title 18 of the United States Code (including 18 U.S.C. §2511(f) relating to exclusive means), to the extent any conflict between provisions and such exercises under Article III.” This idea may have been tweaked in one of the modifications, given that Goldsmith’s memo largely provides an explanation for how FISA got displaced via the AUMF, but I also suspect that, even as problematic as Goldsmith’s memo is, it was probably stronger than any modifications before he issued the memo.

Far more interesting is the language Gonzales included in the March 11 authorization designed to retroactively authorize the bulk collection of entirely domestic metadata. It did so by claiming that metadata “is ‘acquired’ for the purposes of subparagraph 4(b) above when, and only when, the Department of Defense has searched for and retrieved such header/router/addressing-type information, … and not when the Department obtains such header/routing/addressing-type information.” Effectively, that March 11 authorization — and Gonzales’ effort to pretend they hadn’t been violating the law for 3 years — is the source of the Orwellian definition of “collect” that James Clapper relied on when caught in his lies about dragnets. There is a great deal in Goldsmith’s opinion on metadata that remains redacted, so Goldsmith may well have amended this formula. And I think FISC operates with a more reasonable definition of “collect” than the IC does (which ought to be a problem!). But some version of that definition covers probably even more invasive spying of US persons under SPCMA, and that language and logic was always withheld from FISC. My strong suspicion is that Goldsmith did change this. I even think it remotely possible that the scope of SPCMA has been modified since James Baker became FBI General Counsel.

Regardless of whether that definition was reined in in the modifications and/or Goldsmith’s memo, however, that’s still the way the government thinks.

The Continued Belief in Unicorn Cyber Deterrence

/10 Comments/in /by

For some reason, people continue to believe Administration leaks that they will retaliate against China (and Russia!) for cyberattacks — beyond what are probably retaliatory moves already enacted.

I think Jack Goldsmith’s uncharacteristically snarky take is probably right. After cataloging the many past leaks about sanctions that have come to no public fruition, Goldsmith talks about the cost of this public hand-wringing.

As I have explained before, figuring out how to sanction China for its cyber intrusions is hard because (among other reasons) (i) the USG cannot coherently sanction China for its intrusions into US public sector (DOD, OPM, etc.) networks since the USG is at least as aggressive in China’s government networks, and (ii) the USG cannot respond effectively to China’s cyber intrusions in the private sector because US firms and the US economy have more to lose than gain (or at least a whole lot to lose) from escalation—especially now, given China’s suddenly precarious economic situation.

But even if sanctions themselves are hard to figure out, the public hand-wringing about whether and how to sanction China is harmful.  It is quite possible that more is happening in secret.  “One of the conclusions we’ve reached is that we need to be a bit more public about our responses, and one reason is deterrence,” a senior administration official in an “aha” moment told Sanger last month.  One certainly hopes the USG is doing more in secret than in public to deter China’s cybertheft.   Moreover, one can never know what cross-cutting machinations by USG officials lie behind the mostly anonymous leaks that undergird the years of stories about indecisiveness.

This performance seems to be directed at domestic politics, because the Chinese aren’t impressed.

A still crazier take, though, is this one, which claims DOJ thought indicting 5 PLA connected hackers last year would have any effect.

But nearly a year and a half after that indictment was unveiled, the five PLA soldiers named in the indictment are no closer to seeing the inside of a federal courtroom, and China’s campaign of economic espionage against U.S. firms continues. With Chinese President Xi Jinping set to arrive in Washington for a high-profile summit with President Barack Obama later this month, the question of how — and, indeed, if — the United States can deter China from pilfering American corporate secrets remains very much open. The indictment of the PLA hackers now stands out as a watershed moment in the escalating campaign by the U.S. government to deter China from its aggressive actions in cyberspace — both as an example of the creative ways in which the United States is trying to fight back and the limits of its ability to actually influence Chinese behavior.

[snip]

In hindsight, the indictment seems less like an exercise in law enforcement than a diplomatic signal to China. That’s an argument the prosecutor behind the case, U.S. Attorney David Hickton, resents. “I believe that’s absolute nonsense,” Hickton told Foreign Policy. “It was not the intention, when we brought this indictment, to at the same time say, ‘We do not intend to bring these people to justice.’”

But it’s unclear exactly what has happened to the five men since Hickton brought charges against them. Their unit suspended some operations in the aftermath of the indictment, but experts like Weedon say the group is still active. “The group is not operating in the same way it was before,” she said. “It seems to have taken new shape.”

Hickton, whose office has made the prosecution of cybersecurity cases a priority, says he considers the law enforcement effort against hackers to be a long-term one and likens it to indictments issued in Florida against South American drug kingpins during the height of the drug war. Then, as now, skeptics wondered what was the point of bringing cases against individuals who seemed all but certainly beyond the reach of U.S. law enforcement. Today, Hickton points out, U.S. prisons are filled with drug traffickers. Left unsaid, of course, is that drugs continue to flow across the border.

That’s because it fundamentally misunderstands what the five hackers got indicted for.

This indictment was not, as claimed, for stealing corporate secrets. It was mostly not for economic espionage, which we claim not to do.

Rather — as I noted at the time — it was for stealing information during ongoing trade disputes.

But the other interesting aspect of this indictment coming out of Pittsburgh is that — at least judging from the charged crimes — there is far less of the straight out IP theft we always complain about with China.

In fact, much of the charged activity involves stealing information about trade disputes — the same thing NSA engages in all the time. Here are the charged crimes committed against US Steel and the United Steelworkers, for example.

In 2010, U.S. Steel was participating in trade cases with Chinese steel companies, including one particular state-owned enterprise (SOE-2).  Shortly before the scheduled release of a preliminary determination in one such litigation, Sun sent spearphishing e-mails to U.S. Steel employees, some of whom were in a division associated with the litigation.  Some of these e-mails resulted in the installation of malware on U.S. Steel computers.  Three days later, Wang stole hostnames and descriptions of U.S. Steel computers (including those that controlled physical access to company facilities and mobile device access to company networks).  Wang thereafter took steps to identify and exploit vulnerable servers on that list.

[snip]

In 2012, USW was involved in public disputes over Chinese trade practices in at least two industries.  At or about the time USW issued public statements regarding those trade disputes and related legislative proposals, Wen stole e-mails from senior USW employees containing sensitive, non-public, and deliberative information about USW strategies, including strategies related to pending trade disputes.  USW’s computers continued to beacon to the conspiracy’s infrastructure until at least early 2013.

This is solidly within the ambit of what NSA does in other countries. (Recall, for example, how we partnered with the Australians to obtain information to help us in a clove cigarette trade dispute.)

I in no way mean to minimize the impact of this spying on USS and USW. I also suspect they were targeted because the two organizations partner together on an increasingly successful manufacturing organization. Which would still constitute a fair spying target, but also one against which China has acute interests.

But that still doesn’t make it different from what the US does when it engages in spearphishing — or worse — to steal information to help us in trade negotiations or disputes.

We’ve just criminalized something the NSA does all the time.

The reason this matters is because all the people spotting unicorn cyber-retaliation don’t even understand what they’re seeing, and why. I mean, Hickton (who as I suggested may well run for public office) may have reasons to want to insist he’s championing the rights of Alcoa, US Steel, and the Steelworkers. But he’s not implementing a sound deterrence strategy because — as Goldsmith argues — it’s hard to imagine one that we could implement, much less one that wouldn’t cause more blowback than good.

Before people start investing belief in unicorn cyber deterrence, they’d do well to understand why it presents us such a tough problem.

 

Dean Baquet Explains that the CIA Cries Wolf, But Misses How Transparency Helps Hold Feinstein Accountable

/7 Comments/in , /by

Jack Goldsmith conducted  fascinating interview with NYT Executive Editor Dean Baquet about the latter’s decision to name Michael D’Andrea and two other top CIA officials whose identities the CIA was trying to suppress.

He attributes his decision to three factors: The CIA has increasingly taken on a new military role that demands some accountability, the CIA admitted these three figures were widely known anyway, and the CIA (and NSA’s) explanations in the past have proven lame.

There are some interesting points, but I think Baquet — and Goldsmith — miss two aspects of accountability that the NYT article permitted.

Widely known figures

Baquet reveals that even the CIA didn’t claim these men were secret, even if it still pretends they are under cover.

DB: These guys may technically be undercover. But even the CIA admitted when they called – and this was a big factor in the decision – that they are widely known, and they were known to the governments where they were stationed. The CIA’s pitch was not that these guys are secret or that people don’t know about them. The CIA’s pitch to me was, “Look, its one thing to be widely known, and to be known to governments and to be on web sites; but when they appear on the front page of the New York Times, that has a larger meaning.” So they were known anyway. The gentleman at the very top [of the CTC] runs a thousand-person agency, and makes huge decisions, personally, that have tremendous repercussions for national security. I’m not making judgments about him, but that’s the reality.

Later in the interview Goldsmith appears to totally ignore this point when he worries that these men don’t have the same kind of security as their counterparts running drone programs in the military. He suggests they might come under new threat because their names have been published on the front page of the NYT.

But that assumes our adversaries are too dumb to look in the places where these men’s names have been published before — just like CIA’s successful attempt to suppress Raymond Davis’ association with the CIA even after it was broadly known in Pakistan. It assumes our adversaries who seek out this information are not going to find where it’s hiding in plain sight.

The CIA isn’t keeping these secrets from our adversaries. They already know them. Which makes CIA’s efforts to keep them from the US public all the more problematic.

Crying wolf

Baquet’s argument about CIA’s squandered credibility is two fold. First, he notes that the CIA always claims people are under cover, which makes their claims less credible as a result.

JG: Let me ask you a different question. What do you think about the claim by Bob Litt, the General Counsel of the DNI, that you’ve put these guys’ lives and their families’ lives in jeopardy, and also the people they worked with undercover abroad? How do you assess that? How do you weigh that?

DB: I guess I would say a couple of things. I wish the CIA did not say that about everybody and everything. They hurt their case.

JG: They say it a lot?

DB: They say it all the time. I wish they were a little more measured in saying that. Sometime it’s a little difficult to deal with the Agency. When somebody says that and has a track record of rarely saying that, it really gives me pause. But they [the CIA] say it whenever we want to mention a [covert] CIA operative or CIA official.

But — perhaps more importantly for a guy who has taken heat for killing important stories in the past — Baquet also mentions the times agencies convince him to kill stories that turn out to get published anyway. Baquet uses sitting on the detail that the US used a drone base in Saudi Arabia to kill Anwar al-Awlaki as his example.

DB: I’ll give you an example. When Al-Awlaki was killed by a drone strike, we were on deadline, and I was the Managing Editor. The Acting Director of the CIA called up because we were going to say in the middle of the story that the drone that killed Al-Awlaki took off from a base in Saudi Arabia. (I can give you twenty examples, but this is just one.) He called up and said, “If you say that the drone took off from a base in Saudi Arabia, we are going to lose that base. The Saudis are going to go nuts, they don’t want people to know that we are flying drones from their base.” And so I took it out. And I think we made it something like, “The drones took off from a base in the Arabian Peninsula,” something vague. Sure enough, the next day, everybody other than us said it was Saudi Arabia. When I thought hard about it, [I concluded] that was not a good request. And I later told the CIA it was not a good request. And they should have admitted that was not a good request. Everyone knew they had a base. It was for geopolitical reasons, not really national security reasons. I think that’s one where they shouldn’t have asked and I shouldn’t have said “yes” so automatically. So now I am tougher. Now I just say to them, “Give me a compelling reason, really really tell me.” Because to not publish, in my way of thinking, is almost a political act. To not publish is a big deal. So I say, “Give me a compelling reason.” And I don’t think I said that hard enough earlier on. That influences me now. It does make me want to say to the CIA, and the NSA, and other agencies involved in surveillance and intelligence: “Guys, make the case. You can’t just say that it hurts national security. You can’t just say vaguely that it’s going to get somebody killed. You’ve got to help me, tell me.” In cases where they have actually said to me something really specific, I have held it. There is still stuff that’s held, because it is real. But I think I am tougher now and hold them to higher standards. And part of that is that secrecy now is part of the story. It’s not just a byproduct of the story. It’s part of the story. I think there is a discussion in the country about secrecy in government post-9/11. It was provoked partly by Snowden, it was provoked partly by the secrecy of the drone program. And I think that secrecy is now part of it. And that puts more pressure on me to reveal details when I have them.

But I find his invocation of Snowden (and the mention of the NSA which he makes 4 times) all the more interesting.

Remember, in 2006, Mark Klein brought the story, with documents to prove the case, that the NSA had tapped into AT&T’s Folsom Street switch to Baquet when the latter was at the LAT. Baquet killed the story, only to have the NYT publish the story shortly thereafter.

Back in 2006, former AT&T employee Mark Klein revealed information that proved the communications giant was allowing the NSA to monitor Internet traffic “without any regard for the Fourth Amendment.” Klein initially brought the story to The Los Angeles Times, but it never made it to print under Baquet, who recently replaced the fired Jill Abramson as executive editor of The New York Times.

Klein told HuffPost Live’s Alyona Minkovski that he gave 120 pages of AT&T documents to an LA Times reporter who “was promising a big front-page expose” on the story. But the reporter eventually told Klein there was a “hangup,” and the story was abandoned shortly after with no explanation.

Months later, producers from ABC’s “Nightline” who were working on the story contacted editors at the LA Times to ask if they had, in fact, decided not to print it. The producers were told that Baquet killed the story, Klein said.

“That’s when Dean Baquet came out with this lame excuse that he just couldn’t figure out my technical documents, so he didn’t think they had a story. I don’t think anybody really believed that argument because, as I said, a few weeks after the LA Times killed the story, I went to The New York Times and they had no trouble figuring it out,” Klein said.

Any question of the clarity in the documents Klein produced “was just Dean Baquet’s lame cover story for capitulating to the government’s threats,” Klein alleged.

And while Baquet still claims he didn’t kill the story due to pressure from the government, the claim has always rung hollow.

The CIA and NSA have not only cried wolf once too often, they have cried wolf with Baquet personally.

Missing accountability

There are two things that are, sadly, missing from this discussion.

First, no one actually believes that Michael D’Andrea, who (as I pointed out yesterday) the CIA helped Hollywood turn into one of the heroes of the Osama bin Laden hunt) is really under cover. But it’s important to look at what suppressing his actual name does for accountability. And the torture report is the best exhibit for that.

If you can’t connect all the things that D’Andrea — or Alfrea Bikowsky or Jonathan Fredman — have done in their role with torture, you can’t show that certain people should have known better. After KSM led Bikowsky to believe, for 3 months, that he had sent someone to recruit black Muslims in Montana to start forest fires, any further unfathomable credulity on her part can no longer be deemed an honest mistake; it’s either outright incompetence, or a willful choice to chase threats that are not real. Hiding D’Andrea’s name, along with the others, prevents that kind of accountability.

But there’s one other crucial part of accountability that’s core to the claim that our representative government adequately exercises oversight over CIA.

A key part of the NYT story (and Baquet emphasized this) was challenging whether the Intelligence Committees were exercising adequate oversight over the drone strikes. The NYT included really damning details about Mike Rogers and Richard Burr pushing to kill Americans.

Yet the article was most damning, I think, for Dianne Feinstein, though it didn’t make the case as assertively as they could have. Consider the implications of this:

In secret meetings on Capitol Hill, Mr. D’Andrea was a forceful advocate for the drone program and won supporters among both Republicans and Democrats. Congressional staff members said that he was particularly effective in winning the support of Senator Dianne Feinstein, the California Democrat who was chairwoman of the Senate Intelligence Committee until January, when Republicans assumed control of the chamber.

[snip]

The confidence Ms. Feinstein and other Democrats express about the drone program, which by most accounts has been effective in killing hundreds of Qaeda operatives and members of other militant groups over the years, stands in sharp contrast to the criticism among lawmakers of the now defunct C.I.A. program to capture and interrogate Qaeda suspects in secret prisons.

But both programs were led by some of the same people.

The implication — which should be made explicit — is that Dianne Feinstein has been protecting and trusting a guy who also happens to have been a key architect of the torture program (Feinstein did the same with Stephen Kappes).

Feinstein can complain about torture accountability all she wants. But she has the ability to hold certain people to a higher standard, and instead, in D’Andrea’s case and in Kappes, she has instead argued that they should maintain their power.

And that’s the kind of the thing the public can and should try to hold Feinstein accountable for. Rogers and Burr, at least, are not hypocrites. They like unchecked and ineffective CIA power, unabashedly. But Feinstein claims to have concerns about it … sometimes, but not others.

The public may not be able to do much to hold the CIA accountable. But we can call out Feinstein for failing to do the things she herself has power to do to get accountability for torture and other CIA mismanagement. And that, at least, is a key value of having named names.

On the Nonsense of Norms about Secrets

/5 Comments/in , /by

At a panel on secrecy yesterday, Bob Litt proclaimed that the NYT “disgraced itself” for publishing names, some of which were widely known, of the people who were conducting our equally widely known secret war on drones.

Sadly, Litt did not get asked the question implied by the Washington Post’s Greg Miller (who has, in the past, caught heat for not publishing some of the same names).

So CIA tried to convince not to name CTC chief, but helped do profile of CTC women with names and photos??

Did the NYT “disgrace itself” for publishing a column by Maureen Dowd that covers over some of the more unsavory female CIA officers — notably, Alfreda Bikowsky — who have nevertheless been celebrated by the Agency?

I’d submit that, yes, the latter was a far more disgraceful act, regardless of the credit some of the more sane female CIA officers deserve, because it was propaganda delivered on demand, and delivered for an agency that would squawk Espionage Act had the NYT published the same details in other circumstances.

Keep that in mind as you read this post from Jack Goldsmith, claiming — without offering real evidence — that this reflects a new “erosion of norms” against publishing classified information.

I mean, sure, I agree the NYT decision was notable. But it’s only notable because comes after a long series of equally notable events — events upping the tension underlying the secrecy system — that Goldsmith doesn’t mention.

There’s the norm — broken by some of the same people the NYT names, as well as Jose Rodriguez before them — that when you take on the most senior roles at CIA, you drop your cover. By all appearances, as CIA has engaged in more controversial and troubled programs, it has increasingly protected the architects of those programs by claiming they’re still undercover, when that cover extends only to the public, and not to other countries, even adversarial ones. That is, CIA has broken the old norm to avoid any accountability for its failures and crimes.

Then there’s the broken norm — exhibited most spectacularly in the Torture Report — of classifying previously unclassified details, such as the names of all the lawyers who were involved in the torture program.

There’s the increasing amounts of official leaking — up to and including CIA cooperating with Zero Dark Thirty to celebrate the work of Michael D’Andrea — all while still pretending that D’Andrea was still under cover.

Can we at least agree that if CIA has decided a Hollywood propagandistic version of D’Andrea’s is not classified, then newspapers can treat his actual career as such? Can we at least agree that as soon as CIA has invited Hollywood into Langley to lionize people, the purportedly classified identities of those people — and the actual facts of their career — will no longer be granted deference?

And then, finally, there’s CIA’s (and the Intelligence Community generally) serial lying. When Bob Litt’s boss makes egregious lies to Congress to cover up for the even more egregious lies Keith Alexander offered up when he played dress-up hacker at DefCon, and when Bob Litt continues to insist that James Clapper was not lying when everyone knows he was lying, then Litt’s judgement about who “disgraced” themselves or not loses sway.

All the so-called norms Goldsmith nostalgically presents without examination rest on a kind of legitimacy that must be earned. The Executive has squandered that legitimacy, and with it any trust for its claims about the necessity of the secrets it keeps.

Goldsmith and Litt are asking people to participate with them in a kind of propagandistic dance, sustaining assertions as “true” when they aren’t. That’s the habit of a corrupt regime. They’d do well to reflect on what kind of sickness they’re actually asking people to embrace before they start accusing others of disgraceful behavior.

OLC Lowers Its Standards for Retroactive Legal Reviews

/2 Comments/in , , /by

There’s an interesting passage in the DOJ IG discussion of Jack Goldsmith’s efforts to rewrite the Stellar Wind OLC memos (PDF 456).

The first passage describes Jim Comey permitting a lower standard of review to apply for activities already in process.

In explaining the rationale for the revise opinion, Comey described to the OIG his view of two approaches or standards that could be used to undertake legal analysis of government action. If the government is contemplating taking a particular action, OLC’s legal analysis will be based on a “best view of the law” standard. However, if the government already is taking the action, the analysis should instead focus on whether reasonable legal arguments can be made to support the continuation of the conduct.137

137 Goldsmith emphasized to us that this second situation almost never presents itself, and that OLC rarely is asked to furnish legal advise on an ongoing program because the pressure “to say ‘yes’ to the President” invariably would result in applying a lower standard of review. Goldsmith stated that OLC’s involvement in Stellar Wind was “unprecedented” because OLC is always asked to review the facts and formulate its advice “up front.”

If it was unprecedented on March 1, 2004, it quickly became common.

After all, Goldsmith was asked to consider how the Geneva Convention applied to various types of detainees in Iraq, after the Administration had already been and continued to render people out of that occupied country. And he was also in the midst of a review of the torture program.

Indeed, Daniel Levin, who would go on to reconsider torture approvals until Cheney booted him out of the way to have Steven Bradbury rubberstamp things, would have been a part of those discussions.

So when, in fall 2004, he was asked to reconsider torture, that lower standard of review would have been in his mind.

You could even say that this standard of review gave CIA an incentive to start and continue torturing Janat Gul, on whom they pinned their need to resume torture, even after they accepted he was not, as a fabricator had claimed, planning election year plots in the US. So long as they tortured Gul, Levin would be permitted to apply a lower standard to that torture.

In any case, if this was unprecedented then, I suspect it’s not anymore. After all, by the time David Barron first considered the drone killing memo for Anwar al-Awlaki, the Administration had apparently already tried to kill him once. And the Libyan war had already started when OLC started reviewing it (though they made a heroic effort to rule it illegal, which is a testament to just how illegal it was).

With regards to the Stellar Wind OLC, the discussion of what Goldsmith found so problematic is mostly redacted. Which is why I’m interested in his opinion that “‘we can get there’ as to [redacted] albeit by using an aggressive legal analysis.” That says that one of the things his opinion would approve — either the content collection of one-end foreign communications or the dragnet collection of telephone metadata — involved “aggressive legal analysis” even to meet this lower standard.

It’d sure be nice to know which practice was considered so marginally legal.

John Yoo Approved the Stellar Wind Authorization that First Covered Iraq

/5 Comments/in /by

As I noted, one interesting aspect of reading the Stellar Wind IG Reports is tracking the things that show up in the Snowden-leaked draft IG Report that are completely redacted in the DOJ-released report.

One thing that is completely redacted is that Stellar Wind was used to spy on Iraqi targets (or US targets alleged to be Iraqi targets during the war?), as explained here.

(TS//SI//NF) Iraqi Intelligence Service. For a limited period of time surrounding the 2003 invasion oflraq, the President authorized the use of PSP authority against the Iraqi Intelligence Service. On 28 March 2003, the DCI determined that, based on then current intelligence, the Iraqi Intelligence service was engaged in terrorist activities and presented a threat to U.S. interests in the United States and abroad. Through the Deputy DCI, Mr. Tenet received the President’s concurrence that PSP authorities could be used against the Iraqi Intelligence Service. NSA ceased using the Authority for this purpose in March 2004.

Given the timing, this almost certainly is one of the things Jack Goldsmith shut down in the first set of modifications in March 2004 (there appears to have been a parallel effort in 2004 to stop treating Iraqi prisoners as terrorists who could be tortured).

And while the officially released IG Reports hide all mention of this, there is one detail that says volumes. Amid the section describing all the things Patrick Philbin found to be problematic in Yoo’s OLC memos authorizing the program, this footnote appears (at PDF 442).

See Presidential Authorization of April 22, 2003 at para. 4(b)(i) & (ii). The April 22, 2003, Authorization was the only Authorization personally approved as to form and legality by Yoo. He approved the Authorization on April 18, 2003; five days before the date of his talking points memorandum.

John Yoo, not Attorney General Ashcroft, signed the Authorization that went into effect on April 22, 2003.

This Authorization was the first issued after Tenet declared Iraq terrorists on March 28, 2003 (I’ve added the Authorization dates here).

As it happens, that Authorization was also the last or second-to-last one signed while Yoo remained at DOJ. He left in June 2003 because Ashcroft had refused to let him assume the OLC AAG position after Jay Bybee moved onto his sinecure on the 9th Circuit.

That’s not the last crazy thing Yoo did while at OLC: at roughly the same time he was free-lancing “Legal Principles” documents pretend-authorizing torture techniques that the original Bybee memo had not approved.

But I find it interesting that one of the last things Yoo did was sign an authorization to use a program purportedly focused on terrorists to surveil targets (who must in some part be in the US) related to a war of choice.

Section 215’s Multiple Programs and Where They Might Hide after June 1

/6 Comments/in , /by

In an column explicitly limited to the phone dragnet, Conor Friedersdorf pointed to a post I wrote about Section 215 generally and suggested I thought the phone dragnet was about to get hidden under a new authority.

Marcy Wheeler is suspicious that the Obama Administration is planning to continue the dragnet under different authorities.

But my post was about more that just the phone dragnet. It was about two things: First, the way that, rather than go “cold turkey” after it ended the Internet dragnet in 2011 as the AP had claimed, NSA had instead already started doing the same kind of collection using other authorities that — while they didn’t collect all US traffic — had more permissive rules for the tracking they were doing. That’s an instructive narrative for the phone dragnet amid discussions it might lapse, because it’s quite possible that the Intelligence Community will move to doing far less controlled tracking, albeit on fewer Americans, under a new approach.

In addition, I noted that there are already signs that the IC is doing what Keith Alexander said he could live with a year ago: ending the phone dragnet in exchange for cybersecurity information sharing. I raised that in light of increasing evidence that the majority of Section 215 orders are used for things related to cybersecurity (though possibly obtained by FBI, not NSA). If that’s correct, Alexander’s comment would make sense, because it would reflect that it is working cybersecurity investigations under protections — most notably, FISC-supervised minimization — all involved would rather get rid of.

Those two strands are important, taken together, for the debate about Section 215 expiration, because Section 215 is far more than the dragnet. And the singular focus of everyone — from the press to activists and definitely fostered by NatSec types leaking — on the phone dragnet as Section 215 sunset approaches makes it more likely the government will pull off some kind of shell game, moving the surveillances they care most about (that is, not the phone dragnet) under some new shell while using other authorities to accomplish what they need to sustain some kind of  phone contact and connection chaining.

So in an effort to bring more nuance to the debate about Section 215 sunset, here is my best guess — and it is a guess — about what they’re doing with Section 215 and what other authorities they might be able to use to do the same collection.

Here are the known numbers on how Section 215 orders break out based on annual reports and this timeline.

215 Tracker

The Phone Dragnet

Since its transfer under Section 215 in 2006, the phone dragnet has generally made up 4 or 5 orders a year (Reggie Walton imposed shorter renewal periods in 2009 as he was working through the problems in the program). 2009 is the one known year where many of the modified orders — which generally involve imposed minimization procedures — were phone dragnet orders.

We  know that the government believes that if Section 215 were to sunset, it would still have authority to do the dragnet. Indeed, it not only has a still-active Jack Goldsmith memo from 2004 saying it can do the dragnet without any law, it sort of waved it around just before the USA Freedom  Act debate last year as if to remind those paying attention that they didn’t necessarily think they needed USAF (in spite of comments from people like Bob Litt that they do need a new law to do what they’d like to do).

But that depends on telecoms being willing to turn over the dragnet data voluntarily. While we have every reason to believe AT&T does that, the government’s inability to obligate Verizon to turn over phone records in the form it wants them is probably part of the explanation for claims the current dragnet is not getting all the cell records of Americans.

A number of people — including, in part, Ron Wyden and other SSCI skeptics in a letter written last June — think the government could use FISA’s PRTT authority (which does not sunset) to replace Section 215, and while they certainly could get phone records using it, if they could use PRTT to get what it wants, they probably would have been doing so going back to 2006 (the difference in authority is that PRTT gets actual activity placed, whereas 215 can only get records maintained (and Verizon isn’t maintaining the records the government would like it to, and PRTT could not get 2 hops).

For calls based off a foreign RAS, the government could use PRISM to obtain the data, with the added benefit that using PRISM would include all the smart phone data — things like address books, video messaging, and location — that the government surely increasingly relies on. Using PRISM to collect Internet metadata is one of two ways the government replaced the PRTT Internet dragnet. The government couldn’t get 2 hops and couldn’t chain off of Americans, however.

I also suspect that telecoms’ embrace of supercookies may provide other options to get the smart phone data they’re probably increasingly interested in.

For data collected offshore, the government could use SPCMA, the other authority the government appears to have replaced the PRTT Internet dragnet with. We know that at least one of the location data programs NSA has tested out works with SPCMA, so that would offer the benefit of including location data in the dragnet. If cell phone location data is what has prevented the government from doing what they want to do with the existing phone dragnet, SPCMA’s ability to incorporate location would be a real plus for NSA, to the extent that this data is available (and cell phone likely has more offshore availability than land line).

The government could obtain individualized data using NSLs — and it continues to get not just “community of interest” (that is, at least one hop) from AT&T, but also 7 other things that go beyond ECPA that FBI doesn’t want us to know about. But using NSLs may suffer from a similar problem to the current dragnet, that providers only have to provide as much as ECPA requires. Thus, there, too, other providers are probably unwilling to provide as much data as AT&T.

Telecoms might be willing to provide data the government is currently getting under 215 under CISA and CISA collection won’t be tied in any way to ECPA definitions, though its application is a different topic, cybersecurity (plus leaks and IP theft) rather than terrorism. So one question I have is whether, because of the immunity and extended secrecy provisions of CISA, telecoms would be willing to stretch that?

Other Dragnets

In addition to the phone dragnet, FBI and other IC agencies seem to operate other dragnets under Section 215. It’s probably a decent guess that the 8-13 other 215 orders prior to 2009 were for such things. NYT and WSJ reported on a Western Union dragnet that would probably amount to 4-5 orders a year. Other items discussed involve hotel dragnets and explosives precursor dragnets, the latter of which would have been expanded after the 2009 Najibullah Zazi investigation. In other words, there might be up to 5 dragnets, each representing 4-5 orders a year (assuming they work on the same 90-day renewal cycle), so a total of around 22 of the roughly 175 orders a year that aren’t the phone dragnet (the higher numbers for 2006 are known to be combination orders both obtaining subscription data for PRTT orders and location data with a PRTT order; those uses stopped in part with the passage of PATRIOT reauthorization in 2006 and in part with FISC’s response to magistrate rulings on location data from that year).

Some of these dragnets could be obtained, in more limited fashion, with NSLs (NSLs currently require reporting on how many US persons are targeted, so we will know if they move larger dragnets to NSLs). Alternately, the FBI may be willing to do these under grand jury subpoenas or other orders, given the way they admitted they had done a Macy’s Frago Elite pressure cooker dragnet after the Boston Marathon attack. The three biggest restrictions on this usage would be timeliness (some NSLs might not be quick enough), the need to have a grand jury involved for some subpoenas, and data retention, but those are all probably manageable hurdles.

The Internet content

Finally, there is the Internet content — which we know makes up for a majority of Section 215 orders — that moved to that production from NSLs starting in 2009. It’s probably a conservative bet that over 100 of current dragnet orders are for this kind of content. And we know the modification numbers for 2009 through 2011 — and therefore, probably still — are tied to minimization procedure requirements imposed by the FISC.

A recent court document from a Nicholas Merrill lawsuit suggests this production likely includes URL and data flow requests. And the FBI has recently claimed –for what that’s worth — that they rely on Section 215 for cybersecurity investigations.

Now, for some reason, the government has always declined to revise ECPA to restore their ability to use NSLs to obtain this collection, which I suspect is because they don’t want the public to know how extensive the collection is (which is why they’re still gagging Merrill, 11 years after he got an NSL).

But the data here strongly suggests that going from NSL production to Section 215 production has not only involved more cumbersome application processes, but also added a minimization requirement.

And I guarantee you, FBI or NSA or whoever is doing this must hate that new requirement. Under NSLs, they could just horde data, as we know both love to do, the FBI even more so than the NSA. Under 215s, judges made them minimize it.

As I noted above, this is why I think Keith Alexander was willing to do a CISA for 215 swap. While CISA would require weak sauce Attorney General derived “privacy guidelines,” those would almost certainly be more lenient than what FISC orders, and wouldn’t come with a reporting requirement. Moreover, whereas at least for the phone dragnet, FISC has imposed very strict usage requirements (demanding that a counterterrorism dragnet be used only for counterterrorism purposes), CISA has unbelievably broad application once that data gets collected — not even requiring that terrorist usages be tied to international terrorism, which would seem to be a violation of the Keith Supreme Court precedent).

All of this is to suggest that for cybersecurity, IP theft, and leak investigations, CISA would offer FBI their ideal collection approach. It would certainly make sense that Alexander (or now, Admiral Mike Rogers and Jim Comey) would be willing to swap a phone dragnet they could largely achieve the same paltry results for using other authorities if they in exchange got to access cybersecurity data in a far, far more permissive way. That’d be a no-brainer.

There’s just one limitation on this formula, potentially a big one. CISA does not include any obligation. Providers may share data, but there is nothing in the bill to obligate them to do so. And to the extent that providers no longer provide this data under NSLs, it suggests they may have fought such permissive obligation in the past. It would seem that those same providers would be unwilling to share it willingly.

But my thoughts on CISA’s voluntary nature are for another post.

One final thought. If the government is contemplating some or all of this, then it represents an effort — one we saw in all versions of dragnet reform to greater (RuppRoge) or lesser degrees (USAF) — to bypass FISC. The government and its overseers clearly seem to think FISC-ordered minimization procedures are too restrictive, and so are increasingly (and have been, since 2009) attempting to replace the role played by an utterly dysfunctional secret court with one entirely within the Executive.

This is the reason why Section 215 sunset can’t be treated in a vacuum: because, to the extent that the government could do this in other authorities, it would largely involve bypassing what few restrictions exist on this spying. Sunsetting Section 215 would be great, but only if we could at the same time prevent the government from doing similar work with even fewer controls.

The Precedent for Using Presidential National Emergency Proclamations to Expand Surveillance

/6 Comments/in , , /by

On September 14, 2001 — 3 days before signing an expansive Memorandum of Notification that would authorize a suite of covert operations against al Qaeda, and 4 days before signing an AUMF that would give those operations the appearance of Congressional sanction — President Bush declared a National Emergency in response to the 9/11 attack.

The following day, according to a 2002 motion to the FISC to be able to share raw FISA-derived information with CIA and NSA (this was liberated by Charlie Savage), FISC suspended its rules on sharing intelligence derived under FBI-obtained FISA warrants with criminal investigations (see page 26 of this paper for background).

On September 15, 2001, upon motion of the Government, the [FISA] Court suspended the “Court wall,” certification, and caveat requirements that previously had applied to Court-authorized electronic surveillance and physical search of [redacted] related targets, while directing that the FBI continue to apply the standard minimization procedures applicable in each case. As stated in the order resulting from that motion, the Court took this action in light of inter alia:

“the President’s September 14, 2001, declaration of a national emergency and the near war conditions that currently exist;”

“the personal meeting the Court had with the Director of the FBI on September 12, 2001, in which he assured the Court of the collection authority requested from this Court in the face of the nature and scope of the multi-faced response of the United States to the above-referenced attacks;

“the need for the Government to rapidly disseminate pertinent foreign intelligence information to appropriate authorities.”

Ten days after FISC dismantled its role in “the wall” between intelligence and criminal investigations in response to the Executive’s invocation of a National Emergency, on September 25, 2001, John Yoo finished an OLC memo considering the constitutionality of dismantling the wall by replacing “the purpose” in FISA orders with “a purpose.”

A full month later, on October 25, 2001, Congress passed the PATRIOT Act. For over 13 years, analysis of the PATRIOT Act has explained that it eliminated “the wall” between intelligence and criminal investigations by replacing language requiring foreign intelligence be “the purpose” of FISA wiretaps with language requiring only that that be “a significant purpose” of the wiretap. But the FISC suspension had already removed the biggest legal barrier to eliminating that wall.

In other words, the story we’ve been telling about “the wall” for over 13 years is partly wrong. The PATRIOT Act didn’t eliminate “the wall.” “The wall” had already been suspended, by dint of Executive Proclamation and a secret application with the FISC, over a month before the PATRIOT Act was initially introduced as a bill.

FISC suspended it, without congressional sanction, based on the President’s invocation of a National Emergency.

That’s not the only case where the Executive invoked that National Emergency in self-authorizing or getting FISC to authorize expansive new surveillance authorities (or has hidden the authorities under which it makes such claims).

Perhaps most illustratively, on May 6, 2004, Jack Goldsmith pointed to the National Emergency when he reauthorized most aspects of Stellar Wind.

On September 14, 2001. the President declared a national emergency “by reason of the terrorist attacks at the World Trade Center, New York, New York, and the Pentagon, and the continuing and immediate threat of further attacks on the United States.” Proclamation No. 7463, 66 Fed. Reg. 43, !99 (Sept. 14, 2001). The United States also launched a massive military response, both at home and abroad. In the United States, combat air patrols were immediately established over major metropolitan areas and were maintained 24 hours a day until April 2002, The United States also immediately began plans for a military response directed at al Qaeda’s base of operations in Afghanistan.

Only after invoking both the Proclamation and the immediate military response that resulted did Goldsmith note that Congress supported such a move (note, he cited Congress’ September 14 passage of the AUMF, not Bush signing it into law on September 18, thought that may be in part because Michael Hayden authorized the first expansions of surveillance September 14; also remember there are several John Yoo memos that remain hidden) and then point to an article on the friendly-fire death of Pat Tillman as proof that combat operations continued.

On September 14, 2001, both houses of Congress passed a joint resolution authorizing the President “to use all necessary and appropriate force against those nations, organizations, or persons he determines planned, authorized, committed, or aided the terrorist attacks” of September I I. Congressional Authorization § 2(a). Congress also expressly acknowledged that the attacks rendered it “necessary and appropriate” for the United States to exercise its right “to protect United States citizens both at home and abroad,” and acknowledged in particular that the “the President has authority under the Constitution to take action to deter and prevent acts of international terrorism against the United States.” id. pmbl. Acting under his constitutional authority as Commander in Chief, and with the support of Congress, the President dispatched forces to Afghanistan and, with the cooperation of the Northern Alliance, toppled the Taliban regime from power Military operations to seek out resurgent elements of the Taliban regime and al Qaeda fighters continue in Afghanistan to this day. See, e.g., Mike Wise and Josh White, Ex-NFL Player Tillman Killed in Combat, Wash. Post, Apr. 24, 2004, at AI (noting that “there are still more than 10,000 U.S. troops in the country and fighting continues against remains of the Taliban and al Qaeda”).

That is, even in an OLC memo relying on the AUMF to provide legal sanction for President Bush’s systematic flouting of FISA for 2.5 years, Goldsmith relied primarily on the National Emergency Proclamation, and only secondarily on Congress’ sanction of such invocation with the AUMF.

The White Paper released in 2006 largely regurgitating Goldsmith’s opinion for more palatable consumption mentions the AUMF first in its summary, but then repeats Goldsmith’s emphasis on the Proclamation in the background section (see pages 2 and 4).

Paragraphs that may discuss such authorizations get redacted in the 2006 application to move content collection under FISC (see page 6). The entire background section (starting at page 5) of the initial Internet dragnet application is also redacted. While we can’t be sure, given parallel claims made in the same 2004 to 2006 period, it seems likely those memoranda also repeated this formula.

Such a formula was definitely dropped. The 2006 memorandum in support of using Section 215 to create a phone dragnet included no mention of authorities. The 2007 memorandum to compel Yahoo to fulfill Protect American Act orders cites PAA, not Emergency Declarations.

But the formula was retained in all discussions of the Administration’s illegal wiretap program in secret declarations submitted in court in 2006, 2007, and 2009, being repeated again in an unclassified 2013 declaration. While these declarations likely all derive, at least in part, from Goldsmith’s memo, it’s worth noting that the government has consistently suggested it could conduct significant surveillance programs without Congressional sanction by pointing to the that National Emergency Proclamation.

This is the precedent I meant to invoke when I expressed concern about President Obama’s expansive Executive Order of the other day, declaring a National Emergency because of cybersecurity.

Ranking House Intelligence Member Adam Schiff’s comment that Obama’s EO is “a necessary part of responding to the proliferation of dangerous and economically devastating cyber attacks facing the United States,” but that it will be “coupled with cyber legislation moving forward in both houses of Congress” only adds to my alarm (particularly given Schiff’s parallel interest in giving Obama soft cover for his ISIL AUMF while having Congress still involved).  It sets up the same structure we saw with Stellar Wind, where the President declares an Emergency and only a month or so later gets sanction for and legislative authorization for actions taken in the name of that emergency.

And we know FISC has been amenable to that formula in the past.

We don’t know that the President has just rolled out a massive new surveillance program in the name of a cybersecurity Emergency (rooted in a hack of a serially negligent subsidiary of a foreign company, Sony Pictures, and a server JP Morgan Chase forgot to update).

We just know the Executive has broadly expanded surveillance, in secret, in the past and has never repudiated its authority to do so in the future based on the invocation of an Emergency (I think it likely that pre FISA Amendments Act authorization for the electronic surveillance of weapons proliferators, even including a likely proliferator certification under Protect America Act, similarly relied on Emergency Proclamations tied to all such sanctions).

I’m worried about the Cyber Intelligence Sharing Act, the Senate version of the bill that Schiff is championing. But I’m just as worried about surveillance done by the executive prior to and not bound by such laws.

Because it has happened in the past.

Update: In his October 23, 2001 OLC memo authorizing the President to suspend the Fourth Amendment (and with it the First), John Yoo said this but did not invoke the September 14, 2001 proclamation per se.

As applied to the present circumstances, the [War Powers Resolution] signifies Congress’ recognition that the President’s constitutional authority alone enables him to take military measures to combat the organizations or groups responsible for the September 11 incidents, together with any governments that may have harbored or supported them, if such actions are, in his judgment, a necessary and appropriate response to the national emergency created by those incidents.

Update: Thanks to Allen and Joanne Leon for the suspend/suspect correction.