The “Foreign Intelligence” Dragnet May Not Be about “Foreign Intelligence”

There’s one more totally weedy change in the phone dragnet orders I wanted to point out: the flimsy way the program has, over time, tied into “foreign intelligence.”

To follow along, it’s helpful to use the searchable versions of the phone dragnet orders ACLU has posted.

Start by searching on this order — from December 11, 2008, just before FISC started cleaning up the dragnet problems — for “foreign intelligence” (all the earlier orders are, I believe, identical in this respect). You should find 5 instances: 3 references to the FISC, a reference to the language from the Section 215 statute requiring the tangible things be either for foreign intelligence or to protect against international terrorism (¶1 on page 2), and a discussion tying dissemination of US person data to understanding foreign intelligence (¶(3)D on page 9).

In the last instance, the order introduces foreign intelligence, but then drops it. The very next sentence shifts the measure of whether the US person information can be disseminated from “foreign intelligence” to “counterterrorism” — and counterterrorism here is not explicitly tied to international terrorism, although the statute requires it to be.

Before information identifying a U.S. person may be disseminated outside of NSA, a judgment must be made that the identity of the U.S. person is necessary to understand the foreign intelligence information or to assess its importance. Prior to the dissemination of any U.S. person identifying information, the Chief of Information Sharing Services in the Signals Intelligence Directorate must determine that the information identifying the U.S. person is in fact related to counterterrorism information and that it is necessary to understand the counterterrorism information or assess its importance.

Significantly, ¶(3)C on page 8 — the main paragraph restricting NSA’s access to the dragnet data — says nothing about foreign intelligence.

This language would, I believe, have permitted the government to search on and disseminate US person information for reasons without a foreign nexus (and they played word games with other language in the original orders, notably with the word “archives”).

Now check out the next order, dated March 5, 2009. In this — the first of the primary orders dealing with the dragnet problems — the language potentially tying the FBI investigation to foreign intelligence is eliminated (I talked about that change here).The language on dissemination remains the same — that is, the paragraph does not tie dissemination of US person information to terrorism with an international nexus.  But ¶(3)C — the key paragraph regulating access — now specifies that NSA can only “query the BR metadata for purposes of obtaining foreign intelligence.”

In the process of very narrowly limiting what NSA could do with the phone dragnet, Judge Reggie Walton added language limiting queries to foreign intelligence purposes, not just terrorism purposes (though I believe it still could be read as permitting dissemination of information without a foreign nexus).

As a reminder, during the interim period, the government had admitted to tracking 3,000 US persons without submitting them to a First Amendment review.

The orders for the following year changed regularly (and the Administration has withheld what are surely the most interesting orders from that year), but they retained that restriction on queries to foreign intelligence purposes.

But now look what that language in ¶(3)C has since evolved into, starting with the order dated October 29, 2010, though the language below comes from the April 25, 2013 order (the October 29 one has “raw data” hand-written into it, making it clear these requirements, including auditability, only applies to the collection store, not the corporate store).

NSA shall access the BR metadata for purposes of obtaining foreign intelligence information only through contact chaining queries of the BR metadata as described in paragraph 17 of the [redacted] Declaration attached to the application as Exhibit A, using selection terms approved as “seeds” pursuant to the RAS approval process described below.5 NSA shall ensure, through adequate and appropriate technical and management controls, that queries of the BR metadata for intelligence analysis purposes will be initiated using only a selection term that has been RAS-approved. Whenever the BR metadata is accessed for foreign intelligence analysis purposes or using foreign intelligence analysis query tools, an auditable record of the activity shall be generated.

At first glance, this paragraph would seem to add protections that weren’t in the orders previously, ensuring that the phone dragnet only be accessed for foreign, not domestic, intelligence.

But it’s actually only partly a protection.

In fact, the “foreign intelligence” language here serves to distinguish this controlled access from the “data integrity” access (though they no longer call it that), which is described in the previous paragraph.

Appropriately trained and authorized tedmical personnel may access the BR metadata to perform those processes needed to make it usable for intelligence analysis. Technical personnel may query the BR metadata using selection terms4 that have not been RAS-approved (described below) for those purposes described above, and may share the results of those queries with other authorized personnel responsible for these purposes, but the results of any such queries will not be used for intelligence analysis purposes. An authorized technician may access the BR metadata to ascertain those identifiers that may be high volume identifiers. The technician may share the results of any such access, i.e., the identifiers and the fact that they are high volume identifiers, with authorized personnel (including those responsible for the identification and defeat of high volume and other unwanted BR metadata from any 9f NSA’ s various metadata repositories), but may not share any other information from the results of that access for intelligence analysis purposes. In addition, authorized technical personnel may access the BR metadata for purposes of obtaining foreign intelligence information pursuant to the requirements of subparagraph (3)C below.

Footnote 4, discussing “selection terms” is a fairly long, entirely redacted paragraph. And the last sentence, allowing these technical personnel to also conduct foreign intelligence information queries, is fairly recent.

This language would seem to describe the data integrity role more than it had previously been, specifying the search for high volume numbers, plus whatever appears in footnote 4. And it would seem to limit the use of such information, since it doesn’t permit “intelligence analysis” (notwithstanding the fact that figuring out which selectors are high volume is intelligence analysis, to say nothing about the underlying technical decisions that shape automated search functions). But the first use of the dragnet in current descriptions pertains not to contact chaining at all, but as a resource for tech personnel to identify certain characteristics of call patterns using raw data.

Further, these tech personnel now get to double dip: access raw data in intelligible form to get it ready for querying and something else, and access it to conduct queries. That they even have that authority — explicitly — ought to raise alarm bells. Anything data integrity analysts see while doing data integrity, they can run as a query to access in a form that can be disseminated.

Now, perhaps this alarming structural issue is not being abused or exploited. Perhaps it shouldn’t concern us that a dragnet purportedly serving “foreign intelligence” purposes seems to serve, even before that, a different role entirely, not only tied to any foreign purpose.

But we have had assurances over and over in the last 8 months that the NSA can only access this database for certain narrowly defined foreign intelligence purposes. That wasn’t, by letter of the order, at least, true for the first three years. And by the letter of the order, it’s not true now.

image_print
7 replies
  1. Scott Lazarowitz says:

    It has nothing to do with “foreign intelligence.” The State’s surveillance apparatus is there solely to locate and dispose of dissidents, potential whistleblowers, and those who are critical of the Regime. That is how it is in ALL totalitarian countries.

  2. Anonsters says:

    In the last instance, the order introduces foreign intelligence, but then drops it. The very next sentence shifts the measure of whether the US person information can be disseminated from “foreign intelligence” to “counterterrorism” — and counterterrorism here is not explicitly tied to international terrorism, although the statute requires it to be.

    I’m not understanding what you’re identifying as a problem here, if the two sentences you’re referring to are the ones in the blockquote that immediately follows. If those two sentences are consecutive in the original, the only plausible interpretation is that U.S. person information can only be disseminated outside NSA if it’s judged necessary to understand (1) foreign intelligence information (2) that’s related to counterterrorism.

    So, think of it like this: in order to turn on the ceiling fan, you have to flip a light switch (to give it power) and then you have to tug on the chain to start it. Think of dissemination on this analogy as the fan blades actually spinning. Before U.S. person information can be disseminated outside NSA, NSA has to judge it necessary for foreign intelligence purposes. If it’s not foreign-intel.-necessary, the switch stays off. No matter how hard you tug the chain, the blades don’t whirl. There can be no dissemination. If the identifying information is foreign-intel.-necessary, then prior to its dissemination, NSA has to judge it necessary for counterterrorism purposes. If it’s not, they don’t get to pull the chain. If it is counterterrorism-necessary, they get to pull the chain. When they pull it, the fan blades spin. Dissemination is authorized.

  3. emptywheel says:

    @Anonsters: I read the language as saying, 1) a judgement must be made (passive voice) 2) the way we do that is to review whether it’s counterterrorism related. There’s no review mandated for foreign intelligence.

  4. Anonsters says:

    @emptywheel:

    But your reading makes the first sentence mere surplusage. There would be no reason for it whatsoever, because the second sentence also requires a judgment to be made. That the two judgments described in the two sentences relate to different things (as you say, foreign intel. =/= counterterrorism) militates in favor of treating the first sentence as equally operative. Plus, my reading makes the two sentences symmetrical in structure. In the first, it says “before information identifying a U.S. person may be disseminated,” which makes what follows a threshold condition that, if not met, bars dissemination. The main clause of the first sentence uses the passive voice because it was left it up to the NSA to decide who will get to judge relevance re foreign intelligence. The second sentence presumes the first test is met (“prior to the dissemination of any [info]” versus “before [info] may be disseminated”), then tells NSA that in order to go ahead with dissemination, a specific person/office (“the Chief of Information Sharing Services”) must make another determination, this one about counterterrorism.

    [Edited: I just noticed another interesting difference between the two sentences that supports my reading, if you’re still not convinced. But I need to go get a quesadilla, so I’ll wait to see if I should continue belaboring the point. :P]

  5. Anonsters says:

    My quesadilla is quesadillicious, if anyone was wondering. Here was the other thing(-and-a-half) I noticed before I ran out the door:

    In the first sentence, the judgment to be made is whether the identity of the U.S person (“USP”) is necessary to understand the foreign intelligence information. In the second sentence, the Chief of ISS must determine that “the information identifying the [USP]” is (1) related to counterterrorism information and (2) necessary to understand the counterterrorism information. The information referred to in the first sentence is “information identifying a [USP].” Information may identify someone incidentally. Imagine this scenario.

    Tariq the Terrorist calls Fran the Financial Advisor in the U.S. to get over-the-phone advice about the mechanics of money transfers from Germany to the U.S. Tariq wants to wire money to Uthman the Unenviable who lives in Florida. Sam the Spy is tracking Tariq, and she’s noticed that his M.O. is to use randomly-selected financial people as one-offs, people who don’t know what he’s up to. Sam wants to disseminate information about Tariq’s latest call, but if released raw, it would identify Fran. Given what we know about Tariq’s one-time stands with financiers who know nothing about him, we can judge that Fran’s identity is not necessary to understand Tariq’s latest transfer to Uthman. The information about the phone call to the U.S. to try to transfer money is still relevant, though, and perhaps worth disseminating.

    Now, dream up on your own another scenario where the identity of the USP is necessary to understand Tariq’s tomfoolery. In that case, NSA will have to make a judgment that it is. That could be made at a very low-level, it sounds like, perhaps by the analysts themselves. This is suggested by the phrasing of the second sentence, in which the Chief of the ISS has to determine that the identifying information “is in fact related to counterterrorism information” (emphasis added). In the first sentence, we have someone making a judgment call about relevance of a USP’s identity to understanding foreign intelligence information. In the second sentence, we have someone confirming or disconfirming that the information NSA wants to disseminate is “in fact” related to counterterrorism information and necessary to understand that counterterrorism information.

    On this reading, in fact, it would seem that if a USP’s identity is necessary to understand foreign intelligence information, but not necessary to understand counterterrorism, the part that identifies the USP should be withheld.

    Another random (but sort of interesting) thing to note is that the second sentence requires that the USP identifying information be related to “counterterrorism information,” which suggests that it could be related to any counterterrorism information in any way, not some specific counterterrorism information (note the use of the definite article in the first sentence where it says “necessary to understand the foreign intelligence information”).

  6. Daniel Noel says:

    Another convoluted piece on allegations of abusive surveillance of people and activities by some overarching U.S. agents…What is the big deal anyway? As if there were so many different ways for people to shower, have sex, burp, or use the restroom. Whoever review that data must quickly get bored.

    Besides, intrusive, illegal, unauthorized personal and intimate data collection may not be morally wrong as long as it is justified by the overwhelming and ever-present threat of a repeat of 9/11. Of course, if 9/11 was a false flag operation, the matter would have to be viewed from an entirely different perspective.

    Love,

  7. MtVernonCannabisFarms... says:

    Whenever the BR metadata is accessed for foreign intelligence analysis purposes or using foreign intelligence analysis query tools, an auditable record of the activity shall be generated

    why the qualifier ? why doesn’t it read “Whenever the BR metadata is accessed an auditable record of activity shall be generated.” ?

    ahhh…. “Technical personnel may query the BR metadata using selection terms4 that have not been RAS-approved” . so “Technical personnel” essentially have full legally unaudited run of the system .
    somebody ‘has to remove data on US persons’ so the rest of NSA doesn’t have access to it ;)
    hmmm , now I’m wondering what ‘lewinsky’ data the nsa had … and was paula broadwell an FBI reconstruct

Comments are closed.