upstream collection – Techdirt (original) (raw)

Reporting Mandates Likely The Reason Behind The FBI’s Sudden Drop-Off In Section 702 Abuses

from the inadvertent-deterrent dept

Earlier this month, we reported (via Charlie Savage of the New York Times) that the FBI had finally delivered its first reduction in Section 702 abuses in the entirety of its access to this particular NSA collection.

The upstream collection touches a tremendous amount of foreign communications. It also captures communications from US persons communicating with foreign persons. The FBI is allowed to access this database to search for evidence to be used in its investigations, but the search process is supposed to deliver minimized information pertaining to US persons. If the FBI wants this information unmasked (to identify the US person involved), it’s supposed to obtain permission from the FISA court or obtain a warrant to perform additional searches of the same US-based source.

It simply has refused to do that for more than a decade. Its refusal to comply with the Fourth Amendment has made it a frequent target of congressional and FISA court criticism. But harsh words haven’t done much to alter how the FBI (mis)handles its access to Section 702 collections.

This continual abuse — along with recent (and opportunistic) Republican complaints about “deep state” thwartery — has managed to finally place Section 702 on the chopping block. Sure, lots was said about surveillance reform following the Snowden leaks, but Section 702 was never really considered expendable. But angry Republicans have a majority in the House at the moment and the desire to finally terminate this surveillance authority.

The FBI has been on its heels for a bit, thanks to some (mostly) specious criticism from one particular former president and its careless handling of investigations targeting GOP-bros like Carter Page. The FBI definitely deserves to have its access curtailed. And even if it’s just a matter of political convenience for Republicans who will almost certainly want this surveillance power back at some point, those of us who have steadily criticized both the FBI and NSA for abuses enabled by this authority won’t be shedding many tears if it’s allowed to expire.

But there’s more to the story than the FBI’s abusive relationship with its surveillance powers and the potential codification of political grandstanding. The severe drop-off in FBI 702 abuses — from 3 million searches in 2021 to only a little over 119,000 this year — isn’t the result of the FBI making incremental changes to comply with the steady drip of FISA mandates. That’s the conclusion Spencer Ackerman has drawn from reading the FISA court decision and other recently released documents pertaining to the FBI’s Section 702 access.

It’s not that the FBI wants to do better. It’s that it can no longer find some way to get away with it. For lack of a better term, the FBI has been shamed into respecting the law.

The FBI’s statements to journalists following the release of these stats assert this is simply the end result of the FBI’s continual quest for excellence and accountability. But if that was truly the case, the drop-off should have begun back in 2018, when the FBI was first handed additional Section 702 restraints and reporting requirements by its oversight and the FISA court. But those efforts failed to nudge the FBI towards “restraint” or “repairing trust,” as FBI officials have recently claimed.

As Ackerman notes, more supposed oversight and more criticism from the FISA court failed to result in any observable change in Section 702 queries between 2018 and 2021. The downturn only occurred after the FBI was handed an additional mandate: to provide its oversight and the FISA court with an accurate accounting of every Section 702 search it performed. (Emphasis in the original.)

As [FISA court judge] Contreras put it in April 2022, before that statistic was collected, “notwithstanding this foreign-directed targeting, the extent to which Section 702 acquisitions involve U.S. persons is substantial in the aggregate.” And he wrote that after the “precipitous decline” in backdoor searches.

But such a “precipitous decline” in searches, resulting from such modest changes, might suggest that the purpose of the FBI’s backdoor searches is what Wyden’s term—“backdoor search”—implies: to evade long-standing legal and Constitutional protections of Americans’ privacy. Once the FBI had to make a record of what it was doing, its officials thought better of performing many, many such searches in the first place.

Deterrence does actually work. The trick is finding out what government agencies like the FBI will actually view as deterrence. Getting verbally smacked around by FISA judges and fielding pointed questions from even dogged, um, watchdogs like Senator Ron Wyden failed to discourage the FBI from engaging in thousands (if not millions) of highly questionable searches.

What did work was demanding the agency account for all of its Section 702 searches. Once it had to provide something other than highly approximate accounting, it apparently decided closer adherence to the law, the Constitution, and the numerous other mandates handed to it over the years might be the best way to go.

The FBI can be forced to be better. It’s just a matter of finding the right leverage. But that’s not how it should be. The FBI should always strive to be the best it can be, not just when pursuing investigations but when deploying the numerous powers it’s been entrusted with. That it took more than a decade and a steady escalation of mandates to bring the FBI in line with the law isn’t a victory. It’s simply a matter of outlasting a pernicious opponent. The sad thing is that the opponent is supposed to be protecting Americans and their rights, rather than screwing them both just because it felt it could get away with it.

Filed Under: 4th amendment, backdoor searches, fisa court, nsa, section 702, surveillance, upstream collection

FBI Used Section 702 Surveillance Powers To Spy On Protesters, Crime Victims, And Political Party Donors

from the so-much-for-the-First-Amendment dept

For as long as the FBI has had access to NSA collections under its Section 702 authority, the FBI has abused this access. Section 702 allows the NSA to collect content and communications via “upstream” channels. It’s a powerful dragnet and one that is supposed to be foreign-facing, so as not to violate the rights of Americans whose communications might be swept up in the data haul.

The NSA can’t prevent the inadvertent collection of US persons’ communications. That works to the FBI’s advantage. It has repositioned itself as a counterterrorism agency. That repositioning allows it to say things about “national security” and “preventing terrorist acts” when questioned by the FISA court and federal judges — the sort of phrases that tend to prompt less scrutiny from this crucial part of the checks and balances meant to prevent the government from engaging in abusive behavior.

For the first time in its history, the FBI appears to be making an effort to discourage surveillance abuses via this particular authority. But even as it moves towards something bearing a passing resemblance to responsibility, more information continues to come to light that appears to indicate the FBI can never be trusted to use this surveillance authority responsibly. Perhaps the solution is what’s being seriously considered now that the FBI has managed to thoroughly piss off the party holding the most Congressional power at the moment: the expiration of this surveillance authority.

This latest revelation, coming to us via Devlin Barrett and the Washington Post, will only add more fuel to the partisan fire and perhaps see this collection authority terminated for purely political purposes.

The FBI has misused a powerful digital surveillance tool more than 278,000 times, including against crime victims, Jan. 6 riot suspects, people arrested at protests after the police killing of George Floyd in 2020 and — in one case — 19,000 donors to a congressional candidate, according to a newly unsealed court document.

FBI officials say they have already fixed the problems, which the agency blamed on a misunderstanding between its employees and Justice Department lawyers about how to properly use a vast database named for the legal statute that created it, Section 702 of the Foreign Intelligence Surveillance Act (FISA).

The FBI is given billions of dollars a year to be the best it can be. Apparently, almost none of that goes to properly training its agents and analysts. A one-year aberration might be considered a failure of remedial training. A year-after-year record of surveillance abuses suggests the FBI simply doesn’t care whether or not it abides by the law. And while that might seem pretty depressing, it makes the FBI no different and no better than hundreds of local law enforcement agencies who feel the same way about the law and Constitution.

By misusing Section 702 collections, the FBI can spy on Americans without having to bother with securing a warrant. Instead, it can ask the FISA court to give it permission to search NSA databases for supposedly-foreign communications and content and proceed to target Americans without securing the domestic-facing warrants it’s supposed to be using when it seeks to obtain US persons’ communications. A FISA warrant authorizes presumably foreign-facing surveillance. That allows the NSA to do what it does. The FBI is using a backdoor in the law to engage in continual violations of the Fourth Amendment.

While the FBI can certainly demonstrate a legitimate need to target suspected insurrectionists for federal crimes, even its secondhand surveillance of January 6th suspects is, at best, skating along the extreme edges of the Constitution. The FBI has plenty of purely domestic options to obtain communications and data needed to further January 6th investigations. The fact that it chose to perform this task utilizing Constitution-skirting powers meant to target those with limited Constitutional protections (i.e., foreign criminal suspects) shows it really doesn’t care what laws it has to abuse to achieve its ends.

The fact that it used the same powers to target people engaged in activities protected by the First Amendment indicates it has just as little respect for the First as it does the Fourth.

The heavily-redacted 127-page decision [PDF] from the FISA court makes it clear (or at least as clear as a heavily-redacted decision can be) the FBI exceeded its Section 702 authority for reasons the agency is unable to clearly explain. Why the FBI chose to target arrested anti-police violence protesters in the wake of George Floyd’s murder doesn’t appear to have been adequately explained.

That search was done, officials said, to see if there was counterterrorism information about those individuals. When questioned about the searches later, FBI officials said it was reasonable for agents to think the searches would return foreign intelligence. The parts of the court papers describing that effort have significant redactions, making it unclear why the FBI developed its theory.

It also doesn’t seem to have valid, lawful explanation for its decision to avail itself of this foreign-facing collection to vet potential recruits for its always-expanding army of snitches.

Around that same time, an FBI analyst conducted 656 queries of FISA information, apparently because the bureau was considering whether to use people as informants and wanted to check for any derogatory information, the court filing says. The FBI did not have any reason to believe that agents would find such information, officials said.

This is “because it’s there” thinking. If the FBI did not have access to Section 702 collections, it certainly wouldn’t have performed these searches. But, because it did have access, it could perform the Constitution-violating searches and ask for forgiveness later.

And it’s even worse than the examples pointed out above. FBI analysts and investigators felt so comfortable engaging in potential rights violations, they routinely accessed Section 702 collections for the most specious of searches.

_Officials also found a long pattern between 2016 and 2020 in which the FBI conducted FISA searches about “individuals listed in police homicide reports, including victims, next-of-kin, witnesses, and suspects,” according to the court opinio_n.

This is the sort of thing that happens when no one fears any repercussion for engaging in illegal (or, at the very least, highly questionable) searches of collections that are supposed to be limited to identifying and surveilling suspected foreign terrorists and/or other actual threats to national security. The FBI treated the Section 702 collection as just another database it could dig through whenever it felt like it for reasons that never approached the “national security” justifications it has offered in explanation.

And those are the smaller batches of questionable searches. The Washington Post article notes the FBI performed more than 23,000 separate searches on suspected January 6th Capitol raid participants. At least there was some sort of national security nexus in those cases. But it also ran a “batch query” on 19,000 donors to “a Congressional campaign.” The FBI apparently believed this was justified because it believed the (unnamed) Congressional candidate might be the “target of foreign influence.” It failed to explain why only eight of the 19,000 identifiers produced any links to foreign entities or what the FBI did with all the extraneous communications it obtained with this untargeted search.

As mentioned above, abuses finally appear to be dropping. But that seems just as self-interested as the current push to let Section 702 expire. Congressional members seeking to end this collection are only doing so because they feel (correctly or incorrectly) they’re being targeted by the FBI for political reasons. And the FBI only appears to be greatly restricting access to this collection in hopes of convincing members of Congress it truly cares about reducing abuse by its agents and analysts. But if it manages to secure a reauthorization, chances are it will go right back to abusing its access. And Congress will find a new chew toy to amuse itself with, allowing the FBI to continue this abuse up until the expiration date.

Filed Under: backdoor searches, fbi, january 6th, nsa, section 702, surveillance, upstream collection

Supreme Court Denies Cert To NSA Case, Allows State Secret Privilege To Roll On Unaltered

from the press-F-to-escape-lawsuit dept

While we’re waiting to see if the Trump-stocked Supreme Court is going to end the internet as we know it, the nation’s top court has been rejecting, without comment, other essential cases that really could have used another set of judicial eyes.

On Wednesday, we covered one of the Supreme Court’s passes — this one involving parody, police, and qualified immunity. The Sixth Circuit granted immunity to Parma, Ohio police officers who raided a local man’s house, seized a bunch of electronics, and arrested him for the supposed crime of “disrupting police service” — all because he had created a parody Parma PD Facebook page that announced local cops were driving around in a van offering abortions and hosting “Pedophile Reform” events.

Most people saw it for what it was: not particularly subtle satire. The officers, however, weren’t laughing, so they decided to violate the page creator’s First Amendment rights. The Appeals Court took two swings at this one, the first one denying immunity because of the obvious First Amendment violations. For some reason during the second review, the judges reversed course and decided there was just enough probable cause to allow the officers to walk away from the suit. The Supreme Court, by denying certification, said basically the same thing: it’s ok for cops to engage in obvious First Amendment violations as long as there’s some law laying around that might very tenuously support an arrest warrant.

The same order list [PDF] contains another rejection by the Supreme Court that’s only going to encourage more dubious government behavior. In the list of things the Supreme Court can’t be bothered to review is the long-running Wikimedia v. NSA lawsuit — one prompted by the Snowden leaks that sought to hold the government accountable for warrantless domestic surveillance. (h/t Jon Brodkin/Ars Technica)

“Certori denied” is all the order says. With those two words, the federal government is allowed to continue chanting “state secrets” any time it wishes to exit a lawsuit over its surveillance activities. Despite Wikimedia offering up one of the NSA’s own documents — one that appeared to show the online, crowd-sourced encyclopedia was one of the agency’s many, many targets — the Fourth Circuit Appeals Court decided the NSA’s national security work was too important to allow further examination, much less a ruling in favor of the surveilled.

That terminates a lawsuit that was imitated nearly eight years ago. The denial makes it far less likely any current or future lawsuits over bulk domestic surveillance will survive judicial review because there is currently no circuit in the country willing to wholly reject the government’s state secrets privilege, even when evidence appears to show the government has engaged in illegal surveillance. What could have been a chance to limit the invocation of government secrecy to dodge litigation has been discarded without comment by this Supreme Court. That means the government wins without having to show its cards, even after the plaintiffs ante’d up on every litigation round.

Given the amount of time and money it takes to challenge the federal government in court, this rejection is going to deter victims of unlawful surveillance from taking their case to court. And that works out just fine for the Executive Branch, which historically hasn’t seen much in the way of checks and balances from an entity explicitly created to do exactly that.

Filed Under: about collection, ed snowden, mass surveillance, nsa, section 702, supreme court, surveillance, upstream, upstream collection
Companies: aclu, wikimedia

Appeals Court Says State Secrets Privilege Means NSA Can Avoid Wikimedia Foundation's Unlawful Surveillance Allegations

from the create-enough-state-secrets-and-you-can-get-away-with-anything dept

The Snowden leaks exposing NSA dragnet surveillance prompted a lot of litigation. Cast a wide enough net and you’re bound to snag it on some people’s rights. The Wikimedia Foundation was one of several parties who sued over the NSA’s seemingly unconstitutional collection efforts, targeting the agency’s “upstream” harvesting of all data and communications straight from internet backbones.

To keep the case in court, Wikimedia had to plausibly allege its data and communications had been scooped up by the NSA. Fortunately, Ed Snowden had provided some pretty solid evidence for the Foundation. A leaked NSA presentation showed Wikipedia was included in the agency’s HTTP dragnet:

Well, that leaked presentation, which included the Wikipedia logo as part of the traffic the NSA could snag from internet backbones wasn’t enough to impress the district court, which dismissed the lawsuit. It was revived by the appeals court a couple of years later, which said it had alleged enough plausible harm and possible targeting to pursue its First and Fourth Amendment claims.

It went back down to the lower court, which did the same thing it did the first time around. The suit was again dismissed, this time because the district court felt the Foundation didn’t bring enough factual allegations to the table. But then, how could it? The NSA basically said facts could not be introduced or argued.

On remand, the district court ordered jurisdictional discovery. But when Wikimedia sought evidence related to Upstream, the NSA invoked the state secrets privilege.

That’s from the Fourth Circuit’s second pass [PDF] at the Wikimedia lawsuit. This time around the Appeals Court says it disagrees the lawsuit should have been dismissed for lack of standing, but that determination makes no difference when the government says the subject matter is too sensitive to be sued over.

After a discussion of what may or may not be inferred from the limited amount of information disclosed or discussed publicly about this NSA collection, the Appeals Court says no one will be discussing it any further, at least not in this Circuit.

Wikimedia argued the government can’t use the state secret privilege to evade its obligations to hand over information about dragnet surveillance, citing FISA and appellate precedent.

Relying heavily on Fazaga, Wikimedia claims that the third condition unambiguously encompasses the circumstances at hand: Wikimedia is an aggrieved person that made a motion before the district court under Federal Rule of Civil Procedure 37(a) to compel discovery of “materials relating to electronic surveillance.” Id. at § 1806(f). Wikimedia thus reads § 1806(f) as a free-floating right to obtain information related to the government’s electronic surveillance pursuant to any (and all) federal statutes or rules.

The Fourth Circuit says Wikimedia’s interpretation is wrong.

Reading the third condition in context reveals that Wikimedia’s gloss makes for a shiny but ill-fitting shoe. Both parties agree that § 1806(f) may apply regardless of who initiated the suit. But we agree with the government that § 1806(f) describes procedures for determining the admissibility of electronic surveillance information only when the government seeks to use such evidence in a particular proceeding—whether civil or criminal. Thus, even assuming that Wikimedia is an aggrieved person, we conclude that it can’t use § 1806(f) to force the government to introduce electronic surveillance information into this case,

Even if the court were to agree with Wikimedia’s interpretation, it wouldn’t change anything. Determining that the NSA engaged in unlawful surveillance of Wikimedia would only require suppression of evidence collected unlawfully. That’s not what Wikimedia is seeking here. It’s asking the court to review evidence of NSA collection activities to determine whether or not Wikimedia can continue its lawsuit over alleged unlawful surveillance.

This may be a Congressional problem, albeit one created in an attempt to solve a problem, the Court points out:

Congress provided for judicial review of executive branch surveillance, but it did so to “strike[] a fair and just balance between protection of national security and protection of personal liberties.” The government’s reading of § 1806(f) fits that schema exactly. In that provision, Congress permits the government to use electronic surveillance evidence in court against a litigant while withholding materials related to that surveillance from that individual in the interests of national security. But in the same breath, Congress also allows an aggrieved person to challenge the government’s use of such evidence and have a court evaluate the lawfulness of the government’s actions.

Far from giving the government exclusive control over challenges to surveillance, we think this reading of § 1806(f) acknowledges the court’s role in preserving the compromise Congress made between individual rights and national security.

But the compromise requires more from plaintiffs like Wikimedia, the court continues. And it goes farther than shutting down legal challenges of FISA-approved surveillance. Sometimes, the government just gets to win.

[T]his problem isn’t unique to FISA. Every state secrets case presents the possibility that a plaintiff will be denied—in the interests of national security—a remedy available by law.

And no one gets to ask questions about secret surveillance techniques because they’re secret, says the Fourth Circuit, closing the loop on the state secrets discussion and terminating Wikimedia’s lawsuit for the second time.

Wikimedia claims that the NSA is acquiring all communications on a chokepoint cable that it is monitoring. There’s simply no conceivable defense to this assertion that wouldn’t also reveal the very information that the government is trying to protect: how Upstream surveillance works and where it’s conducted. Indeed, “the whole object of [Wikimedia’s] suit and of the discovery” is to inquire into “the methods and operations of the [NSA]”—“a fact that is a state secret.”

[…]

The district court thus correctly held that, in the face of the state secrets privilege, Wikimedia can’t continue to litigate the Wikimedia Allegation to support standing.

This probably isn’t supposed to come across as a judicial shrug, but it sure feels like it.

To sum up, evidence of the Wikimedia Allegation establishes a genuine issue of material fact as to standing, but the state secrets privilege prevents further litigation of that issue.

The house wins. And it didn’t even have to show its cards. Wikimedia may actually be able to allege an injury that gives it standing, but it can’t do that without the government discussing its surveillance programs, which it won’t. And the court can’t make it do it.

Filed Under: 4th amendment, 4th circuit, ed snowden, nsa, state secrets, surveillance, upstream collection
Companies: wikimedia

Appeals Court Revives Wikimedia's Lawsuit Against The NSA

from the doesn't-'collect-it-all'-mean-'collect-it-all?' dept

Back in 2015, Wikimedia’s lawsuit against the NSA — filed with several other plaintiffs and with the help of the ACLU — was tossed out by the district court. Wikimedia argued it was illegally the subject of NSA upstream surveillance, thanks to the nature of this Section 702 collection. Wikimedia’s reach is global, making it highly likely the NSA was gathering its content and communications while snagging data off internet backbones.

To further demonstrate the probability of this happening, Wikipedia submitted leaked Snowden documents, including an NSA presentation slide that contained Wikimedia’s logo.

>

No dice. The district court said Wikimedia had no standing to pursue these claims, even with the unexpected buttress of leaked NSA documents. The court went even further, disabusing Wikipedia of its “99.9999999999% certainty” notion that the NSA had illegally harvested at least one of its trillions of internet transactions. In all, it was a very ugly day for Wikimedia and its lawsuit.

Fortunately, for Wikimedia, its lawsuit has been revived on appeal. The Fourth Circuit Appeals Court is far more amenable to Wikimedia’s claims, finding them to be more credible than the lower court determined. From the opinion [PDF]:

[A]t least at this stage of the litigation, Wikimedia has standing to sue for a violation of the Fourth Amendment. And, because Wikimedia has self-censored its speech and sometimes forgone electronic communications in response to Upstream surveillance, it also has standing to sue for a violation of the First Amendment.

The court doesn’t necessarily treat all of Wikimedia’s allegations as true, but finds it has handed over enough background evidence to give it standing to pursue its First and Fourth Amendment claims.

But this revival is limited to Wikimedia and only some of its claims. The seven other plaintiffs aren’t invited to the next district court round. A lack of produced evidence appears to have killed off the “dragnet” claims raised by the plaintiffs (which includes Wikimedia). The other defendants have a much smaller web footprint, making it less plausible their communications were subjected to upstream collection by the NSA. The only way those claims would be plausible is if the court found the “dragnet” assertions plausible… which it doesn’t.

The Dragnet and Wikimedia Allegations share much in common. Because each alleges the same particularized and ongoing cognizable injuries, our analysis of the injury-in-fact, traceability, and redressability elements of Article III standing with respect to the Wikimedia Allegation also applies here. But there’s a key difference in the scope of the two allegations. In the Dragnet Allegation, Plaintiffs must plausibly establish that the NSA is intercepting “substantially all” text-based communications entering and leaving the United States, whereas it’s sufficient for purposes of the Wikimedia Allegation to show that the NSA is conducting Upstream surveillance on a single backbone link. Because Plaintiffs don’t assert enough facts about Upstream’s operational scope to plausibly allege a dragnet, they have no Article III standing.

The difference between the two claims is one of numbers. Wikimedia only had to show its traffic traveled across enough internet backbones to plausibly claim harvesting from any one of them would result in interception of its communications. The “dragnet” argument claims the NSA is harvesting almost everything that travels across multiple backbones. The majority finds this assertion unlikely. The dissent, however, says the same arguments Wikimedia put forth to demonstrate the probability of illegally-intercepted communications lend credence to the “dragnet” argument simply because that’s how internet traffic works.

Plaintiffs have plausibly alleged that the NSA surveils most backbone links because — based on the technical rules governing internet communications — the agency cannot know which link the communications it targets will traverse when they enter or leave the United States. The path that packets take along the internet backbone is determined dynamically based on unpredictable conditions. Thus, a communication sent by a surveillance target can enter the United States through one backbone link, but an immediate response returned to the surveillance target can traverse a different backbone link. Similarly, communications sent by a surveillance target at different times or locations can traverse different backbone links. Given this technical limitation, the government’s disclosure that the NSA seeks to “comprehensively acquire communications that are sent to or from its targets,” J.A. 49, renders Plaintiffs’ allegation plausible. If the NSA cannot know which backbone link its targets’ internet communications will traverse, then the only way it can comprehensively acquire its targets’ communications is by surveilling virtually every backbone link.

It’s a good point but it’s not enough to save the rest of the plaintiffs, which include the National Association of Criminal Defense Lawyers, Human Rights Watch, and Amnesty International. Perhaps a further examination of Wikimedia’s arguments by the lower court will aid these plaintiffs in their future legal endeavors.

Filed Under: 4th circuit, nsa, section 702, standing, surveillance, upstream collection
Companies: wikimedia

EFF Finally Gets To Ask Appeals Court To Look At 4th Amendment Question Over NSA's Backbone Sniffing

from the constitutional-fun dept

It’s taken many years, but one of the EFF’s longstanding cases against the NSA has finally reached an important milestone: exploring the 4th Amendment question raised by the NSA tapping the internet backbone. This is part of the Jewel v. NSA case that has been going on for years. Back in February (after a lot of procedural back and forth on other issues), the district court rejected the 4th Amendment argument, basically toeing the government’s “but… but… national security!” line. Not surprisingly, the EFF disagreed with the court and appealed to the 9th Circuit appeals court.

The appeal is not just about the 4th Amendment question, but also about the question of standing. Like many surveillance cases, the courts have given the government a bit of a “get out of jail free” card by not letting anyone sue unless they can prove that they, specifically, were swept up by the surveillance. The lower court used this to reject the EFF’s case as well, arguing that the evidence it presented was too “speculative.” On appeal, the EFF argues this is ridiculous, as you can see in the EFF’s opening brief:

First, the court erred in concluding plaintiffs lacked standing. Plaintiffs? evidence, including extensive government admissions, shows that at least some of their Internet communications have been intercepted, copied, and searched, thus establishing their injury and giving them standing. Moreover, because the government defendants put in no evidence creating a genuine factual dispute regarding plaintiffs? standing, plaintiffs are entitled to summary judgment on standing.

And then we get to the meat of the 4th Amendment argument:

Above all, the evidence demonstrates that plaintiffs are entitled to summary judgment on the merits of their Fourth Amendment claim. The suspicionless, warrantless interception and copying of plaintiffs? Internet communications is an unconstitutional seizure, and the subsequent content searching of some of those communications is an unconstitutional search.

Later, the EFF filing leans heavily on last year’s Supreme Court ruling in the Riley case which found mobile phone searches without a warrant to be a 4th Amendment violation:

The Supreme Court recently affirmed that the government?s search and seizure of digital information implicates core Fourth Amendment values and triggers the warrant requirement. Riley, 134 S.Ct. at 2495 (?The fact that technology now allows an individual to carry such information in his hand does not make the information any less worthy of the protection for which the Founders fought.?). The Court specifically noted the protected privacy interests in Internet browsing: ?Internet search and browsing history . . . could reveal an individual?s private interests or concerns?perhaps a search for certain symptoms of disease, coupled with frequent visits to WebMD.? …. The Court went on to detail how a person?s digital information because of its breadth and depth gives a wide-ranging picture of a person?s most private thoughts and actions?even beyond what a general search of their home might reveal….

The Fourth Amendment privacy interests in digital information that the Supreme Court recognized in Riley are fully applicable to the Internet activities of plaintiffs that the government is seizing and searching? including emails, web browsing and searching, live chat, voice calls, social networking, photos, and videos?because of ?all they contain and all they may reveal.?… Indeed, the Court noted that much of the digital information it protected in Riley is increasingly not stored on smartphones themselves but in the Internet ?cloud,? with phones used to access the information over the Internet…. Because communications between smartphones and the Internet ?cloud? often transit the Internet backbone, those communications are subject to the NSA?s interception.

There’s a lot more in the filing that is well worth reading, and you can expect the Justice Department to attack basically all of it. Hopefully the 9th Circuit sees through it and recognizes the core principles at play here. It is difficult to believe that when the Founders drafted the 4th Amendment, that they didn’t think it applied to sniffing up basically every communication “just in case.”

Filed Under: 4th amendment, jewel v nsa, nsa, privacy, surveillance, upstream collection

DOJ Blurred Lines Between Terrorism & Crime To Expand NSA & FBI Warrantless Wiretapping Of 'Hackers'

from the whatever,-it's-all-the-same dept

This week, of course, the US government passed the USA Freedom Act, a modest step towards reform. As we’ve noted, it doesn’t even touch on two of the more concerning surveillance authorities: Executive Order 12333 and Section 702 of the FISA Amendments Act, which includes the infamous “warrantless wiretapping” programs that allow the NSA to tap “upstream” fiber optic cables from AT&T and others to sniff all data traveling across those cables.

Pro Publica and the NY Times have teamed up to report on how the DOJ expanded the warrantless wiretapping regime to go after hackers. There’s a lot to unpack in the story (which is well worth reading), but the short version is that, under pressure from the White House, NSA and others, officials appear to have deliberately blurred the lines between “crime” and “international terrorism” in order to get the DOJ to sign off on secret legal orders allowing the NSA and the FBI to use its “upstream” snooping capabilities to monitor certain “cybersecurity signatures” which include basically anything the feds want, to sniff out a hacker. From the revealed documents (which, yes, come from Ed Snowden’s cache):

If you can’t see that, the key line is:

The Certification will also for the first time spell out the authorization for targeting cyber signatures such as IP addresses, strings of computer code, and similar non-email or phone number-based selectors.

In short: the government said, “okay, you can now sniff that upstream firehose for hackers based on whatever “code snippets” or “IP addresses” we give you.”

Of course, this raises some questions about the split between domestic law enforcement and international anti-terrorism/foreign intelligence work. Remember, the 702 upstream program is pretty specific in that it’s only to be used for non-domestic, non-criminal work. But, according to the White House, those distinctions no longer matter:

?Reliance on legal authorities that make theoretical distinctions between armed attacks, terrorism and criminal activity may prove impractical,? the White House National Security Council wrote in a classified annex to a policy report in May 2009, which was included in the NSA?s internal files.

Yes, apparently, it’s “impractical” for the surveillance state to actually follow the law.

The documents also reveal that they really wanted access to that sweet, sweet upstream firehose, because much more limited programs like PRISM (which involve court orders to certain internet companies) didn’t provide enough coverage:

Then, to take things a step further, the government allowed the FBI direct access to the NSA’s upstream collection, even though the FBI doesn’t have the same limits against surveillance on Americans that the NSA has. Why? Basically, the argument appears to be “well, the NSA already has that data… so… let’s give it to the FBI as well”:

The documents do contain and interesting slide presentation about how and when certain capabilities can be used, including a slide dedicated to repeating the 4th Amendment, and another with a note saying that the “worst thing” the NSA can do is to use its signals intelligence capabilities “to collect against a [US Person] hacker” because doing so is “basically doing surveillance for [law enforcement] purpose without a warrant.” So, at the very least, they understand the law, but it’s not at all clear that they follow it:

And, in fact, later in that same presentation, it notes that the NSA’s Threat Operations Center (NTOC) wants more power to target “foreign hackers outside the US” without having to prove as much: “Because attribution is hard, just having to prove foreigness and an FI purpose is especially useful to NTOC.”

According to the Pro Publica / NY Times report, the NSA sought more and more permission here, though it’s not clear what has actually been granted:

In May and July 2012, according to an internal timeline, the Justice Department granted its secret approval for the searches of cybersignatures and Internet addresses. The Justice Department tied that authority to a pre-existing approval by the secret surveillance court permitting the government to use the program to monitor foreign governments.

That limit meant the NSA had to have some evidence for believing that the hackers were working for a specific foreign power. That rule, the NSA soon complained, left a ?huge collection gap against cyberthreats to the nation? because it is often hard to know exactly who is behind an intrusion, according to an agency newsletter. Different computer intruders can use the same piece of malware, take steps to hide their location or pretend to be someone else.

So the NSA, in 2012, began pressing to go back to the surveillance court and seek permission to use the program explicitly for cybersecurity purposes. That way, it could monitor international communications for any ?malicious cyberactivity,? even if it did not yet know who was behind the attack.

The newsletter described the further expansion as one of ?highest priorities? of the NSA director, Gen. Keith B. Alexander.

Remember all of this when you see the government asking for new “cybersecurity” laws — which all too frequently are ways of granting the NSA and/or FBI greater powers to do surveillance via these upstream collections. As The Intercept points out, during the big debates on cybersecurity over the last few years, the NSA has insisted that it doesn’t have access to this kind of information, and almost every debate on the power of upstream collection by the NSA and others has been based on claims by the intelligence community that they only use unique identifiers like email addresses — and not very, very broad identifiers like an IP address or “computer code.”

There’s a lot more in the full article and in the released documents which you can see below.

Filed Under: 702, cybersecurity, fbi, fisa, hacking, nsa, surveillance, upstream, upstream collection, warrantless wiretapping

Court Rejects EFF's Arguments Over NSA Internet Surveillance

from the keep-appealing dept

One of the key ongoing lawsuits challenging the NSA’s warrantless surveillance of Americans and their internet usage is the Jewel v. NSA case that actually predates the Snowden revelations. The specific case involves challenges to the so-called “upstream collection” under Section 702 of the FISA Amendments Act. Specifically, this is about the NSA tapping telco fiber directly (as Mark Klein revealed concerning AT&T) and sifting through all the traffic for “relevant” (defined loosely) information. The EFF is handling the case against the government in Jewel, and argued that such collection violates the 4th Amendment. Unfortunately, the court has now rejected that argument, refusing to grant summary judgment to the EFF, instead granting partial summary judgment to the US Government.

Unfortunately, as in past attempts to challenge US surveillance, much of the issue comes down to one of standing. The individuals suing don’t have evidence that their personal information was collected, so they don’t necessarily have standing to sue (so says the US government). Of course, even when there is evidence, the government often has a way to weasel out of the legal challenge anyway. And, unfortunately, we’re right back in that situation with the Jewel case. Since this case was over the AT&T internet taps, the EFF noted that AT&T customers should have standing, but the court isn’t convinced that’s enough:

However, the question whether Plaintiffs can establish standing to pursue their Fourth Amendment claim against the Government Defendants for constitutional violations goes beyond whether they, as individuals and AT&T customers with Internet communications, can proffer evidence of generalized surveillance of Internet communications. Although the public and admissible evidence presented establishes that Plaintiffs are indeed AT&T customers with Internet communications and would fall into the class of individuals surveilled, the evidence at summary judgment is insufficient to establish that the Upstream collection process operates in the manner in which Plaintiffs allege it does.

In their attempt to establish the factual foundation for their standing to sue on their Fourth Amendment Claim, Plaintiffs rely in large part on the declarations of Mark Klein and their proffered expert, J. Scott Marcus, as well as other former AT&T and NSA employees to present the relevant operational details of the surveillance program. Plaintiffs assert that the declarations support the contention that all AT&T customers? Internet communications are currently the subject of a dragnet seizure and search program, controlled by or at the direction of the Government. However, having reviewed the record in its entirety, the Court finds the Plaintiffs? evidence does not support this claim.

Plaintiffs principally rely on the declaration of Klein, a former AT&T technician who executed a declaration in 2006 about his knowledge and perceptions about the creation of a secure room at the AT&T facility at Folsom Street in San Francisco. However, the Court finds that Klein cannot establish the content, function, or purpose of the secure room at the AT&T site based on his own independent knowledge…. The limited knowledge that Klein does possess firsthand does not support Plaintiffs? contention about the actual operation of the Upstream data collection process. Klein can only speculate about what data were actually processed and by whom in the secure room and how and for what purpose, as he was never involved in its operation. In addition, Plaintiffs? expert, Marcus, relies exclusively on the observations and assumptions by Klein to formulate his expert opinion. Accordingly, his testimony about the purpose and function of the secure equipment at AT&T and assumed operational details of the program is not probative as it not based on sufficient facts or data…. The Court finds that Plaintiffs have failed to proffer sufficient admissible evidence to support standing on their claim for a Fourth Amendment violation of interference with their Internet communications. In addition, without disclosing any of the classified content of the Government Defendants? submissions, the Court can confirm that the Plaintiffs? version of the significant operational details of the Upstream collection process is substantially inaccurate.

And, unfortunately, the court further accepts the DOJ’s claims that going any further in this case will lead to the terrorists winning or something:

In addition, having reviewed the classified portion of the record, the Court concludes that even if the public evidence proffered by Plaintiffs were sufficiently probative on the question of standing, adjudication of the standing issue could not proceed without risking exceptionally grave damage to national security. The details of the Upstream collection process that are subject the Government?s assertion of the state secrets privilege are necessary to address the defenses against Plaintiffs? theory of standing as well as to engage in a full and fair adjudication of Government Defendants? substantive defenses against the Claim. The Court has reviewed the classified brief submitted by the Government and finds that its legal defenses are persuasive, and must remain classified.

Disclosure of this classified information would risk informing adversaries of the specific nature and operational details of the Upstream collection process and the scope of the NSA?s participation in the program. Notwithstanding the unauthorized public disclosures made in the recent past and the Government?s subsequent releases of previously classified information about certain NSA intelligence gathering activities since 2013, the Court notes that substantial details about the challenged program remain classified. The question of whether Plaintiffs have standing and the substantive issue of whether there are Fourth Amendment violations cannot be litigated without impinging on that heightened security classification. Because a fair and full adjudication of the Government Defendants? defenses would require harmful disclosures of national security information that is protected by the state secrets privilege, the Court must exclude such evidence from the case.

And, with that, the judge, Jeffrey White, rejects the 4th Amendment claim. I’m guessing that the EFF will appeal.

Filed Under: doj, faa, fisa amendments act, jewel v nsa, nsa, section 702, standing, state secrets, surveillance, upstream collection
Companies: eff

Privacy And Civil Liberties Board Mostly Unconcerned About PRISM Or Backbone Tapping By NSA

from the that's-unfortunate dept

As expected, the Privacy and Civil Liberties Oversight Board (PCLOB) has now issued its analysis of the Section 702 surveillance done by the NSA (and, as revealed earlier this week, passed on to the FBI and CIA). You may recall that, back in January, the PCLOB issued a scathing report about the NSA’s Section 215 bulk data collection efforts, calling the program both illegal and unconstitutional. In contrast, the report on the 702 program is much more muted — claiming that the program is constitutional, legal and effective as a counterterrorism tool. Like the previous report, this new one is highly readable — and I recommend reading it in its entirety. However, the legal analysis is disappointing compared to the earlier report.

The report details how the program works, in a manner that doesn’t really reveal too much that’s new for folks who have been following all of the details over the past year, but does confirm the basics of how the Section 702 collections work — something that many, many people seem to be confused about. In short, the Section 702 program is made up of two different collections of information. The first is the infamous PRISM program, which is not as broad as many people have believed in the past. This is when, under FISA Court approval, various internet companies are given certain “selectors” related to non-US persons, and those companies are compelled to hand over the communications to or from that person:

In PRISM collection, the government sends a selector, such as an email address, to a United States-based electronic communications service provider, such as an Internet service provider (?ISP?), and the provider is compelled to give the communications sent to or from that selector to the government. PRISM collection does not include the acquisition of telephone calls. The National Security Agency (?NSA?) receives all data collected through PRISM. In addition, the Central Intelligence Agency (?CIA?) and the Federal Bureau of Investigation (?FBI?) each receive a select portion of PRISM collection.

This is different from the much more troubling “upstream” collection, which comes from directly tapping the internet backbone and basically sifting through everything possible to see if any triggers are hit. This is where the infamous “about” triggers are included. As we’ve been discussing, the NSA doesn’t just collect communications to and from targets, but also “about” them — and that all happens at the upstream level, rather than PRISM. Upstream is also where the NSA is able to collect audio communications as well.

Upstream collection differs from PRISM collection in several respects. First, the acquisition occurs with the compelled assistance of providers that control the telecommunications ?backbone? over which telephone and Internet communications transit, rather than with the compelled assistance of ISPs or similar companies. Upstream collection also includes telephone calls in addition to Internet communications. Data from upstream collection is received only by the NSA: neither the CIA nor the FBI has access to unminimized upstream data. Finally, the upstream collection of Internet communications includes two features that are not present in PRISM collection: the acquisition of so-called ?about? communications and the acquisition of so-called ?multiple communications transactions? (?MCTs?). An ?about? communication is one in which the selector of a targeted person (such as that person?s email address) is contained within the communication but the targeted person is not necessarily a participant in the communication. Rather than being ?to? or ?from? the selector that has been tasked, the communication may contain the selector in the body of the communication, and thus be ?about? the selector. An MCT is an Internet ?transaction? that contains more than one discrete communication within it. If one of the communications within an MCT is to, from, or ?about? a tasked selector, and if one end of the transaction is foreign, the NSA will acquire the entire MCT through upstream collection, including other discrete communications within the MCT that do not contain the selector.

While PRISM has been the sexy target for complaints due to its name and connection to easy target tech companies, the upstream sifting through the backbone has always been the much more troubling program, and this report confirms that.

Unfortunately, unlike the PCLOB’s report on the Section 215 program, here the PCLOB more or less throws up its hands over the possible legal and constitutional issues, insisting that it’s probably fine or that violations are “incidental.” The EFF has issued a scathing condemnation of the report, noting its most glaring weakness: a failure to recognize that the Constitution requires a warrant to collect any such data in the first place. The PCLOB seems to totally ignore this requirement, as the EFF points out:

The board skips over the essential privacy problem with the 702 ?upstream? program: that the government has access to or is acquiring nearly all communications that travel over the Internet. The board focuses only on the government?s methods for searching and filtering out unwanted information. This ignores the fact that the government is collecting and searching through the content of millions of emails, social networking posts, and other Internet communications, steps that occur before the PCLOB analysis starts. This content collection is the centerpiece of EFF?s Jewel v. NSA case, a lawsuit battling government spying filed back in 2008.

The board?s constitutional analysis is also flawed. The Fourth Amendment requires a warrant for searching the content of communication. Under Section 702, the government searches through content without a warrant. Nevertheless, PLCOB?s analysis incorrectly assumes that no warrant is required. The report simply says that it ?takes no position? on an exception to the warrant requirement when the government seeks foreign intelligence. The Supreme Court has never found this exception.

PCLOB findings rely heavily on the existence of government procedures. But, as Chief Justice Roberts recently noted: “the Founders did not fight a revolution to gain the right to government agency protocols.” Justice Roberts? thoughts are on point when it comes to NSA spying?mass collection is a general warrant that cannot be cured by government?s procedures.

Frankly, it does seem bizarre that the PCLOB fails to even consider the original collection and whether or not that violates the 4th Amendment. The Constitutional analysis in the report seems to leap over that question almost entirely, focusing just on the question of what the NSA hangs onto later. The brief discussion about the actual collection basically just says “well, this is tricky, because we’re not looking at a single instance, but rather an entire program — some of which may be Constitutional and some of which may be not, so we’ll just lump it all together and see if it meets the “reasonable” test.” That seems… questionable. If any part of the program is unconstitutional then that’s a problem. You don’t get to lump it all together and say that, on the whole, it’s probably Constitutional because most of the searches and collection would likely be allowed. Even as such, the PCLOB says that the program — especially the backdoor searches on Americans — pushes the program “close to the line of constitutional reasonableness” but probably not over it.

These features of the Section 702 program, and their cumulative potential effects on the privacy of U.S. persons, push the entire program close to the line of constitutional reasonableness. At the very least, too much expansion in the collection of U.S. persons? communications or the uses to which those communications are put may push the program over the line. The response if any feature tips the program over the line is not to discard the entire program; instead, it is to address that specific feature.

And, indeed, nearly all of the “recommendations” are to “address” minor aspects that the PCLOB finds to be potentially troubling, but without making any significant changes to the way either part of the program functions.

For example, concerning those “about” searches, the PCLOB basically says that it would be nice if they were limited, but that the NSA doesn’t really have a way to do that, so, oh well, what can you do?

With regard to the NSA?s acquisition of ?about? communications, the Board concludes that the practice is largely an inevitable byproduct of the government?s efforts to comprehensively acquire communications that are sent to or from its targets. Because of the manner in which the NSA conducts upstream collection, and the limits of its current technology, the NSA cannot completely eliminate ?about? communications from its collection without also eliminating a significant portion of the ?to/from? communications that it seeks. The Board includes a recommendation to better assess ?about? collection and a recommendation to ensure that upstream collection as a whole does not unnecessarily collect domestic communications.

Similarly, the PCLOB notes that, despite all of the information the intelligence community was willing to share with it, that did not include details of how many US persons were impacted by the program:

The government is presently unable to assess the scope of the incidental collection of U.S. person information under the program. For this reason, the Board recommends several measures that together may provide insight about the extent to which communications involving U.S. persons or people located in the United States are being acquired and utilized.

So, in short, on some of the biggest questions in front of the PCLOB, it basically says “Well, there’s not much we can do, but it would sure be nice if we had more info next time.” Blech. Shouldn’t those be the point at which the PCLOB says “Hey, wait, that’s unacceptable and illegal and needs to be fixed!”

While at first, it did seem that the report was ignoring the privacy rights of non-US persons, it does actually include a fairly thorough section on such privacy rights, and how those rights actually do have some built-in protections under the program. While it’s a low bar, it’s at least moderately reassuring that the program is not, as some assumed, designed to say “non-US persons have no privacy rights whatsoever.” The report also notes international law, and President Obama’s newly issued rules for protecting the privacy rights of non-US persons, but notes that those rules have not yet been fully implemented and could change the analysis.

In the end, the report does provide some valuable clarifications and explanations of what’s going on — but it’s disappointingly weak in the legal and Constitutional analysis. If you’re interested in the specific recommendations of the PCLOB, we’ve included them below, above the embedded report.

Filed Under: 4th amendment, about searches, backdoor searches, cia, fbi, nsa, pclob, prism, section 702, surveillance, upstream collection

Why Does The NSA Focus So Much On 'TERROR!' When PRISM's Success Story Is About Cybersecurity?

from the odd dept

We’ve mocked the NSA for the way it always reverts to FUD about “terrorists” to show how “successful” programs like PRISM have been, but then also reverts to talking about cybersecurity as a focus to make the surveillance seem more like it’s about protecting people, rather than spying on them. However, as some of the latest revealed documents show, perhaps the NSA has its talking points all mixed up. There’s plenty to discuss concerning the revelations about the NSA spying on French phone calls, but some people have noticed that, while some of the presentation documents revealed with that story were revealed before, there are a few new ones as well, including this one:

The key thing here is the report that the NSA was able to use its FAA authority (apparently via both PRISM and “upstream collection” — which is tapping directly into the backbone via telcos) to figure out that someone, perhaps the Chinese, had gotten access to a defense contractor’s network and was either preparing to, or at least had the ability to get 150 gigs of important data out. The NSA alerted the FBI which alerted the contractor and they plugged the hole the same day. While that certainly seems like a good thing, it’s not entirely clear stopping such hacking is really worth giving up a ton of privacy, though it does show, again, why Keith Alexander keeps demanding access to pretty much everything. Of course, you’d think that the NSA would be a bit more forward in promoting this success story, rather than its bogus claims about stopping terrorist attacks, which have fallen apart under scrutiny.

The other interesting slide is this one:

It shows some of the differences between PRISM and the upstream collections, both of which the NSA believes are authorized under Section 702 of the FISA Amendments Act. PRISM involves being able to collect specific data from the 9 specific companies which have been named (Google, Facebook, Microsoft, Yahoo, Apple, Skype, AOL, Paltalk, YouTube), while “upstream” is what the NSA gets from tapping the backbone via telcos. “DNR Selectors” are the phone call metadata collected under a different program (Section 215 of the Patriot Act) which they apparently can filter the upstream data collection against. “DNI” is internet data (email addresses and such). Once again, it looks like tapping the backbone provides a hell of a lot more data, but it lacks the ability to “access stored communications,” which they get via PRISM.

The other interesting tidbit to me, is the “direct relationship” claim. Note that with PRISM, it says “only through FBI,” which suggests a reason why the PRISM companies have insisted that they’ve never been involved in any NSA program. It looks like they may have only had to deal with FBI requests (and associated FISA court orders). It’s just that the data the FBI gets is then shared with the NSA.

Filed Under: cybersecurity, nsa, nsa surveillance, prism, terror, upstream collection