New Documents Suggest IRS Reads Emails Without a Warrant
By Nathan Freed Wessler | ACLU | April 10, 2013
Everyone knows the IRS is our nation’s tax collector, but it is also a law enforcement organization tasked with investigating criminal violations of the tax laws. New documents released to the ACLU under the Freedom of Information Act reveal that the IRS Criminal Tax Division has long taken the position that the IRS can read your emails without a warrant—a practice that one appeals court has said violates the Fourth Amendment (and we think most Americans would agree).
Last year, the ACLU sent a FOIA request to the IRS seeking records regarding whether it gets a warrant before reading people’s email, text messages and other private electronic communications. The IRS has now responded by sending us 247 pages of records describing the policies and practices of its criminal investigative arm when seeking the contents of emails and other electronic communications.
So does the IRS always get a warrant? Unfortunately, while the documents we have obtained do not answer this question point blank, they suggest otherwise. This question is too important for the IRS not to be completely forthright with the American public. The IRS should tell the public whether it always gets a warrant to access email and other private communications in the course of criminal investigations. And if the agency does not get a warrant, it should change its policy to always require one.
The IRS and Email: Reading Between the Lines
The federal law that governs law enforcement access to emails, the Electronic Communications Privacy Act (ECPA), is hopelessly outdated. It draws a distinction between email that is stored on an email provider’s server for 180 days or less, and email that is older or has been opened. The former requires a warrant; the latter does not. Luckily, the Fourth Amendment still protects against unreasonable searches by the government. Accordingly, in 2010 the Sixth Circuit Court of Appeals decided in United States v. Warshak that the government must obtain a probable cause warrant before compelling email providers to turn over messages.
However, the IRS hasn’t told the public whether it is following Warshak everywhere in the country, or only within the Sixth Circuit.
The documents the ACLU obtained make clear that, before Warshak, it was the policy of the IRS to read people’s email without getting a warrant. Not only that, but the IRS believed that the Fourth Amendment did not apply to email at all. A 2009 “Search Warrant Handbook” from the IRS Criminal Tax Division’s Office of Chief Counsel baldly asserts that “the Fourth Amendment does not protect communications held in electronic storage, such as email messages stored on a server, because internet users do not have a reasonable expectation of privacy in such communications.” Again in 2010, a presentation by the IRS Office of Chief Counsel asserts that the “4th Amendment Does Not Protect Emails Stored on Server” and there is “No Privacy Expectation” in those emails.
Other older documents corroborate that the IRS did not get warrants across the board. For example, the 2009 edition of the Internal Revenue Manual (the official compilation of IRS policies and procedures) explains that “the government may obtain the contents of electronic communication that has been in storage for more than 180 days” without a warrant.
Then came Warshak, decided on December 14, 2010. The key question our FOIA request seeks to answer is whether the IRS’s policy changed after Warshak, which should have put the agency on notice that the Fourth Amendment does in fact protect the contents of emails. The first indication of the IRS’s position, from an email exchange in mid-January 2011, does not bode well. In an email titled “US v. Warshak,” an employee of the IRS Criminal Investigation unit asks two lawyers in the IRS Criminal Tax Division whether Warshak will have any effect on the IRS’s work. A Special Counsel in the Criminal Tax Division replies: “I have not heard anything related to this opinion. We have always taken the position that a warrant is necessary when retrieving e-mails that are less than 180 days old.” But that’s just the ECPA standard. The real question is whether the IRS is obtaining warrants for emails more than 180 days old. Shortly after Warshak, apparently it still was not.
The IRS had an opportunity to officially reconsider its position when it issued edits to the Internal Revenue Manual in March 2011. But its policy stayed the same: the Manual explained that under ECPA, “Investigators can obtain everything in an account except for unopened e-mail or voice mail stored with a provider for 180 days or less using a [relevant-and-material-standard] court order” instead of a warrant. Again, no suggestion that the Fourth Amendment might require more.
The first indication that the IRS was considering the effect of Warshak came in an October 2011 IRS Chief Counsel Advice memorandum available on the IRS website but not provided in response to our FOIA request. An IRS employee sought guidance about whether it is proper to use an administrative summons, instead of a warrant, to obtain emails that are more than 180 days old. (The emails in question were located on an internet service provider’s (ISP) server somewhere in the territory covered by the Ninth Circuit Court of Appeals). The memo summarized the holding of Warshak and advised that “as a practical matter it would not be sensible” to seek older emails without a warrant. This is good advice, but the memo’s reasoning leaves much to be desired. The memo explained that Warshak applies only in the Sixth Circuit but that, because the ISP had informed the IRS that it did not intend to voluntarily comply with an administrative summons for emails, there was not “any reasonable possibility that the Service will be able to obtain the contents of this customer’s emails . . . without protracted litigation, if at all.” Any investigative leads contained in the emails would therefore be “stale” by the time the litigation could be concluded, making attempted warrantless access not worthwhile.
The memo misses another chance to declare that agents should obtain a warrant for emails because the Fourth Amendment requires it. Instead, the memo’s advice (which may not be used as precedent and is not binding in other IRS criminal investigations) is limited to situations in the Ninth Circuit where an ISP intends to challenge warrantless requests for emails. The IRS shouldn’t obey the Fourth Amendment only when it faces the inconvenience of protracted litigation; it should recognize that the Fourth Amendment requires warrants for the contents of emails at all times.
Finally, to the present: has the IRS’s position changed this tax season? Apparently not. The current version of the Internal Revenue Manual, available on the IRS website, continues to explain that no warrant is required for emails that are stored by an ISP for more than 180 days. Apparently the agency believes nothing of consequence has changed since ECPA was enacted in 1986, or the now-outdated Surveillance Handbook was published in 1994.
The IRS Owes the American Public an Explanation—and a Warrant Requirement
Let’s hope you never end up on the wrong end of an IRS criminal tax investigation. But if you do, you should be able to trust that the IRS will obey the Fourth Amendment when it seeks the contents of your private emails. Until now, that hasn’t been the case. The IRS should let the American public know whether it obtains warrants across the board when accessing people’s email. And even more important, the IRS should formally amend its policies to require its agents to obtain warrants when seeking the contents of emails, without regard to their age.
(We also sent FOIA requests to the FBI and other components of the Department of Justice—we will be receiving records from those offices in the coming weeks).
Related articles
- Like rest of the feds, the IRS can get your e-mails with no problem (arstechnica.com)
- When a Secretive Stingray Cell Phone Tracking “Warrant” Isn’t a Warrant (alethonews.wordpress.com)
Fatal Payback for Organizing, Mother Says
By IULIA FILIP | Courthouse News | April 9, 2013
GULFPORT, Mississipi – A worker trying to unionize an unsafe workplace was dragged into a conveyor and killed when the plant intentionally left him unattended inside and failed to lock the equipment, his mother claims in court.
Cynthia Hebert sued Omega Protein, ACE American Insurance Co., and ESIS Inc., in Federal Court, seeking damages for the death of her son, Christopher Allen Hebert.
She claims Omega “engaged in intentional conduct designed to bring about injury, or death, to Christopher.”
In the years before he died, Chris Hebert tried to unionize the workers at the unsafe plant, which met “harsh resistance” from management, his mother says in the complaint.
Christopher died on April 9, 2012, at Omega Protein’s Moss Point, Miss. fish-processing plant, according to the complaint.
Houston-based Omega Protein produces omega-3 fish oil and fish meal.
Hebert, 24, had worked at the plant for three years, according to WLOX-TV of Biloxi.
While working in the maintenance department, he reported to his supervisors “what he believed to be unreasonably unsafe and dangerous working conditions,” but management failed to act, according to the complaint.
“Upon information and belief, because Christopher’s reports of unsafe and dangerous work conditions were not acted upon by Omega Protein, Christopher began to discuss with other employees and management the need to unionize the workers at the Moss Point facility,” his mom says in the complaint. “Christopher began the process of unionization by having the employees sign a petition. Christopher believed that unionization of the employees at the Moss Point facility would help to improve the working conditions and eliminate the unsafe and unreasonable dangerous conditions there. Based upon information and belief, Christopher’s efforts to unionize the employees of Omega Protein were met with harsh resistance from the management at Omega Protein. Based on information and belief, Christopher was harassed by the management of Omega Protein for his unionization efforts.
“On April 9, 2012, Christopher reported to work at the Moss Point facility. After arriving at work, he was directed by supervisor Wayne Gray to weld the seams of a newly installed hopper that released fish products into a single screw conveyor at its base. At that time, supervisor Gray assigned an employee to be Christopher’s safety watchperson. This new ‘safety’ watchperson was not the same watchperson Christopher partnered with normally. At the time Christopher began his work, the single screw conveyor equipment remained energized and operational. At the time Christopher began his work, Christopher was unaware that the single screw conveyor was energized and operational. The single screw conveyor was not locked out or otherwise prevented from operating. While Christopher was inside the single screw conveyor, his safety watchperson left without notifying Christopher. After the safety watchperson left, another employee was directed by an Omega Protein supervisor to turn on the single screw conveyor.
“When the single screw conveyor was activated, Christopher was dragged into the machinery feet first. Christopher began screaming for help as the machine dragged him in. Other employees heard Christopher’s screams and arrived at Christopher’s location. Christopher’s last words were ‘I’m dead!’ Christopher died of massive blood loss.
“Based upon information and belief, defendant Omega Protein intentionally chose not to have lockout equipment and safety rules for the single screw conveyor which killed Christopher. Based on information and belief, defendant Omega Protein intentionally left Christopher unattended in the energized and operational single screw conveyor without a safety watchperson. Based upon information and belief, defendant Omega Protein, by and through its employees, engaged in intentional conduct designed to bring about injury, or death, to Christopher.”
Hebert’s mother claims that ACE and ESIS, which provided workers’ compensation insurance to Omega Protein, failed to inspect the plant and implement machinery safety rules.
Omega Protein did not have its own safety rules, and relied on the insurers to design and implement them, according to the complaint.
Hebert’s family seeks compensatory and punitive damages for wrongful death, pain and suffering, negligence, and breach of contract.
It is represented by David Harris Jr. with the Corban Gunn Van Cleave Law Firm of Biloxi.
Omega Protein did not return a request for comment.
Related article
- Omega Protein charged with releasing pollutants (hamptonroads.com)
Palestinian Cameraman Shot In The Face In Bethlehem
By Saed Bannoura | IMEMC & Agencies | April 08, 2013
Bethlehem, Monday April 8, 2013, Palestinian medical sources reported that a Palestinian cameraman was shot in the face, on Monday evening, by a rubber-coated metal bullet, in the Aida refugee camp in the West Bank city of Bethlehem.
The Palestine News Network (PNN) has reported that Mohammad Waleed Al-Azza was shot during clashes that took place between Israeli soldiers invading the camp and local youths who hurled stones at them.
PNN added that Al-Azza, who works at the Refugee Media Center in addition to freelancing for PNN and other agencies, was deliberately shot in the face by the soldiers who tried to stop him from documenting the invasion.
The soldiers tried to push him away, and when he refused to leave, one of the soldiers pointed his gun at him and shot him from a relatively close range.
Al-Azza’s medical condition was described as moderate; he was moved to the Bethlehem Arab Society for Rehabilitation, in Bethlehem, where he will undergo surgery.
The camp has been witnessing an extended wave of escalation since several months now, due to repeated Israeli invasions and attacks against the residents, PNN said.
Several reporters have been injured in recent clashes between the soldiers and the Palestinians in different parts of the occupied West Bank, and occupied East Jerusalem.
Supporters Say All The Wrong Things to Try and Pass CISPA
By Mark M. Jaycox | EFF | April 8, 2013
Ever since reintroducing CISPA, the so-called “cybersecurity bill,” its supporters promote the bill with craftily worded or just plain misleading claims. Such claims have been lobbed over and over again in op-eds, at hearings, and in press materials. One “fact sheet” by Rep. Rogers and Ruppersberger titled “Myth v. Fact” is so dubious that we felt we had to comment.
Here are some of the statements supporters of CISPA are pushing and why they’re false:
Supporters of CISPA say, “There are no broad definitions”
Supporters are keen to note that the bill doesn’t have broad definitions. In the “Myth v. Fact” sheet, the authors of CISPA specifically point to the definition of “cyber threat information.” Cyber threat information is information about an online threat that companies can share with each other and with any government agency—including the NSA. In hearings, experts have said that they don’t need to share personally identifiable information to combat threats. But the definition in the bill allows for any information related to a perceived threat or vulnerability—including sensitive personal information—to be shared. Cyber threat information should be a narrowly defined term.
Another example of a broad (or missing) definition is the term “cybersecurity system.” Companies can use a “cybersecurity system” to “identify or obtain” information about a potential threat (“cyber threat information”). The definition is critical to understanding the bill, but is circular. CISPA defines a “cybersecurity system” as “a system designed or employed” for a cybersecurity purpose (i.e. to protect against vulnerabilities or threats). The language is not limited to network security software or intrusion detection systems, and is so broadly written that one wonders if a “system” involving a tangible item—e.g., locks on doors—could be considered a “cybersecurity system.” In practical terms, it’s unclear what is exactly covered by such a “system,” because the word “system” is never defined.
The best example of a dangerous undefined term in the bill is found within the overly broad legal immunity for companies. The clause grants a company who acts in “good faith” immunity for “any decisions made” based off of the information it learns from the government or other companies. Does this cover decisions to violate other laws, like computer crime laws? Or privacy laws intended to protect users? Companies should not be given carte blanche immunity to violate long-standing computer crime and privacy law. And it is notoriously hard to prove that a company acted in bad faith, in the few circumstances where you would actually find out your privacy had been violated.
Supporters of CISPA say, “The bill is not a government surveillance program”
Supporters are adamant CISPA doesn’t create a wide-ranging “government surveillance program.” It’s true the bill doesn’t create such a surveillance program like the one described in the ongoing warrantless wiretapping lawsuits.
But the trick here is what is meant by “government surveillance.” We think that if the bill aims at having our information flow to the government, it’s tantamount to government surveillance, whether or not the government initially collected the information.
The bill creates a loophole in the privacy laws that prevented companies from disclosing your information to the government and gives companies broad legal immunity for sharing information with the government. As a result, CISPA makes it more likely that companies will surveil their own users and then disclose that information. The sly wording dodges the key issue: that CISPA encourages companies to conduct surveillance on their networks and hand “cyber threat information” to the government. In short, the bill encourages a de facto private spying regime, with the same end result.
Supporters of CISPA say, “The government can’t read your private email”
Reps. Rogers and Ruppersberger are adamant CISPA doesn’t grant the government access to read private emails. The claim was recently repeated by James Lewis, a fellow at the Center for Strategic and International Studies. But the broad definitions do allow for personal information to be gathered by companies and then sent to the government without any mandatory minimization of personal information. And under the vague definitions an aggressive company could claim that private messages are related to the threat, obtain them, and share then with the government. If Reps. Rogers and Ruppersberger did want content of emails disclosed under CISPA, it would be easy enough to exclude them explicitly.
Supporters say, “CISPA follows advice from privacy and civil liberty advocates”
In his introduction of the bill, Rep. Rogers assured the audience that he has listened to the privacy and civil liberties community.
This year’s CISPA does contain some language added after privacy and civil liberties advocates complained in 2012. But those changes didn’t address some big issues that were raised last year, and this year’s privacy and civil liberties complaints about CISPA remain unaddressed.
Let’s Stop CISPA
Reps. Rogers and Ruppersberger are on a strong publicity offensive to make sure the bill passes. The American public deserves full explanations and clear meanings about what CISPA can do and the extent to which it can do it. The public doesn’t need carefully worded messaging materials that obfuscate and mislead a discussion on CISPA. The issues at stake—like the broad legal immunity and new spying powers that allow for companies to collect private, and sensitive, user information—are too serious.
To stop this type of misinformation—and to stop CISPA—we urge you to tell your members of Congress to stand up for privacy.
Related articles
Indiana Supreme Court Rules Tax Money Can be Used to Support Religious Schools; Voucher System Proceeds
By Matt Bewig | AllGov | April 8, 2013
The Indiana Supreme Court on Tuesday unanimously upheld the country’s broadest school voucher program, which gives taxpayer dollars to poor and middle-class families to pay private school tuition, almost exclusively to religious schools. Although school voucher opponents, including the teachers’ union and parents, argued that the program was unconstitutional because nearly all the voucher money has gone to religious schools, the court held that that was irrelevant as long as the money makes a brief stop in the hands of parents before arriving at the religious school or madrasa of their choice.
In making its ruling, the Indiana court was following recent U.S. Supreme Court case law. In the case of Zelman v. Simmons-Harris (2002), the Court narrowly (5-4) overturned prior precedent and created a five-part test that allows public tax money to go to religious schools. Under the test written by the court’s five conservatives at the time, a voucher program is constitutional if: 1) the program has a valid secular purpose; 2) aid goes directly to parents, who then pay schools; 3) a broad class of beneficiaries is covered; 4) the program is facially neutral with respect to religion; and 5) there are adequate nonreligious options.
Although critics cite studies showing that voucher systems drain money from public schools, subsidize overtly sectarian indoctrination, and pay for explicitly false and incorrect instruction in subjects like biology, geology, history and astronomy, the Indiana court abjured any interest in the policy implications of its decision, writing that, “whether the Indiana program is wise educational or public policy is not a consideration,” in the case.
Nationwide, more than 100,000 students in a dozen states, including Florida, Louisiana, Georgia, Ohio and Wisconsin, use vouchers to help pay private school tuition, overwhelmingly at sectarian schools. Similar court cases challenging voucher programs in Colorado and Louisiana are currently pending in the supreme courts of those states.
To Learn More:
School Vouchers Can Fund Religious Education (by Jeff D. Gorman, Courthouse News Service)
Indiana Court Upholds Broadest School Voucher Program (by Stephanie Simon, Reuters)
Meredith v. Pence (Indiana Supreme Court, 2013 (pdf)
Indiana Supreme Court upholds school voucher program (jurist.org)
Canadian police arrest 279 protesters in Montreal
Press TV – April 7, 2013
Hundreds of protesters have been arrested during a demonstration against Canada’s police tactics in the country’s second-largest city of Montreal.
The Friday demonstration was held in protest against the controversial municipal bylaw called P-6, which allows the police to declare a protest event illegal in case no itinerary is given to authorities prior to the protest.
At least 279 protesters were arrested and fined 637 Canadian dollars for participating in an ‘illegal’ protest.
The P-6 also forbids participants to cover their faces during a protest.
Critics say that the P-6 is a form of police repression.
The event on Friday was organized by the Anti-Capitalist Convergence, also known as CLAC, who said the protest was a family-friendly event that aimed to “take back the streets.”
CLAC argues that holding a peaceful gathering is a right within the Canadian Charter of Rights and Freedoms.
Since February, several protests against the P-6 have been held in Montreal, with a total of nearly 600 people arrested and fined.
Israeli military court sentences cartoonist to five months in jail
Palestine Information Center – 06/04/2013
JENIN — The Israeli military court in Salem, north of Jenin, has sentenced Palestinian cartoonist Mohammed Sabana to five months imprisonment on the charge of contacting “hostile parties”.
Family members told the PIC reporter on Saturday that the court passed the sentence on Friday and charged Sabana with making such contacts during his visit to Jordan.
They said that the charges were unfounded, adding that the sentence was illegal and proved the summary trials conducted against Palestinian citizens.
The relatives affirmed that Sabana was not involved with any political party or organization and was just an activist who employs his cartoons in exposing the Israeli occupation’s crimes.
Sabana was arrested on his return from Jordan last February and held for interrogation. His brother, Thamer, was also detained for his pro-prisoners’ activities.
Related articles
- Israel detains Palestinian cartoonist, family says (alethonews.wordpress.com)
- Palestinian Journalists jailed by Israelis (english.pravda.ru)
Report Details Government’s Ability to Analyze Massive Aerial Surveillance Video Streams
By Jay Stanley | ACLU | April 5, 2013
Yesterday I wrote about Dayton Ohio’s plan for an aerial surveillance system similar to the “nightmare scenario” ARGUS wide-area surveillance technology. Actually, ARGUS is just the most advanced of a number of such “persistent wide-area surveillance” systems in existence and development. They include Constant Hawk, Angel Fire, Kestrel (used on blimps in Afghanistan), and Gorgon Stare.
One of the problems created by these systems—which have heretofore been used primarily in war zones—is that they tend to generate a deluge of video footage. A 2010 article says that American UAVs in Iraq and Afghanistan produced 24 years’ worth of video in 2009, and that that number was expected to increase 30-fold (which would be 720 years’ worth) in 2011. Who knows what that’s up to this year, or where it will be by, say, 2025. The human beings who operate these systems can’t possibly analyze all that footage.
In an attempt to solve this problem, Lawrence Livermore Labs has created a system for the military called “Persistics.” It can be used in conjunction with drone (or manned) camera systems such as ARGUS to help manage the vast oceans of video data that are now being generated. The system is
designed to help the Department of Defense and other agencies monitor tens of square kilometers of terrain from the skies, with sufficiently high resolution for tracking people and vehicles for many hours at a time.
That’s from a May 2011 report that I recently came across with the faintly ominous title “From Video to Knowledge.” Produced by Livermore Labs, it contains a lot of interesting detail about Persistics and the problems and solutions involved in massive aerial video surveillance.
The Persistics system consists of algorithms that “analyze the streaming video content to automatically extract items of interest.”
Its analysis algorithms permit surveillance systems to “stare” at key people, vehicles, locations, and events for hours and even days at a time while automatically searching with unsurpassed detail for anomalies or preselected targets.
With Persistics, the report boasts, “analysts can determine the relationships between vehicles, people, buildings, and events.” Among the capabilities touted in the report are:
- “Seamless stitching” together of images from multiple cameras to create “a virtual large-format camera.”
- Stabilizing video (“essential for accurate and high-resolution object identification and tracking”).
- Eliminating parallax (the difference in how an object appears when viewed from slightly different angles).
- Differentiating moving objects from the background.
- The ability to automatically follow moving objects such as vehicles.
- Creating a “heat map” representation of traffic density in order to “automatically discern if the traffic pattern changes.”
- Comparing images taken at different times and automatically detecting any changes that have taken place.
- Super-high “1,000-times” video compression.
- The ability to provide all the locations a particular vehicle was spotted within a given time frame.
- The ability to provide all the vehicles that were spotted at a particular location within a given time frame.
Technologically, according to the report, the Persistics program relies heavily on the explosion in the power of consumer Graphics Processing Units (GPUs) used in video games and the like.
The report also says that the system “is being further enhanced” to work with ARGUS, and includes new details about that system:
Persistics can simultaneously and continuously detect and track the motion of thousands of targets over the ARGUS-IS coverage area of 100 square kilometers. ARGUS-IS can generate several terabytes of data per minute, hundreds of times greater than previous-generation sensors.
Previous reports said that ARGUS could cover 15 square miles; here it reports 100 square kilometers, which is 38.6 square miles. (I suppose we should expect Moore’s Law-like expansion in the capabilities of these systems.)
Of course, the system is designed to store and retrieve all the records and data about everything that it surveils:
Persistics supports forensic analyses. Should an event such as a terrorist attack occur, the archival imagery of the public space could be reviewed to determine important details such as the moment a bomb was placed or when a suspect cased the targeted area. With sufficiently high-resolution imagery, a law-enforcement or military user could one day zoom in on an individual face in a heavily populated urban environment, thus identifying the attacker.
As with every privacy-invading technology designed and/or sold as helping foil terrorists, we have to wonder how long it will be before it’s applied to tracking peace activists.
Future work on Persistics is focused on the kind of behavioral analytics that have been discussed in the context of programs such as “Trapwire.” Livermore scientists, according to the report, are now working on automated methods for identifying “patterns of behavior” that could indicate “deviations from normal social and cultural patterns” and “networks of subversive activity.”
Also under development are efforts to allow the three-dimensional viewing of targets, as well as “methods to overlay multiple sensor inputs—including infrared, radar, and visual data—and then merge data to obtain a multilayered assessment.”
Of course, much of this is unobjectionable from a domestic civil liberties point of view when it’s used as originally intended: on foreign battlefields. The problem comes when the government brings the technology home and turns it inward upon the American people. In fact, at the close of the report, Livermore contemplates exactly that:
Unmanned aircraft have demonstrated their ISR [intelligence, surveillance, and reconnaissance] value for years in Afghanistan and Iraq. As U.S. soldiers return home, the role of overhead video imagery aided by Persistics technology is expected to increase. Persistics could also support missions at home, such as monitoring security at U.S. borders or guarding ports and energy production facilities. Clearly, with Persistics, video means knowledge—and strengthened national security.
Among the federal agencies most interested in the technology, the report says, is DHS.
Related article
- Drone ‘Nightmare Scenario’ Now Has A Name: ARGUS (alethonews.wordpress.com)
