Tag Archive for: Upstream surveillance

I’m working through some weedy NSA stuff, and wanted to “handle” a discrete point about a change in NSA’s Section 702 minimization procedures dating to 2012.

Earlier this year, the government provided ACLU with the full Section 702 order from 2012, though ACLU re-released it last week with a bunch of other things (and the opinion makes more sense in conjunction with these releases). Previously, the government had just released the 9 pages of the opinion pertaining to John Bates’ satisfaction that the NSA had properly dealt with all the domestic upstream transactions it had acquired prior to October 31, 2011. The newly unredacted material in the version of the opinion released this year include details about changes to the 702 minimization procedures in 2012, as well as language describing five pages from a November 2011 opinion resolving the upstream surveillance.

NSA starts formally distinguishing between “processing” and “handling” data (without defining the latter in minimization procedures)

One change the government made in 2012 was to distinguish in minimization procedures between data it “processed” and data it “handled.”

“Processing” versus “handling” information. In a number of places in the amended NSA minimization procedures, the government has replaced the term “processed” with the word “handled.” See Amended NSA Minimization Procedures at 9 (§ 5(1)) & 12 (§§ 6(c)(l) & 6(c)(2)). Both the previously-approved NSA minimization procedures and the amended procedures define the terms “processed” or “processing” to mean “any step necessary to convert a communication into an intelligible form intended for human inspection.” Id. at 2 (§ 2(h)). The previously-approved procedures did not uniformly use the terms in a manner consistent with that narrow definition. This clarifying change remedies that inconsistency by using the distinct term “handled” or “handling” to refer to the treatment of communications after they have been rendered intelligible for human inspection. This non-substantive change reduces the potential for confusion and mistake and raises no issue under Section 1801(h).

Now, we can’t see exactly what this change looks like, because we only have the 2011 and 2014 minimization procedures, not the 2012 that implemented this change. In 2011 the minimization procedures mentioned “processing” data 18 times (including the definition) and “handling” it just three times (neither of these minimization procedures define “handling”). By the 2014 minimization procedures, “process” is mentioned just four times (including the two definitional references), and “handl[e]” is mentioned 18 times. As I’ll lay out below, the word processing came to be used exclusively for data manipulation for which the NSA would want plausible deniability regarding the status of US person communications. So I wanted to track all the changes and retentions of the two terms.

Three changes are made immediately

The 2012 and 2013 minimization procedures may have made some interim changes. As noted, the opinion cites just three passages of what would become the 2012 minimization procedures where the language changed.

The first, at page 9§5(1) in the 2014 minimization procedures, is part of the language changed in 2012 to allow NSA to keep and play with domestic communications that have significant foreign intelligence value, as opposed to just handing it on to FBI. [my emphases, using bold for things changed to “handle” and italics for things that remain “process” throughout]

such domestic communication is reasonably believed to contain significant foreign intelligence information. Such domestic communication (and, if applicable, the transaction in which it is contained) may be retained, handled, and disseminated in accordance with these procedures;

And on page 13 at §§ 6(c)(l) & 6(c)(2), which permit the sharing of information with CIA and FBI.

(1) (U) NSA may provide to the Central Intelligence Agency (CIA) unminimized communications acquired pursuant to section 702 of the Act. CIA will identify to NSA targets for which NSA may provide unminimized communications to CIA. CIA will handle any such unminimized communications received from NSA in accordance with CIA minimization procedures adopted by the Attorney General, in consultation with the Director of National Intelligence, pursuant to subsection 702(e) of the Act.

(2) (U) NSA may provide to the FBI unminimized communications acquired pursuant to section 702 of the Act. The FBI will identify to NSA targets for which NSA may provide unminimized communications to the FBI. The FBI will handle any such unminimized communications received from NSA in accordance with FBI minimization procedures adopted by the Attorney General, in consultation with the Director of National Intelligence, pursuant to subsection 702(e) of the Act.

Handle got introduced in the discussion of transactions

But, as noted above, either the NSA made the “process” to “handle” change in far more places in 2012 than noted in the opinion or it continued to change things from “process” to “handle” between 2012 and 2014.

To begin with, in 2011 there were already three uses of the word “handle.” Those were all in the discussion on how to deal with upstream transactions, and so would have been new in 2011.

On page 4, §3(b)(5)(a)(1)(b), which discusses how the NSA should treat multiple communication transactions (MCTs) that have been reviewed and moved into more generally accessible repositories.

Any information moved or copied from the segregated repository into repositories more generally accessible to NSA analysts will be processed in accordance with subsection 3(b)(5)(b) below and handled in accordance the other applicable provisions of these procedures.

On page 5, §3(b)(5)(a)(2), which discusses upstream communications that are not segregated as MCTs most likely to include US person transactions.

Internet transactions that are not identified and segregated pursuant to subsection 3(b)(5)a. will be processed in accordance with subsection 3(b)(5)(b) below and handled in accordance with the other applicable provisions of these procedures.

And on page 5, §3(b)(5)(b)(2)(a), which explains that if an analyst wants to use a communication within a transaction that involves the actual selector that identified the communication, the analyst can treat US person information as it would normally (that is, as incidental communication).

If the discrete communication is to, from, or about a tasked selector, any U.S. person information in that communication will be handled in accordance with the applicable provisions of these procedures.

The transition from “process” to “handle” may have happened in interim minimization procedures

So the minimization procedures started to move to “handle” in 2011, at least three more instances did so in 2012, but by the 2014 minimization procedures, “process” is retained just four times (including the two definitional references). The two remaining non-definitional uses of processing are page 4, §3(b)(4)(a)(1), which effectively permits an exception to the segregation rules on upstream MCTs in order to render upstream collection intelligible to analysts.

Notwithstanding subsection 3(b)(4)a. above, NSA may process Internet transactions acquired through NSA upstream collection techniques in order to render such transactions intelligible to analysts.

In 2011, this was the introduction of the following clause, though it defined processing as “(e.g., decryption, translation).”

And page 14 §8(b), which permits NSA to share information with foreign governments for technical and linguistic assistance.

It is anticipated that NSA may obtain information or communications that, because of their technical or linguistic content, may require further analysis by foreign governments to assist NSA in determining their meaning or significance. Notwithstanding other provisions of these minimization procedures, NSA may disseminate computer disks, tape recordings, transcripts, or other information or items containing unminimized information or communications acquired pursuant to section 702 to foreign governments for further processing and analysis, under the following restrictions with respect to any materials so disseminated:

The other mentions of processing that get lost between 2011 and 2014 are §3(b)(1), which takes out a reference to the “processing cycle.”  §3(b)(3) provides explicit permission to process magnetic tapes or other storage media.

Finally, one use of “process” got dropped at §3(b)(4). In 2011, the passage stated that only domestic transactions that are fit the retention exception may be “processed,” a meaning which would now be handled. But the 2011 clause still permitted other transactions to be “retained or disseminated,” according to the procedures.

2011:

As a communication is reviewed, NSA analyst(s) will determine whether it is a domestic or foreign communication to, from, or about a target and is reasonably believed to contain foreign intelligence information or evidence of a crime. Only such communications may be processed. All other communications may be retained or disseminated only in accordance with Sections 5, 6, and 8 of these procedures.

2014:

As a communication is reviewed, NSA analyst(s) will determine whether it is a domestic or foreign communication to, from, or about a target and is reasonably believed to contain foreign intelligence information or evidence of a crime for purposes of assessing how the communication should be handled in accordance with these procedures.