Posts

Adam Schiff Makes Clear FBI Is Using Section 215 Like the 2014 Exception

/19 Comments/in , /by

For months, Congress has been debating the reauthorization of Section 215 of the PATRIOT Act. The House passed a compromise bill before COVID shut-downs really halted everything in Congress, though did so in such a way as to prevent Zoe Lofgren from offering any amendments. After the Senate failed to act, the provision (and two related ones lapsed). Then, a few weeks ago, the Senate passed a version that added an amendment from Mike Lee and Patrick Leahy that strengthened the amicus to the previously passed House bill. But an amendment offered by Ron Wyden and Steve Daines failed by one vote after Tom Carper said that Pelosi had warned him its passage would gut FISA (and after Bernie Sanders and Patty Murray didn’t make it for the vote). The operative language of their amendment read,

(C) An application under paragraph (1) may not seek an order authorizing or requiring the production of internet website browsing information or internet search history information.

Zoe Lofgren and Warren Davidson tried to pass that amendment in the House. Over a weekend of heated negotiations, they limited the Wyden-Daines language to apply just to US persons.

(C) An application under paragraph (1) may not seek an order authorizing or requiring the production of internet website browsing information or internet search history information of United States persons.

At first, Wyden endorsed the Lofgren-Davidson language. Except then Adam Schiff gave Charlie Savage a statement that suggested the amendment would only prevent the government from seeking to obtain Americans’ internet information, not prevent it altogether.

But in his own statement, Mr. Schiff put forward a narrower emphasis. Stressing the continued need to investigate foreign threats, he described the compromise as banning the use of such orders “to seek to obtain” an American’s internet information.

That led Ron Wyden to withdraw his support. Leadership withdrew that amendment from the Rule.

Schiff’s ploy seems to suggest one way the government is using Section 215.

Wyden had previously asked how each of three applications for Section 215 would appear in counts:

  • An order in which an IP address used by multiple people is the target
  • An order collecting all the people who visit a particular website
  • An order collecting all the web browsing and internet searches of a single user

I’ve argued in the past that the FBI wouldn’t go to the trouble of a Section 215 order for a person who was not otherwise targeted, the last bullet. Schiff’s willingness to limit collection to foreigners is consistent with that (because targeting non-US persons has a lower probable cause level), meaning that’s not the function the government is so intent on preserving.

Which leaves Wyden’s IP address used by multiple people and a website, what I have suggested might be VPNs and WikiLeaks. Those are the applications that Schiff (and Pelosi) are going to the mat to protect.

That makes something that happened in 2014 important. That year, FISC permitted the government to remain tasked on a selector under 702 (which can only target foreigners) even after finding that Americans were using the selector, provided the US person content was purged after the fact. Except ODNI made a list of enumerated crimes — virtually all of which exploit the Dark Web — that Section 702 content could be used to prosecute. Richard Burr codified that principle when the law was reauthorized in 2017.

Schiff has invoked the same principle — allowing the FBI to target a URL or IP, and in the name of obtaining foreign intelligence, obtaining the US person activity as well. Because this is not treated as “content,” the government may not be limited to instances where the US person activity is location obscured (though it’s possible this is just about obtaining VPN traffic, and not something like WikiLeaks).

Wyden called the resulting practice (remember, this is status quo), as “dragnet surveillance.”

“It is now clear that there is no agreement with the House Intelligence Committee to enact true protections for Americans’ rights against dragnet collection of online activity, which is why I must oppose this amendment, along with the underlying bill, and urge the House to vote on the original Wyden-Daines amendment,” Wyden said.

So once again — still — the government is using a foreign targeted law to obtain leads of Americans to investigate. That, apparently, is what Pelosi considers the key part of FISA: honey pots to identify Americans to investigate.

Meanwhile, DOJ doesn’t even like the changes Lee and Leahy implemented, falsely claiming that the law — which requires DOJ to meet the standards laid out voluntarily by FBI’s response to the DOJ IG Report — does nothing to address the problems identified by the IG Report.

The Department worked closely with House leaders on both sides of the aisle to draft legislation to reauthorize three national security authorities in the U.S.A. Freedom Act while also imposing reforms to other aspects of FISA designed to address issues identified by the DOJ Inspector General. Although that legislation was approved with a large, bipartisan House majority, the Senate thereafter made significant changes that the Department opposed because they would unacceptably impair our ability to pursue terrorists and spies. We have proposed specific fixes to the most significant problems created by the changes the Senate made. Instead of addressing those issues, the House is now poised to further amend the legislation in a manner that will weaken national security tools while doing nothing to address the abuses identified by the DOJ Inspector General.

Accordingly, the Department opposes the Senate-passed bill in its current form and also opposes the Lofgren amendment in the House. Given the cumulative negative effect of these legislative changes on the Department’s ability to identify and track terrorists and spies, the Department must oppose the legislation now under consideration in the House. If passed, the Attorney General would recommend that the President veto the legislation.

Trump, meanwhile, is opposing the bill because it doesn’t go far enough.

WARRANTLESS SURVEILLANCE OF AMERICANS IS WRONG!

Republicans are inventing reasons to oppose it after supporting it in March.

Back in March, Billy Barr said he could do what he needed to with EO 12333. It’s unclear how he’d coerce providers.

But Schiff’s efforts to defeat Wyden make it clear this is a function designed to identify Americans.

Update: I had thought a current vote was on FISA, but is on China sanctions, so I’ve deleted.

Ron Wyden Hints at How the Intelligence Community Hides Its Web Tracking Under Section 215

/2 Comments/in /by

Ron Wyden had an amendment to Section 215 that would have limited the use of that provision to obtain web traffic information that fell one vote short in the Senate, partly because Nancy Pelosi whipped Tom Carper against it and partly because two Senators (Bernie Sanders and Patty Murray) didn’t get back for a vote. In an effort to resuscitate the amendment in the House under Zoe Lofgren and Warren Davidson’s leadership (which would surely pass if Section 215 got bounced back to the Senate), Ron Wyden released a letter to Ric Grenell trying to force some transparency about how the IC hides the scope of the use of Section 215 to get web search and Internet traffic information.

The letter asks Grenell to explain how Section 215 orders served on IP addresses, rather than email addresses, might get counted in transparency provisions.

How would the government apply the public reporting requirements for Section 215 to web browsing and internet searches? In this context, would the target or “unique identifier” be an IP address?

If the target or “unique identifier” is an IP address, would the government differentiate among multiple individuals using the same IP address, such as family members and roommates using the same Wi-Fi network, or could numerous users appear as a single target or “unique identifier”?

If the government were to collect web browsing information about everyone who visited a particular website, would those visitors be considered targets or “unique identifiers” for purposes of the public reporting? Would the public reporting data capture every internet user whose access to that website was collected by the government?

If the government were to collect web browsing and internet searches associated with a single user, would the public reporting requirement capture the scope of the collection? In other words, how would the public reporting requirement distinguish between the government collecting information about a single visit to a website or a single search by one person and a month or a year of a person’s internet use?

Wyden here lays out three use cases for how the IC might (one should assume does) use Section 215 to get web traffic.

  • An order in which an IP address used by multiple people is the target
  • An order collecting all the people who visit a particular website
  • An order collecting all the web browsing and internet searches of a single user

The government is required to report:

(5)the total number of orders issued pursuant to applications made under section 1861(b)(2)(B) of this title and a good faith estimate of—

(A)the number of targets of such orders; and

(B)the number of unique identifiers used to communicate information collected pursuant to such orders;

Taking each of his three scenarios, here’s what I believe the government would report.

An order in which an IP address used by multiple people is the target

In the first scenario, the government is trying to obtain everyone who “uses” a particular IP address. The scenario laid out by Wyden is a WiFi router used by family or friends, but both because the House Report prohibited such things in 2015 and because DOJ IG has raised questions about targeting everyone who uses a Friends and Family plan, I doubt that’s what the IC really does.

Rather, I suspect this is about VPNs and other servers that facilitate operational security. The government could hypothetically obtain four orders a year getting “VPNs,” requiring providers of each of the 10 major VPNs in the country to provide the IP addresses of all the incoming traffic, which would show the IP addresses of everyone who was using their location obscuring traffic.

In such a case, the targeted VPN IP addresses wouldn’t be communicating information at all. The users would get no information back. Therefore, the IC would only report the number of targets of such orders. If the “target” were defined as VPN, the number would be reported as 4 (for each of the 4 orders); if the “target” were defined as the specific VPN providers, the number of targets would be reported as 10.

The IC would entirely hide the number of individual Americans affected.

An order collecting all the people who visit a particular website

This application would seek to learn who visited a particular website. The classic case would be Inspire magazine, the AQAP propaganda. But I could also see how the IC might want to collect people who visit WikiLeaks’ submission page, or any number of sites that would offer information of interest to foreign spies (even DNI’s report on surveillance collection!). In such a use case, the government might ask not for the information provided to the user, but instead the incoming IP addresses of every request to the website. Again, this would not reflect a communication of information (and certainly not to the end user), so would not be reported under 5B.

If the targets were defined as “AQAP propaganda sites,” Inspire and all its affiliates might be reported as just one target (or might even be counted on a more generalized 215 order targeting AQAP or WikiLeaks, and so not as a unique 215 order at all).

The end users here would, again, not be counted if the collection request deliberately asked for something that did not “communicate information,” though I’m not sure precisely what technical language the government would use to accomplish this.

An order collecting all the web browsing and internet searches of a single user

This use case would ask how a 215 order targeting an individualized target (like Carter Page) shows up in transparency reports. If this were an order served on Google targeting a single account identifier for Google (say, Page’s Gmail account), the government might treat that Gmail identifier as the unique identifier, even though the government was getting information on every time this unique identifier obtained information.

Even in the criminal context, prosecutors don’t always target Google histories (for example, they did not with Joshua Schulte, and so got Google searches going back to before he joined the CIA). In the intelligence context, the FBI is given even more leeway to obtain everything, based off the logic that it’s harder to find clandestine activity.

In other words, Wyden has pointed to three use cases, all of which the IC is surely using, which existing transparency reporting requirements would entirely obscure the impact of.