USA Freedom Must Explicitly Require NSA and CIA to Comply with Law’s Minimization Procedures

I know I’ve had a lot of mostly unenthusiastic things to say about even Pat Leahy’s version of the USA Freedom Act.

  • It explicitly exempts FBI from counting back door searches
  • It may not do anything to existing non-electronic communication bulk programs, because it probably permits the use of corporate persons as Specific Selection Terms
  • The “connection chaining” may permit expanded access to smart phone data
  • It retains USA Freedumber’s “foreign intelligence” retention language

Having read about half of last week’s Internet Dragnet document dump so far, I’m increasingly worried about two details I’ve already raised.

I suspect, unless the law explicitly imposes minimization procedures on NSA (and CIA, which reportedly operates the bulky Western Union dragnet), they will evade the bill’s most stringent minimization procedures.

As I noted in November and PCLOB noted in January, the business records provision was explicitly written for FBI, not other intelligence agencies. As a result, the language in it requiring minimization procedures did not — and still would not under Leahy Freedom (to say nothing of USA Freedumber) — require minimization procedures from Agencies beyond FBI. For example, unless I’m misreading how the law would be implemented, this is what would still be in place with regards to minimization procedures.

Applications have to lay out minimization procedures. But the law only requires they apply to FBI.

(D) an enumeration of the minimization procedures adopted by the Attorney General under subsection (g) that are applicable to the retention and dissemination by the Federal Bureau of Investigation of any tangible things to be made available to the Federal Bureau of Investigation based on the order requested in such application.

The judge reviews the minimization procedures in the application to make sure they comply with (g), and then includes an order they be followed in his order approving the application.

(1) Upon an application made pursuant to this section, if the judge finds that the application meets the requirements of subsections (a) and (b) and that the minimization procedures submitted in accordance with subsection (b)(2)(D) meet the definition of minimization procedures under subsection (g), the judge shall enter an ex parte order as requested, or as modified, approving the release of tangible things. Such order shall direct that minimization procedures adopted pursuant to subsection (g) be followed.

And as I’ve already noted, the entire section (g) devoted to minimization explicitly applies to just FBI.

The Attorney General shall adopt specific minimization procedures governing the retention and dissemination by the Federal Bureau of Investigation of any tangible things, or information therein, received by the Federal Bureau of Investigation in response to an order under this subchapter.

What’s particularly crazy about this is that the clause was changed to take out deadlines imposed in the 2006 renewal. In other words, they changed this clause, but left in the limits for most minimization procedures to just FBI.

There are two new kinds of minimization that the bill’s supporters are (in my mind, foolishly) very excited about. First, there’s new language in (g) that applies to any non-targeted collection (otherwise known as bulky collection).

(C) for orders in which the specific selection term does not specifically identify an individual, account, or personal device, procedures that prohibit the dissemination, and require the destruction within a reasonable time period (which time period shall be specified in the order), of any tangible thing or information therein that has not been determined to relate to a person who is—

(i) a subject of an authorized investigation;

(ii) a foreign power or a suspected agent of a foreign power;

(iii) reasonably likely to have information about the activities of—

(I) a subject of an authorized investigation; or

(II) a suspected agent of a foreign power who is associated with a subject of an authorized investigation; or

(iv) in contact with or known to—

(I) a subject of an authorized investigation; or

(II) a suspected agent of a foreign power who is associated with a subject of an authorized investigation, unless the tangible thing or information therein indicates a threat of death or serious bodily harm to any person

I lay out here why this language probably doesn’t change the status quo, and could conceivably be more permissive than the minimization procedures FISC currently imposes on large numbers (probably a majority) of its orders. And again–that’s under the “FBI” section, so presumably would not explicitly apply to CIA’s reported Western Union bulk program.

Finally, there’s the one section — as part of the b(2)(C) Call Detail Record provision — that doesn’t explicitly apply only to FBI. It requires the Agency in question to adopt minimization procedures, but unlike all the minimization procedures for the traditional collection, the law dose not require the FISC to approve the minimization procedures!

(I) adopt minimization procedures that require the prompt destruction of all call detail records produced under the order that the Government determines are not foreign
3 intelligence information; and

(II) destroy all call detail records produced under the order as prescribed by such procedures.

I’ve noted that, given PCLOB’s and WaPo’s review of NSA’s implementation of its minimization procedures under Section 702 (which impose an identical destruction requirement), this language is meaningless. We know NSA (and also FBI and CIA) would just call everything Foreign Intelligence and keep it!

Worse still, what this language would do, I’m increasingly sure, is explicitly change the dissemination rules for Section 215 data. Currently, Section 215 queries can only be shared if an NSA official certifies the data has a counterterrorism purpose and is necessary to understand the intelligence. By permitting the retention of language that has a foreign intelligence purpose, this language would permit foreign intelligence dissemination.

None of this is surprising. What this language does — rather than imposing some new protection — is to weaken current protections to USSID 18 standards, NSA’s default minimization procedures for all their data.

And the reason I’m increasingly certain all this is designed to sustain and at least as pertains NSA weaken the status quo is because of what we’ve now seen in the End-to-End Reports for both the Internet and phone  dragnets. In them, after 5 and 3 years of collection (respectively) the government said to the Court: “Gee willikers! Sure you’ve told us 21 or 12 times not to share this data outside of a counterterorrism focus. But golly, we didn’t notice that and we’ve just been using our default USSID standard which is also in the orders! And sorry, by the way, that means that CIA, FBI, and NCTC have been able to log right into query results directly!”

I’m also willing to bet a quarter there is or at least was an opinion somewhere judging that NSA didn’t have to pay attention to the minimization procedures imposed by the FISC because obviously they’re only intended for the FBI. Takers?

Which, by passing Leahy’s bill, Congress would ratify explicitly.

This was — as the Internet dragnet documents make clear — the plan from 2002. NSA conducts this analysis and CIA and FBI tap right into it. Which is presumably what — after a period of 5 years of heightened protection — we would return to under Leahy’s Freedom.

One more detail that suggests this is the plan.

As I’ve noted elsewhere, Leahy’s bill adds meaningless language to try to reassure that by assigning “privacy procedures” under the PRTT authority to the Attorney General, it wouldn’t take such authority out of FISC hands. But there is a consistent thread here: with both PRTT and emergency procedures, the AG assumes the authority the FISC currently has. And with Section 215 collection, everything reverts to what the Agencies in question were doing until they got caught in 2009.

I’d say that’s pretty good indication it’s all part of the plan.

Marcy has been blogging full time since 2007. She’s known for her live-blogging of the Scooter Libby trial, her discovery of the number of times Khalid Sheikh Mohammed was waterboarded, and generally for her weedy analysis of document dumps.

Marcy Wheeler is an independent journalist writing about national security and civil liberties. She writes as emptywheel at her eponymous blog, publishes at outlets including the Guardian, Salon, and the Progressive, and appears frequently on television and radio. She is the author of Anatomy of Deceit, a primer on the CIA leak investigation, and liveblogged the Scooter Libby trial.

Marcy has a PhD from the University of Michigan, where she researched the “feuilleton,” a short conversational newspaper form that has proven important in times of heightened censorship. Before and after her time in academics, Marcy provided documentation consulting for corporations in the auto, tech, and energy industries. She lives with her spouse and dog in Grand Rapids, MI.

12 replies
  1. earlofhuntingdon says:

    One would think that repeated intentional violations of the law would prove criminal intent and, analogous to financial crimes, systemic harm. It ought to put paid to the obvious bogus claim that all this behavior is unintentional, at worst negligent. But then Chief Justice Roberts and his judicial appointees seem never to have met an executive branch overreach they couldn’t warmly embrace.

    • wallace says:

      quote”One would think that repeated intentional violations of the law would prove criminal intent and, analogous to financial crimes, systemic harm.”unquote

      It depends on which way the wind is blowing on planet x. Back here on this one, thinking like that is dangerous to ones well being.

  2. blueba says:

    As I understand it the 7 page memo which “justified” or “made legal”the killing of US citizens without due process is still in effect and that the US government claims the right to kill anyone anytime anywhere.

    Given this it is difficult to see that the US legal system is legitimate.

    So new laws twiking the spy system will not be any more legitimate or enforceable than the ones in regard to due process which have been swept aside.

    • wallace says:

      quote”Given this it is difficult to see that the US legal system is legitimate. “unquote

      Legitimate is only relative to the parallel universe they live in. Legal Imperialism is another animal altogether. That is the universe we live in.

  3. wallace says:

    In other words….
    1. It explicitly exempts FBI from counting back door searches. CHECK

    2. It may not do anything to existing non-electronic communication bulk programs.CHECK

    3. Because it probably permits the use of corporate persons as Specific Selection Terms,
    the “connection chaining” may permit expanded access to smart phone data. CHECK

    4 It retains USA Freedumber’s “foreign intelligence” retention language. CHECK
    CHECK

    5. I suspect, (snip for clarity)… they will evade the bill’s most stringent minimization
    procedures. CHECK

    6. The entire section (g) devoted to minimization explicitly applies to just FBI. CHECK

    7. The clause was changed to take out deadlines imposed in the 2006 renewal. CHECK

    8. This language probably doesn’t change the status quo, and could conceivably be more permissive than the minimization procedures FISC currently imposes on large numbers of its orders. CHECK

    9. Finally, there’s the one section the law that requires the Agency in question to adopt minimization procedures, but…. doES not require the FISC to approve the minimization procedures! CHECK

    10. Given PCLOB’s and WaPo’s review of NSA’s implementation of its minimization procedures under Section 702, this language is meaningless. CHECK

    11. The business records provision was explicitly written for FBI, and as a result, the language in it requiring minimization procedures did not — and still would not under Leahy Freedom require minimization procedures from Agencies beyond FBI. CHECK

    12. Worse still, what this language could do, is explicitly change the dissemination rules for Section 215 data. CHECK

    So, in summary…

    A. None of this is surprising. CHECK

    B. What this language does is weaken current protections to USSID 18 standards. CHECK

    C. Judging that NSA didn’t have to pay attention to the minimization procedures imposed by the FISC , obviously they’re only intended for the FBI. Which, by passing Leahy’s bill, Congress would ratify explicitly.CHECK

    D. The plan from 2002 was NSA conducts this analysis and CIA and FBI tap right into it, which under Leahy’s bill, they would go right back to doing it, even after having been caught and their hands slapped for 5 years. CHECK

    E. Leahy’s bill adds OOD supplied meaningless language to insure every American is bewildered to the point they give up and accept the loss of the 4th Amendment..forever. CHECK

    and finally..

    F. It’s all part of the plan. CHECK and DOUBLE CHECK

    Now..see, wasn’t that easy?

    Now, what’s for dinner?

  4. Bitter Angry Drunk says:

    Codifying previous government law-breaking sure makes it easy to look forward and not back.

    • wallace says:

      quote”I wonder what lies they told Leahy that he really wanted to hear.”unquote

      1. We won’t come in your mouth.
      2. Your check is in the mail.
      3. We’ll burn our evidence.
      4. See #1

    • emptywheel says:

      To be fair, Leahy’s problem (one of them, anyway) is he doesn’t have votes for real reform in SJC, and if the bill goes through SSCI, it’ll be far, far worse. So his bill represents what Sheldon Whitehouse likes, not what he likes.

  5. wallace says:

    As much as I hate to post unrelated information on emptywheels current thread, sometimes I feel there are current events of such magnitude, that I dare being perceived as a troll. This is one of those times. Although I’m sure Marcy would have something to say about it, I know her plate is pretty full with all the doc releases in the last week and may not have time to break her pace. In that light, you REALLY need to read this as this revelation that just occurred in “Jewel vs NSA”, is so far beyond anything within my memory of groundshaking government overreach, it’s barely comprehensible….

    https://www.techdirt.com/articles/20140813/23203228207/unsealed-jewel-v-nsa-transcript-doj-has-nothing-contempt-american-citizens.shtml#c248

Comments are closed.