Mike Rogers’ Plan To ‘Stop’ Bulk Collection Of Phone Records Riddled With Dangerous Loopholes That Will Expand Surveillance
By Mike Masnick | Techdirt | April 1, 2014
Now that people have had a chance to go through the proposal by Reps. Mike Rogers and Dutch Ruppersberger to “stop” the bulk phone record collection under Section 215 of the Patriot Act, they’re finding more and more things to be concerned about. We had noted some potential easter eggs in there for law enforcement, but the deeper people look, the worse it gets. Trevor Timm notes that the bill is really a trojan horse to expand surveillance capabilities, while pretending to end them.
Curiously, a large majority of the House bill focuses on new ways for the government to collect data from “electronic communications service providers” – also known as the internet companies. Why is a bill that’s supposedly about ending bulk collection of phone-call data focused on more collection of data from internet companies?
From there, we turn to Julian Sanchez, who has given one of the most thorough explanations of what’s actually in the bill, noting that it fails to really end the bulk collection of phone records while also potentially massively expanding other surveillance capabilities.
First, the HPSCI bill’s seemingly broad prohibition on bulk collection turns out to be riddled with ambiguities and potential loopholes. The fuzzy definition of “specific identifiers” leaves the door open to collection that’s extremely broad even if not completely indiscriminate. Because the provision dealing with “call detail records” applies only to §:215 and the provision dealing with “electronic communications records” excludes telephony records, the law does not bar the bulk collection of telephony records under FISA provisions other than §215. The prohibition on non-specific acquisition of other communications “records” probably does not preclude bulk collection under the FISA pen register provision that was previously used for the NSA Internet metadata dragnet. And, of course, none of these prohibitions apply to National Security Letters. If the government wanted to keep collecting metadata in bulk, it would have plenty of ways to do so within the parameters of this statute given a modicum of creative lawyering—at least if the FISC were to continue being as accommodating as it has been in the past.
Second, something like the novel authority created here may well be necessary to enable fast and flexible acquisition of targeted records without dragnet collection. However, once we get down to details—and even leaving aside the question of ex-post versus ex-ante judicial approval—this authority is in some respects broader than either the current §215 telephony program, the president’s proposal, or the pre-Snowden understanding of the FISA business records authority. Critically, it eliminates the required link to a predicated investigation—which, in the case of U.S. persons, must be for counterterror or counterespionage purposes.
In other words, this appears to be a superficial attempt to end bulk collection “under this program,” while at the same time knocking down a bunch of barriers to much broader bulk collection under other authorities, with less oversight and fewer ways to push back against abuse. Did anyone really expect anything different from the NSA’s two biggest defenders in the House?

AT&T’s First Transparency Report Reveals Warrantless Demands for Customer Data
By Matthew Cagle | ACLU | February 19, 2014
In the wake of our shareholder advocacy, AT&T has now joined Verizon and released its first transparency report. AT&T’s report shows how federal, state, and local governments have requested large volumes of customer information, typically without a warrant. While we welcome AT&T’s move, the American public remains in the dark about a lot of what’s happening behind the scenes. Greater transparency is still needed from AT&T and the federal government.
Here’s a breakdown of the many demands AT&T received in 2013. As we have long suspected, the vast majority of these demands lacked a warrant:
- AT&T received 301,816 demands related to criminal and civil litigation. Only 16,685 of these demands included a warrant based on probable cause.
- AT&T received 223,659 subpoenas for customer information. This is significantly more than the 164,184 subpoenas Verizon received during the same period.
- AT&T received 37,839 demands for location information. At least 21,000 of these demands lacked a warrant. AT&T’s full report says a warrant is “almost always required to obtain real-time location information.”
- AT&T also received 1,034 demands for “cell tower searches” last year, some of them compelling the company to identify the numbers of all phones that connected to a specific cell tower during a given period of time. Cell tower information is ripe for misuse—we know of at least one instance where a cell tower request was made for all phones within the vicinity of a planned labor protest.
AT&T also included information on national security requests (though, not the complete story):
- AT&T reported receiving between 2,000 and 3,000 National Security Letters (NSLs) from the federal government for customer information including name, address, length of service, and toll billing records. NSLs do not require prior approval from courts and the government has been criticized for misusing them. 4,000 to 4,999 AT&T customers were affected by NSLs last year. Note: Verizon has not yet revealed how many customers were affected by the NSLs it received.
- AT&T also released information about federal government demands for customer content under the Foreign Intelligence Surveillance Act (FISA), demands that may result in government access to the telephone and Internet communications of US citizens and persons abroad. For the first six months of 2013, AT&T received 0-999 requests for content that ultimately affected 35,000-35,999 customers. In fact, more AT&T customers were affected by FISA content requests in the first half of 2013 than the combined number of Facebook, Google, and Microsoft customers affected by the same sort of requests during that period.
- Unfortunately, the report omits important information on the metadata that the government reportedly obtains from AT&T under the call records program (currently being challenged by the ACLU in federal court). Phone metadata includes the phone numbers of parties to a conversation, a call’s duration, and device identifiers—information that can paint a very detailed picture of private lives. We know that the government justifies its access to phone metadata with a section of the FISA law, yet AT&T’s report states that only 0-999 customers were affected by such “non-content” requests. On its own, this lack of detail misleads the millions of AT&T customers whose phone metadata may be subject to these demands.
In addition to a clearer explanation of national security requests, we hope that AT&T’s future reports will also address the following shortcomings:
- The current report does not include the number of customers or individuals affected by all of the government demands. The company claims that it is “difficult” to tally this information.
- The report does not describe statistics on how often AT&T complies with demands.
- This report includes very limited information about demands from foreign governments.
AT&T’s transparency report, limited in what it reveals, also highlights just how essential it is for privacy laws to be updated in both the national security and law enforcement contexts. Technology has advanced exponentially and our privacy laws are still in the digital dark ages, enabling the government to engage in a largely unsupervised shopping spree of the personal data held by AT&T and other companies. This is why you should tell your member of Congress to support the USA Freedom Act and an update to the federal Electronic Communications Privacy Act. We also urge AT&T to play a larger role by pushing for greater transparency, including far more detail in its future reports, and advocating for stronger privacy protections.
Matthew Cagle is a Volunteer Attorney for Technology and Civil Liberties with the ACLU of Northern California.
Copyright 2014 American Civil Liberties Union of Northern California
Reprinted with permission of the American Civil Liberties Union of Northern California http://www.aclunc.org
Related articles

NSA chief admits govt collected cellphone location data
RT | October 02, 2013
The director of the National Security Agency admitted this week that the NSA tested a program that collected cellphone location data from American citizens starting in 2010, but suspended it shortly after.
Gen. Keith Alexander, the head of both the NSA and the United States Cyber Command, told lawmakers in Washington early Wednesday that the secretive pilot program was taken offline in 2011, but that the intelligence community may someday in the future make plans to routinely collect location data about US citizens.
Alexander briefly discussed the program during a Senate hearing on the Hill early Wednesday that focused on the data provided to the government through the Foreign Intelligence Surveillance Act, or FISA, including programs that were exposed earlier this year by unauthorized disclosures attributed to contractor-turned-leaker Edward Snowden.
Only days earlier, Sen. Ron Wyden (D-Oregon) asked Alexander during a Senate Intelligence Committee hearing if the NSA was collecting location data on American citizens.
“I’m asking, has the NSA ever collected, or ever made any plans to collect, American cell site information?” Wyden asked last Thursday.
The NSA, Alexander responded at the time, “is not receiving cell-site location data and has no current plans to do so.”
During this Wednesday’s hearing, Alexander explained that, “In 2010 and 2011, NSA received samples in order to test the ability of its systems to handle the data format, but that data was not used for any other purpose and was never available for intelligence analysis purposes.”
According to a written copy of the statement obtained by The New York Times before Wednesday’s hearing, Alexander said that location information is not being collected by the NSA under Section 215 of the Patriot Act. Alexander did not discuss if any other laws are being implemented to otherwise allow for the collection and analysis of location data.
Moments after Alexander revealed the pilot program before the Senate committee, he said that the NSA may someday want to seek approval from Washington to revive that initiative as part of a fully functioning intelligence gathering operation.
“I would just say that this may be something that is a future requirement for the country, but it is not right now,” Alexander said.
Alexander’s statement regarding the new defunct program was expected, and obtained by The New York Times moments before Wednesday’s hearing was underway. Times reporter Charlie Savage wrote that morning that information about the pilot project was only recently declassified by Director of National Intelligence James Clapper, and that the draft answer obtained by the paper and later read aloud by Alexander was prepared in case he was asked about the topic.
Still unsatisfied by the intelligence community’s explanation about the collection of cellphone location data, Sen. Wyden supplied the Times with a response suggesting that the truth behind the NSA’s activities isn’t being fully acknowledged by the intelligence community.
“After years of stonewalling on whether the government has ever tracked or planned to track the location of law-abiding Americans through their cellphones, once again, the intelligence leadership has decided to leave most of the real story secret — even when the truth would not compromise national security,” Wyden said.
In March, Wyden asked Clapper to say if the NSA was collecting personal information on millions of Americans. The intelligence director dismissed that allegation, then later apologized to the Senate for offering a “clearly erroneous” response.
“Time and time again, the American people were told one thing about domestic surveillance in public forums, while government agencies did something else in private,” Wyden told the Senate Intelligence Committee panel of witnesses last week, which included Alexander, Clapper, and Deputy Attorney General James Cole.
During last week’s meeting, Wyden said he “will continue to explore that because I believe this is something the American people have a right to know whether the NSA has ever collected or made plans to collect cell-site information.”
Related articles
Key Loophole Allows NSA To Avoid Telling Congress About Thousands Of Abuses
By Mike Masnick | Techdirt | August 19, 2013
As we’ve noted, one of the key claims by NSA surveillance defenders was that the program had strong oversight from Congress. However, with the revelations last week about thousands of abuses, it’s become quite clear that this isn’t true. Late on Friday, Rep. Jim Himes, who is on the House Intelligence Committee, claimed that he was unaware of those violations, was told that there were “no abuses” and that these kinds of abuses are unacceptable:
Remember, this isn’t just a Congressional Rep, but a member of the Intelligence Committee, who is in charge of overseeing the NSA surveillance program. Hell, he’s even on the oversight subcommittee, and no one told him about any abuses, despite thousands happening per year. That’s astounding, and highlights how the claims of Congressional oversight are clearly bogus. Furthermore, it makes a mockery of the statement that House Intelligence Committee chair Mike Rogers put out on Friday, claiming that “The Committee has been apprised of previous incidents.” Himes says that’s completely untrue.
How is this happening? Marc Ambinder explains the “loophole” that the NSA has used to avoid telling Congress about these abuses. It’s a bit convoluted, but basically, the NSA believes that Congressional oversight only covers spying done under FISA — the law that covers any spying done on Americans, for which a court order is needed. FISA doesn’t cover spying on non-US persons (i.e., foreigners who are outside the country at the time of surveillance). And that’s where some of the abuses came in, and the NSA believes that since those aren’t “FISA” related, and Congress is only overseeing “FISA,” they don’t have to report those mistakes.
Since the focus of oversight efforts has been on FISA compliance, NSA gives Congress detailed narratives of violations of the FISA-authorized data sets, like when metadata about American phone records was stored too long, when a wrong set of records was searched by an analyst or when names or “selectors” not previously cleared by FISA were used to acquire information from the databases. In these cases, the NSA’s compliance staff sends incident reports to the Senate Select Committee on Intelligence and the House Permanent Select Committee on Intelligence for each “significant” FISA violation, and those reports include “significant details,” the official said.
But privacy violations of this sort comprise just one third of those analyzed by the inspector general. Of the 2,776 violations reported by the NSA from May 2011 to May 2012, more than two-thirds were counted as E.O. 12333 incidents. And the agency doesn’t provide Congress detailed reports on E.O. 12333 violations.
Now, you can argue these are very different circumstances, but Ambinder points out that’s not really true in many cases:
In some ways, it’s a distinction without a difference: it does not matter to U.S. citizens whether their phone call was accidentally intercepted by an analyst focusing on U.S.-based activities or those involving a foreign country. But the difference is relevant as it keeps Congress uninformed and unable to perform its oversight duties because the NSA doesn’t provide the intelligence committees with a detailed narrative about the latter type of transgressions.
For example, if someone’s e-mails were inadvertently obtained by the NSA’s International Transit Switch Collection programs, it would count as 12333 error and not a FISA error, even though the data was taken from U.S. communication gateways, and NSA would not notify Congress.
So, basically, any “error” that involves spying on Americans doesn’t “count” as an abuse, as far as the NSA tells Congress (who keep claiming they’re in charge of oversight), because they “obtained” it outside the US, and the “error” is considered outside of FISA. That’s a pretty massive loophole through which the NSA can hide its abuse of programs from Congress.
Related articles
- EFF: Leaks Prove NSA Has No Meaningful Oversight – (dslreports.com)
- Uncontrolled by FISA court, NSA commits ‘thousands of privacy violations per year’ (alethonews.wordpress.com)
Uncontrolled by FISA court, NSA commits ‘thousands of privacy violations per year’
RT | August 16, 2013
The National Security Agency broke the law and ignored privacy protections thousands of times in each of the years since Congressional leaders expanded the agency’s power in 2008, according to a new report citing documents leaked by Edward Snowden.
The majority of the violations are related to unauthorized surveillance on Americans or foreigners inside the United States, conditions deemed illegal by executive order, according to a new report from the Washington Post.
The account is based on top-secret documents and a May 2012 internal NSA audit that found 2,776 infractions – including unauthorized collection, storage, access to or distribution of legally protected communications – in the preceding 12 months alone. The audit, originally only meant to be seen by top NSA leaders, only accounted for violations at NSA headquarters at Fort Meade, Virginia, and other locations in the Washington DC region.
Three government sources told the Post that the 2,776 infractions would in fact be much higher had the audit included all NSA data collection centers. Each of the 2,776 violations could have potentially encompassed thousands of communications.
“One key to the Washington Post story,” tweeted journalist Glenn Greenwald, who first published Snowden’s disclosures in June, “the reports are internal, NSA audits, which means high likelihood of both under-counting and white-washing.”
One of the most flagrant examples is a 2008 incident when a “large number” of telephone calls were inadvertently intercepted because a programmer erroneously typed “202” instead of “20,” Egypt’s national calling code, according to a “quality assurance” memorandum never seen by NSA oversight staff.
Another time, the NSA kept 3,032 files they were ordered to destroy by the Foreign Intelligence Surveillance Act (FISA) court. Each individual file included an undisclosed number of telephone call records, according to the Post.
In a separate incident, the NSA failed to notify the FISA court about a new collection method the agency was using for months, at which point the court deemed the method unconstitutional. The agency reportedly “diverted large volumes of international data passing through fiber-optic cables in the United States into a repository where the material could be stored temporarily for processing and selection.”
This finding, and others like it, refutes claims made by NSA chief Keith Alexander and other brass that the government does not store or process the information it collects. As per NSA policy, the number of Americans affected was not disclosed in the top-secret documents.
NSA officials also failed to explain why, with the number of violations lower in 2008 and 2009 than in later years, violations only increased as time went on.
US District Judge Reggie Walton, the chief judge of the FISA court, admitted that the court’s rulings are based only on information provided by the government. Consequently, judges entrusted with determining what the NSA may and may not do are forced to rely on the NSA to prove the government has not and will not overstep its legal bounds.
“The [FISA court] is forced to rely upon the accuracy of the information that is provided to the Court,” Walton wrote to The Washington Post. “The [FISA court] does not have the capacity to investigate issues of noncompliance, and in that respect the [FISA court] is in the same position as any other court when it comes to enforcing [government] compliance with its orders.”
Privacy advocates have previously expressed concern that the court is never informed of many of the violations. Even when the court is informed of the agency’s intentions, however, the judges are sometimes ignored.
A recently declassified Justice Department review from 2009 discovered a “major operational glitch that had led to a series of significant violations of the court’s order and notified the court.” While specifics of the error were not disclosed, problems including the so-called “over-collection” of phone call metadata were reported.
“The problems generally involved the implementation of highly sophisticated technology in a complex and ever-changing communications environment which, in some instances, results in the automated tools operating in a manner that was not completely consistent with the specific terms of the Court’s orders,” a December 2009 memo to the Senate and House intelligence committees stated.
The Washington Post notified the NSA of Thursday’s report before it was published, at which point the agency said it stops mistakes “at the earliest possible moment, implement mitigation measures wherever possible, and drive them down.”
“We’re a human-run agency operating in a complex environment with a number of different regulatory regimes, so at times we find ourselves on the wrong side of the line,” said one senior official who spoke on the condition of anonymity. “You can look at a number in absolute terms that looks big, and you look at it in relative terms, it looks a little different.”
The documents also described a tutorial that NSA collectors and analysts are required to complete. Titled the “Target Analysts Rationale Instructions,” the training instructs employees on how to complete oversight requirements without revealing “extraneous information” to “our FAA overseers,” a reference to the FISA Amendments Act of 2008.
California Senator Dianne Feinstein said she did not receive a copy of the audit until questioned by the Post, despite her position as Senate Intelligence Committee Chairman. She said the committee “can and should do more to independently verify that NSA’s operations are appropriate, and its reports of compliance incidents are accurate.”
The timing of the report comes just after US President Barack Obama defended the NSA’s widespread domestic and foreign surveillance. Obama said the programs were necessary to protect national security and legitimate partly because of comprehensive oversight.
“If you look at the reports – even the disclosures that Mr. Snowden has put forward – all the stories that have been written, what you’re not reading about is the government actually abusing these programs and listening in on people’s phone calls or inappropriately reading people’s emails,” Obama said.
“What you’re hearing about is the prospect that these could be abused. Now, part of the reason they’re not abused is because these checks are in place, and those abuses would be against the law and would be against the orders of the Foreign Intelligence Surveillance Court.”
After the initial report was published Thursday night the Washington Post issued an appendix revealing that after reporters spoke with NSA leadership, the Obama administration refused allow the Post to publish their names or official titles. The explanation from the newspaper is reproduced in full below:
“The Obama administration referred all questions for this article to John DeLong, the NSA’s director of compliance, who answered questions freely in a 90-minute interview. DeLong and members of the NSA communications staff said he could be quoted “by name and title” on some of his answers after an unspecified internal review. The Post said it would not permit the editing of quotes. Two days later, White House and NSA spokesmen said that none of DeLong’s comments could be quoted on the record and sent instead a prepared statement in his name. The Post declines to accept the substitute language as quotations from DeLong. The statement is below.
“We want people to report if they have made a mistake or even if they believe that an NSA activity is not consistent with the rules. NSA, like other regulated organizations, also has a “hotline” for people to report — and no adverse action or reprisal can be taken for the simple act of reporting. We take each report seriously, investigate the matter, address the issue, constantly look for trends, and address them as well — all as a part of NSA’s internal oversight and compliance efforts. What’s more, we keep our overseers informed through both immediate reporting and periodic reporting. Our internal privacy compliance program has more than 300 personnel assigned to it: a fourfold increase since 2009. They manage NSA’s rules, train personnel, develop and implement technical safeguards, and set up systems to continually monitor and guide NSA’s activities. We take this work very seriously.”
Related article
‘Low-level NSA analysts can spy on Americans’
RT :: July 28, 2013
NSA spying programs give access to US citizens’ private data to low-level analysts with little court approval or supervision, says Guardian journalist Glenn Greenwald, who broke the story on Washington’s PRISM surveillance system.
“[PRISM] is an incredibly powerful and invasive tool,” Greenwald told ABC’s ‘This Week.’ The NSA programs are “exactly the type that Mr. Snowden described. NSA officials are going to be testifying before the Senate on Wednesday, and I defy them to deny that these programs work exactly as I’ve said.”
The NSA keeps trillions of telephone calls and emails in their databases which they can access anytime with simple screen programs, he said.
“And what these programs are, are very simple screens, like the ones that supermarket clerks or shipping and receiving clerks use, where all an analyst has to do is enter an email address or an IP address, and it does two things.”
“It searches that database and lets them listen to the calls or read the emails of everything that the NSA has stored, or look at the browsing histories or Google search terms that you’ve entered, and it also alerts them to any further activity that people connected to that email address or that IP address do in the future.”
While the program conducts wiretapping with little court approval or supervision, there are “legal constraints” on surveillance that require approval by the Foreign Intelligence Surveillance Act (FISA) of 1978, in which court judges can secretly review the government’s plans to track suspected terrorists in advance.
“You can’t target [Americans] without going to the FISA court,” Greenwald stressed. “But these systems allow analysts to listen to whatever emails they want, whatever telephone calls, browsing histories, Microsoft Word documents.”
“And it’s all done with no need to go to a court, with no need to even get supervisor approval on the part of the analyst,” he added.
Greenwald will testify before a Congressional committee on Wednesday, along with NSA officials who have previously downplayed Snowden’s claims about the agency’s easy-access data.
PRISM is a mass electronic surveillance data mining program operated by the NSA since 2007. The program was exposed by former NSA contractor Edward Snowden earlier this summer. Snowden leaked information about the program to the media, warning of a far greater extent of mass data collection than the public knew existed. The disclosures were published by The Guardian and The Washington Post on June 6.
Snowden later leaked further information to Greenwald which pertained to mass security operations carried out across the world. He spoke of British spy agency GCHQ, which uses the Tempora surveillance program. The whistleblower also shared information regarding Germany’s cooperation with US intelligence, which reportedly combs through half a billion German phone calls, emails, and text messages on a daily basis.
A call for transparency on surveillance programs
The call for increased oversight and transparency for surveillance programs has been growing, even among supporters of the NSA.
“I do think that we’re going to have to make some change to make things more transparent,” Senator Saxby Chambliss, vice chairman of the Senate Intelligence Committee, told ABC.
Former federal judge James Robertson, who used to grant surveillance orders, said he was shocked to hear of changes to allow broader authorization of NSA programs – such as the monitoring of US phone records. He urged for a reform which would to allow counter-arguments to be heard.
“What FISA does is not adjudication, but approval,” Robertson said, speaking as a witness during the first public hearings into the Snowden revelations. “This works just fine when it deals with individual applications for warrants, but the 2008 amendment has turned the FISA court into an administrative agency making rules for others to follow.”
However, government officials have defended the surveillance initiatives as authorized under law, claiming they are necessary in order to guard the country against terrorist threats.
Following Snowden’s revelations on NSA surveillance, President Barack Obama assured US citizens in June that “nobody is listening to [their] telephone calls.”
He said the surveillance programs monitor phone numbers and the durations of calls, adding that if there are any suspicions and “if the intelligence community then actually wants to listen to a phone call, they’ve got to go back to a federal judge, just like they would in a criminal investigation.”
President Obama added that America is “going to have to make some choices” between privacy and security, warning that the highly publicized programs will make it harder to target terrorists.
Meanwhile, deputy FBI Director Sean Joyce said that the “program is not intentionally used to target any US citizens” and is “key in our counter-terrorism efforts.”
Testifying on Capitol Hill before the House Permanent Select Committee on Intelligence in June, NSA director Gen. Keith Alexander claimed that the NSA’s storage of millions of phone records has thwarted more than 50 terror attacks in more than 20 countries since September 11, 2001. However, evidence of the prevented attacks has not been revealed.
Bills Introduced by Congress Fail to Fix Unconstitutional NSA Spying
By Mark M. Jaycox | EFF | July 15, 2013
In the past two weeks Congress has introduced a slew of bills responding to the Guardian‘s publication of a top secret court order using Section 215 of the PATRIOT Act to demand that Verizon Business Network Services give the National Security Agency (NSA) a record of every customer’s call history for three months. The order was confirmed by officials like President Obama and Senator Feinstein, who said it was a “routine” 90 day reauthorization of a program started in 2007.
Currently, four bills have been introduced to fix the problem: one by Senator Leahy, Senator Sanders, Senators Udall and Wyden, and Rep. Conyers. The well-intentioned bills try to address the Justice Department’s (DOJ) abusive interpretations of Section 215 (more formally, 50 USC § 1861) apparently approved by the reclusive Foreign Intelligence Surveillance Court (FISA Court) in secret legal opinions.
Sadly, all of them fail to fix the problem of unconstitutional domestic spying—not only because they ignore the PRISM program, which uses Section 702 of the Foreign Intelligence Surveillance Act (FISA) and collects Americans’ emails and phone calls—but because the legislators simply don’t have key information about how the government interprets and uses the statute. Congress must find out more about the programs before it can propose fixes. That’s why a coalition of over 100 civil liberties groups and over half a million people are pushing for a special congressional investigatory committee, more transparency, and more accountability.
More Information Needed
The American public has not seen the secret law and legal opinions supposedly justifying the unconstitutional NSA spying. Just this week the New York Times and Wall Street Journal (paywall) reported that the secret law includes dozens of opinions—some of which are hundreds of pages long—gutting the Fourth Amendment. The special investigative committee must find out necessary information about the programs and about the opinions. Or, at the very least, extant committees like the Judiciary or Oversight Committees must conduct more open hearings and release more information to the public. Either way, the process must start with the publication of the secret legal opinions of the FISA Court, and the opinions drafted by the Department of Justice’s Office of Legal Counsel (OLC).
Why the Legislation Fails to Fix Section 215
Some of the bills try to narrow Section 215 by heightening the legal standard for the government to access information. Currently, the FBI can obtain “any tangible thing”—including, surprisingly, intangible business records about Americans—that is “relevant”
to an authorized investigation to obtain foreign intelligence information not concerning a US person or to protect against international terrorism or clandestine intelligence activities
with a statement of facts showing that there are “reasonable grounds to believe” that the tangible things are “relevant” to such an investigation. Bills by Rep. Conyers and Sen. Sanders attempt to heighten the standard by using pre-9/11 language mandating “specific and articulable facts” about why the FBI needs the records. Rep. Conyers goes one step further than Sen. Sanders by forcing the FBI to include why the records are “material,” or significantly relevant, to an investigation.
By heightening the legal standard, the legislators intend for the FBI to show exactly why a mass database of calling records is relevant to an investigation. But it’s impossible to know if these fixes will stop the unconstitutional spying without knowing how the government defines key terms in the bills. The bills by Sen. Leahy and Sens. Udall and Wyden do not touch this part of the law.
Failure to Stop the Unconstitutional Collection of “Bulk Records”
Sens. Udall, Wyden, and Leahy use a different approach; their bills mandate every order include why the records “pertain to” an individual or are “relevant to” an investigation. Collectively this aims—but most likely fails—to stop the government from issuing “bulk records orders” like the Verizon order. Senator Sanders travels a different path by requiring the government specify why “each of” the business records is related to an investigation; however, it’s also unclear if this stops the spying. Yet again, Rep. Conyers’ bill provides the strongest language as it deletes ambiguous clauses and forces all requests “pertain only to” an individual; however even the strongest language found in these bills will probably not stop the unconstitutional spying.
Legislators Are Drafting in the Dark
Unfortunately, legislators are trying to edit the statutory text before a thorough understanding of how the government is using key definitions in the bill or how the FISA Court is interpreting the statute. For instance, take the word “relevant.” The “tangible thing” produced under a Section 215 order must be “relevant” to the specific type of investigation mentioned above. But the Verizon order requires every Verizon customer’s call history.
The New York Times confirmed the secret FISA court was persuaded by the government that this information is somehow relevant to such an investigation. The Wall Street Journal (paywall), quoting “people familiar with the [FISA Court] rulings” wrote: “According to the [FISA Court], the special nature of national-security and terrorism-prevention cases means ‘relevant’ can have a broader meaning for those investigations.” Obviously, only severely strained legalese—similar to the Department of Justice’s re-definition of “imminent“—could justify such an argument. And the Fourth Amendment was created to protect against this exact thing—vague, overbroad “general warrants” (.pdf).
If “relevant” has been defined to permit bulk data collection, requiring more or better facts about why is unlikely to matter. Even Sen. Sanders’ approach—which would require “each” record be related to an investigation—could fall short if “relevance” is evaluated in terms of the database as a whole, rather than its individual records. This is just one example of why the secret FISA Court decisions and OLC opinions must be released. Without them, legislators cannot perform one of their jobs: writing legislation.
Congress Must Obtain and Release the Secret Law
The actions revealed by the government strike at the very core of our Constitution. Further, the majority of Congress is unaware about the specific language and legal interpretations used to justify the spying. Without this information, Congress can only legislate in the dark. It’s time for Congress to investigate these matters to the fullest extent possible. American privacy should not be held hostage by secrecy. Tell Congress now to push for an special investigative committee, more transparency, and more accountability.
Related article
- FISA court process must be unveiled (politico.com)
A Secret Court Making Secret Laws? That’s No Democracy
By Mike Masnick | TechDirt | July 8th 2013
Last December, well before the Ed Snowden leaks revealed some information about the FISA court (FISC) and its rulings, we had already noted that the court itself was almost certainly unconstitutional. More recently, we talked about how the fact that all the court’s judges are appointed by the Chief Justice of the Supreme Court means that the court has turned into a rubber stamp made in the image of some of the most “law and order”-minded Chief Justices from the past few decades. Ezra Klein has since expanded on that to discuss the oddity of how current Chief Justice John Roberts is basically the Chief Justice of the Surveillance State, answerable to absolutely no one: “You have exclusive, unaccountable, lifetime power to shape the surveillance state.”
Over the weekend, the NY Times put out a powerful piece discussing how FISC has basically become a shadow Supreme Court, doling out all sorts of important rulings in total secrecy. It rules on cases where it only hears one side, and where there are no appeals, no guarantee that the full story is presented, and involves a bunch of judges who tend to have law enforcement backgrounds before being appointed to the court. In the end, you have a secret court issuing secret rulings by ex-law enforcement officials, allowing their former colleagues ever greater power to spy on everyone.
The 11-member Foreign Intelligence Surveillance Court, known as the FISA court, was once mostly focused on approving case-by-case wiretapping orders. But since major changes in legislation and greater judicial oversight of intelligence operations were instituted six years ago, it has quietly become almost a parallel Supreme Court, serving as the ultimate arbiter on surveillance issues and delivering opinions that will most likely shape intelligence practices for years to come, the officials said.
[….] Unlike the Supreme Court, the FISA court hears from only one side in the case — the government — and its findings are almost never made public. A Court of Review is empaneled to hear appeals, but that is known to have happened only a handful of times in the court’s history, and no case has ever been taken to the Supreme Court. In fact, it is not clear in all circumstances whether Internet and phone companies that are turning over the reams of data even have the right to appear before the FISA court.
As an example of how FISC has basically completely overturned the rules of surveillance in secret, the NY Times reveals the details of some of its thinking, taking a extremely narrow ruling meant to apply in special cases, and turning it into a general rule that has allowed the vast capture of information:
In one of the court’s most important decisions, the judges have expanded the use in terrorism cases of a legal principle known as the “special needs” doctrine and carved out an exception to the Fourth Amendment’s requirement of a warrant for searches and seizures, the officials said.
The special needs doctrine was originally established in 1989 by the Supreme Court in a ruling allowing the drug testing of railway workers, finding that a minimal intrusion on privacy was justified by the government’s need to combat an overriding public danger. Applying that concept more broadly, the FISA judges have ruled that the N.S.A.’s collection and examination of Americans’ communications data to track possible terrorists does not run afoul of the Fourth Amendment, the officials said.
That legal interpretation is significant, several outside legal experts said, because it uses a relatively narrow area of the law — used to justify airport screenings, for instance, or drunken-driving checkpoints — and applies it much more broadly, in secret, to the wholesale collection of communications in pursuit of terrorism suspects. “It seems like a legal stretch,” William C. Banks, a national security law expert at Syracuse University, said in response to a description of the decision. “It’s another way of tilting the scales toward the government in its access to all this data.”
I don’t care where you come down on the importance of widespread surveillance — I just don’t see how you can possibly square the above interpretation of the law with the 4th Amendment. If “special needs” can be used to justify mass collection of data on just about everyone “just in case” it might stop some sort of terrorist attack, then you no longer have a 4th Amendment. At all.
But, the bigger issue here is just the fact that we have a secret court issuing secret interpretations of the law that have a massive impact on our privacy. This is supposed to be an open democracy. An open democracy doesn’t involve secret courts and secret laws. We have laws that everyone knows, and which the public can discuss and weigh in on through their elected officials. When you set up a secret court, making secret rules with no oversight, and with all of the judges appointed by a single Supreme Court Justice with a particular bias, you no longer have a functioning democracy at all. And that’s downright scary.
This is a point that some Senators have been making for years now, but the leaks from Ed Snowden have really made it that much clearer just how insane the situation is. Earlier, it had seemed like perhaps there was one or two rulings from FISC that had some oddities in the interpretation, and which should probably be revealed to the public. However, the various revelations so far suggest that the issue is much, much bigger, and we have a secret “shadow court” system that is systematically obliterating the 4th Amendment and helping to create and then “legitimize” the vast surveillance state.
The Snowden leaks have shone a number of lights on various bad things within our government, but one thing that they have made abundantly clear is that the FISC needs to go. Whether that means it needs to be opened up, or to have greater oversight, or just be done away with completely, could be up for discussion. But if it remains the way it is, it’s clear that we’ve thrown away our basic democratic principles, and moved towards the same sorts of autocratic regimes with secret courts that the US has always presented itself as being against.
Related article
- Five unanswered questions about the NSA’s surveillance programs (alethonews.wordpress.com)
Five unanswered questions about the NSA’s surveillance programs
By Brendan Sasso | The Hill | 07/07/13
Leaks by former National Security Agency contractor Edward Snowden have provided new insight into how the government monitors domestic and foreign communications for threats to national security.
Although the government has disclosed some additional details about the programs in response to the leaks, important questions remain about the nature and scope of the surveillance programs.
Without that additional information, it is impossible to know the extent to which the government is peering into the lives of Americans in the name of national security, according to privacy advocates.
1. What other data is being collected under the Patriot Act?
The first leak from Snowden was a secret court order demanding that Verizon turn over vast batches of “metadata” on its U.S. customers. The data included the time and duration of calls, as well as the phone numbers involved, but not the contents of the conversations. The data collection was authorized under Section 215 of the Patriot Act.
The Director of National Intelligence (DNI) clarified that while the government does obtain data on millions of U.S. phone calls (and from more companies than just Verizon), it only “queries” the database a limited number of times for specific national security reasons.
Michelle Richardson, a legislative counsel for the American Civil Liberties Union (ACLU), questioned whether the NSA is using Section 215 to collect more than just phone records.
“Is it also financial data or Internet records or other things?” she asked. “Knowing now that the court has been so broad in its interpretation, it’s even more important to figure out what else they’re getting.”
Greg Nojeim, a senior counsel for the Center for Democracy and Technology, said the NSA is likely using the Patriot Act to collect the credit card records and IP addresses of millions of people within and outside of the United States.
2. How broad are the programs?
How many people have been spied on through the NSA programs remains unclear. According to the NSA, it queried its massive database of phone records fewer than 300 times in 2012. But the agency did not disclose figures on other years or how many phone numbers were accessed in those queries.
Richardson explained that a single query could be an algorithm that scans the database and returns information on many people.
The other major program revealed by Snowden is the NSA’s Internet surveillance program, called PRISM. Unlike the phone record collection program under the Patriot Act, the NSA uses PRISM to access the contents of communications, such as emails, video chats, photographs and other information.
According to the DNI, the NSA only accesses those online records if there is a “foreign intelligence purpose” and the target is “reasonably believed” to be outside of the U.S. The program is authorized by Section 702 of the Foreign Intelligence Surveillance Act, and the searches require approval by a secret FISA court.
The NSA has not disclosed how many people it has targeted under Section 702 or how many people were spied on incidentally as part of the program.
“We have no idea how many U.S. persons have had their communications swept up,” said Sharon Bradford Franklin, senior counsel for the Constitution Project.
3. What’s the legal rationale?
The NSA has insisted the surveillance programs comply with the law and are overseen by independent FISA courts. But the opinions of those courts are secret, so little is known about how the courts are enforcing privacy protections or why they signed off on certain surveillance methods.
Section 215 of the Patriot Act allows the government to collect business records if they are “relevant” to a terrorism investigation. The FISA courts have determined that that provision allows the NSA to collect records on virtually all phone calls within and outside of the U.S. Why the court determined that so much data is “relevant” to a terrorism investigation remains unclear.
“Generally we don’t know the legal rationale being offered by the administration and being accepted by the FISA court to justify these particular types of surveillance programs,” Bradford Franklin said. “We should not have secret law in a democracy.”
4. Is the NSA still collecting email records?
One of the latest leaks revealed that beginning in 2001, the NSA collected vast amounts of email records. The NSA was able to identify the email accounts that sent and received messages, as well as IP addresses. The data collection did not include the contents of the emails.
The Obama administration confirmed the existence of the program, but said it ended in 2011 for “operational and resource reasons.”
One major question, according to privacy advocates, is whether the government is still able to obtain similar email records through a separate program.
5. Are there other programs that we don’t know about?
Although the NSA has provided some details about the programs leaked by Snowden, it is unclear what other programs exist and how they work together as part of a broad surveillance strategy.
“There’s this giant surveillance superstructure out there that we’re finally getting glimpses of, but there’s still a lot of questions of how does the whole thing work,” Richardson said.
Related articles
The advantages of knowing everything
Xymphora | June 16, 2013
Here we go: “NSA admits listening to U.S. phone calls without warrants”:
“A requirement of the 2008 law is that the NSA “may not intentionally target any person known at the time of acquisition to be located in the United States.” A possible interpretation of that language, some legal experts said, is that the agency may vacuum up everything it can domestically — on the theory that indiscriminate data acquisition was not intended to “target” a specific American citizen.”
Gathering everything is OK. Also:
“Director of National Intelligence Michael McConnell indicated during a House Intelligence hearing in 2007 that the NSA’s surveillance process involves “billions” of bulk communications being intercepted, analyzed, and incorporated into a database.
They can be accessed by an analyst who’s part of the NSA’s “workforce of thousands of people” who are “trained” annually in minimization procedures, he said. (McConnell, who had previously worked as the director of the NSA, is now vice chairman at Booz Allen Hamilton, Snowden’s former employer.)”
As far as the NSA is concerned, gathering everything without warrants is legally permitted, and once they have it, NSA analysts who are ‘trained’ to NSA standards are legally allowed to listen to whatever they want. Gathering everything is actually better than getting a FISA warrant for a particular target.
PRISM is going to take over the entire discussion, and, lo and behold, it is not that bad. Get a few more keys for the ‘lockbox’, and all will be deemed to be well.
The three big questions concerning Total Information Awareness are:
- economic – can we pay to store all this information?;
- technical – can we develop search engines that will allow us to handle all this information without becoming paralyzed by the sheer volume of it (remember that Simon’s big straw man was the ridiculousness of having FBI agents listen to all the conversations!!!), the traditional problem with totalitarian states?; and
- legal – in a country with constitutional protections for basic liberties, how is any of this allowed?
The NSA believes it has an answer to the first two of these problems, and just needs to fool Americans into believing that the presence of those scary Moooooooslims under their beds justifies a bit of bending of the constitution to finesse the legal problem. Some tinkering will be done to PRISM, and everybody will go back to sleep.
The final step will be to continue to expand the exploitation of the information as a method of social control using blackmail or something like blackmail – even the awareness that there is information out there that could be used for blackmail will start to influence behavior, particularly repressing any kind of political protest (not that there is much of that anyway) – and to use the insider information to siphon up whatever wealth is not yet in the hands of the 1% (it is a fun fact that Booz Allen is owned by the Carlyle Group).
Related articles
- Why Did Edward Snowden Go to Hong Kong?
- NSA Document Leak Proves Conspiracy To Create Big Brother Style World Control System
- DOJ launches criminal probe of NSA leaker
- US security officials said NSA leaker, journalist should be ‘disappeared’ – report
- Government Spying: Should We Be Shocked?
- Boundless Informant: NSA’s complex tool for classifying global intelligence
- The NSA’s Favorite Weasel Word To Pretend It’s Claiming It Doesn’t Spy On Americans
- The “Congress knew” defense
- NSA memo pushed to ‘rethink’ 4th Amendment
Leaked: NSA’s Talking Points Defending NSA Surveillance
By Mike Masnick | techdirt | June 14, 2013
The government has been passing around some “talking points” to politicians and the press trying to spin the NSA surveillance story. We’ve got the talking points about scooping up business records (i.e., all data on all phone calls) and on the internet program known as PRISM. Both are embedded below. Let’s dig in on a few of the points, starting with the business records/FISA issue:
The news articles have been discussing what purports to be a classified, lawfully-authorized order that the Foreign Intelligence Surveillance Court (FISA Court) issued under an Act of Congress – the Foreign Intelligence Surveillance Act (FISA). Under this Act, the FISA Court authorized a collection of business records. There is no secret program involved here – it is strictly authorized by a U.S. statute.
“There is no secret program here”? Bullshit. Why, then, have so many people, both in the Congress and the public been shocked at the extent to which the NSA is snarfing up data? This is a secret program, enabled by a secret interpretation of the FISA Amendments Act, by the FISA Court, which the DOJ and the NSA insist the public is not allowed to know. Yes, it’s a secret program. Saying otherwise is simply lying.
It authorizes only metadata collection, which includes barebones records – such as a telephone number or the length of a call.
“Barebones records” and “metadata” are terms being used to play down the extent of the collection of info, but it ignores multiple reports that note the amount of data actually collected — including phone numbers, call times, call location, among other things — is more than enough to identify who someone is and a variety of important characteristics about that person.
This legal tool, as enacted by Congress, has been critical in protecting America. It has been essential in thwarting at least one major terrorist attack to our country in the past few years.
“At least one” is a lot less than the “dozens” NSA boss Keith Alexander recently stated. But, so far the only “one” identified, involving an attempted NYC Subway bombing was shown not to have needed this data collection program to uncover and stop. So, nope.
Despite what appears to be a broad scope in the FISA Court’s order, the Intelligence Community uses only a small fraction of a percent of the business records collected to pursue terrorism subjects.
This is meaningless. That’s like saying, even though we search everyone’s house illegally, we only actually arrest a small number of people. No one would allow such house searches under the 4th Amendment, so why is it okay with phone records?
All three branches – Congress, the Courts, and the Executive Branch – review and sign off on FISA collection authorities. Congress passed FISA, and the Intelligence Committees are regularly and fully briefed on how it is used.
Except many in Congress have made it clear they did not review this kind of program, or were led to believe that the NSA did not collect this kind of information. And those who are being briefed now say the program goes way beyond what they were told. And, those who did know about it beforehand, tried to dig deeper into the program, but were blocked. As for “the Courts” reviewing it, we’re talking about the FISA Court which is a rubberstamp in black robes, having approved every single request of it for the past three years. It last rejected a request back in 2009, and that was only one out of 1320. In its entire history, since 1979, the court has rejected a grand total of 11 applications. 11. Out of 33,939 applications. That’s 0.03%. Not 3%. 0.03% with not a single rejection in over three years. That’s not careful review. That’s a rubber stamp. As for the executive branch signing off on it, what do you expect? They’re going to hold back their own ability to spy on people?
The FISA Court authorizes intelligence collection only after the Intelligence Community has proven its case, based on underlying facts and investigations.
Well, we already covered the rubber stamp issue above, but Section 215 of the Patriot Act requires that the government present a case that the data it is seeking “must be relevant to an authorized preliminary or full investigation to obtain foreign intelligence information not concerning a U.S. person or to protect against international terrorism or clandestine intelligence activities.” I’d love to see the argument that all data is somehow relevant to the investigation. Of course, I can’t see it, because it’s secret.
This legal tool has been reauthorized only after ongoing 90-day renewal periods. That means that every 90 days, the Department of Justice and the FBI must prove to the Foreign Intelligence Surveillance Court that they have the facts and legal basis to renew this legal authority. It is not a rubber stamp.
Ha ha ha. So, we violate your privacy without any opposing view — but we do it every 90 days for seven straight years.
FISA-authorized collections are subject to strict controls and procedures under oversight of the Department of Justice, the Office of the Director of National Intelligence and the FISA Court, to ensure that they comply with the Constitution and laws of the United States and appropriately protect privacy and civil liberties.
What kind of “strict controls and procedures” allow for the collection of every single record of every single phone call, and then also make it accessible to the 29-year-old IT guy in Hawaii? Just wondering…
Moving on to the “NSA internet talking points.”
Section 702 is a vital legal tool that Congress reauthorized in December 2012, as part of the FISA Amendments Act Reauthorization Act, after extensive hearings and debate. Under Section 702, the Foreign Intelligence Surveillance Court (FISA Court) certifies foreign intelligence collection. There is no secret program involved – it is strictly authorized by a U.S. statute.
Again, “no secret program,” merely a secret interpretation of the law, in a secret ruling by a secret court. What’s everyone complaining about?
Section 702 cannot be used to target any U.S. person. Section 702 also cannot be used to target any person located in the United States, whether that person is an American or a foreigner.
Note the careful choice of words: it cannot be used to target a person in the US. It can, however, be used to collect info on a person in the US if they’re not “the target” of the investigation. Fun with words!
The unauthorized disclosure of information about this critical legal tool puts our national security in grave danger, puts Americans at risk of terrorist and cyber attacks, and puts our military intelligence resources in danger of being revealed to our adversaries.
Right. So this is not a new program, it’s no surprise, people shouldn’t be concerned… and now that you know about it we’re all going to die!
How does anyone take these jokers seriously?