emptywheel
Microsoft’s Very Public Spat in the Cloud
A few weeks back, I did a Salon piece laying out how both the US and UK were claiming they can demand data stored in a cloud in any country. The UK is doing that with their new DRIP law, which will increase their ability to demand data from companies within and outside of the UK. The US is doing that by serving warrants on US companies for data stored in their clouds overseas.
The next battle in the latter war will take place on Thursday, at a hearing in NYC. In anticipation, Microsoft’s counsel Brad Smith wrote a WSJ op-ed to make the spat good and public. Here’s how he describes the government’s efforts to use Third Party doctrine to get around border limits on warrants.
Microsoft believes you own emails stored in the cloud, and that they have the same privacy protection as paper letters sent by mail. This means, in our view, that the U.S. government can obtain emails only subject to the full legal protections of the Constitution’s Fourth Amendment. It means, in this case, that the U.S. government must have a warrant. But under well-established case law, a search warrant cannot reach beyond U.S. shores.
The government seeks to sidestep these rules, asserting that emails you store in the cloud cease to belong exclusively to you. In court filings, it argues that your emails become the business records of a cloud provider. Because business records have a lower level of legal protection, the government claims that it can use its broader authority to reach emails stored anywhere in the world.
Courts have long recognized the distinction between a company’s business records and an individual’s personal communications. For example, the government can serve a subpoena on UPS to disclose business records that show where a customer shipped packages, but it must establish probable cause and get a warrant from a judge to look at what a customer put inside.
[snip]
Microsoft believes the higher legal protection for personal conversations should be preserved for new forms of digital communication, such as emails or text and instant messaging.
This is a battle about cloud storage. But it’s also a proxy war for questions of how the government conducts its more secret surveillance — as well as a very public show of opposing the government’s more expansive claims (the amici in this case include other companies — like AT&T — that have never complained about the government’s surveillance requests but that have good reason to make a good show of complaining here).
Which makes it interesting that Microsoft is so aggressively reaching out to the public.
A Good Idea that May Backfire: FISCR Fast Track
I’ve written several posts about Leahy’s USA Freedom already. To recap:
- The bill is definitely an improvement off of USA Freedumber, though it retains “connection” chaining language I’m seriously concerned about
- The bill permits the government to collect “bulky” collections in at least two ways: the use of IP addresses and non-individual persons (aka corporations)
- The bill inexplicably exempts the FBI from reporting requirements on back door searches
My last new concern about the bill pertains to a measure that means well, but might backfire.
The bill includes language designed to provide for appeals of significant issues, first to the FISA Court of Review, and then to SCOTUS.
(j) REVIEW OF FISA COURT DECISIONS.—After issuing an order, a court established under subsection (a) shall certify for review to the court established under subsection (b) any question of law that the court determines warrants such review because of a need for uniformity or because consideration by the court established under subsection (b) would serve the interests of justice. Upon certification of a question of law under this paragraph, the court established under subsection (b) may give binding instructions or require the entire record to be sent up for decision of the entire matter in controversy.
(k) REVIEW OF FISA COURT OF REVIEW DECISIONS.—
(1) CERTIFICATION.—For any decision issued by the court of review established under subsection (b) approving, in whole or in part, an application by the Government under this Act, such court may certify at any time, including after a decision, a question of law to be reviewed by the Supreme Court of the United States.
(2) SPECIAL ADVOCATE BRIEFING.—Upon certification of an application under paragraph (1), the court of review established under subsection (b) may designate a special advocate to provide briefing as prescribed by the Supreme Court.
(3) REVIEW.—The Supreme Court may review any question of law certified under paragraph (1) by the court of review established under subsection (b) in the same manner as the Supreme Court reviews questions certified under section 1254(2) of title 28, United States Code.
That is, it provides a way for FISC to ask FISCR to review their work, and for FISCR to ask SCOTUS to review their work.
To some degree, the more eyes that look at these novel decisions, the better.
But neither the FISCR review nor the SCOTUS review requires even the Special Advocate. While FISCR has, in the past, permitted amici, they (and Yahoo, in the case where Yahoo appealed FISC’s 2007 recision on Protect America Act) were shooting in the dark. the new advocate, such as it exists, would be able to argue before FISCR if the court wanted it.
So to a significant extent that would result in the same people (the government and the Court’s permanent staff, on one side, and the unproven advocate on the other) arguing the same issue over and over. with the courts themselves choosing to have their own decisions certified by the higher courts.
With the potential result that you’d have appellate decisions or even a SCOTUS instruction without ever giving a real adversary a shot at the issue. If FISC responded to the phone dragnet question before the way they have since Snowden leaked details of it, they would have gotten it certified to confirm their authority.
One addition to Leahy’s bill could exacerbate that. His bill requires the FISC to consult with PCLOB on appointees as Advocates. With today’s PCLOB, that’d be a good thing. But if Republicans win back the Senate — especially if Mitch McConnell retains his seat — you’d see another PCLOB member the likes of Elisabeth Collins Cook and Rachel Brand. Both are really smart. But both were architects of the surveillance regime while serving as DOJ Policy AAGs. Add a third of that ilk, and PCLOB could load up the Advocates corp with people like Steven Bradbury.
Moreover, for the foreseeable future, Justice John Roberts will be handpicking these judges, which doesn’t give me a lot of confidence.
I just think the Advocate system is unproven right now. It may work out, it may be gamed to reinforce the dysfunction of the court. And the record of the FISCR — especially Laurence Silberman’s efforts to rule FISA illegal in 2002 — give me no confidence this kind of self-appeal would do anything but sanction bad decisions.
Mind you, the Leahy bill also permits the government to go on denying aggrieved people of review of Section 215 collection, so it’s not clearly anyone else will get standing to challenge this program in particular.
But it seems like the FISC system is so dysfunctional, there’s no reason to pre-empt the possibility of real adversarial court function.
Leahy USA Freedom’s Bulky Corporate Persons
As I said in my post the other day, the definition of Specific Selection Term in the Leahy version of USA Freedom addresses almost all my concerns about bulk collection under USA Freedom Act.
But not all of them.
I have two concerns.
First, some background. The bill actually uses two definitions of “specific selection term.” The definition as it applies to traditional Section 215, PRTT, and NSL collection is,
(i) means a term that specifically identifies a person, account, address, or personal device, or another specific identifier, that is used by the Government to narrowly limit the scope of tangible things sought to the greatest extent reasonably practicable, consistent with the purpose for seeking the tangible things; and [my emphasis]
It defines “address” this way:
ADDRESS.—The term ‘address’ means a physical address or electronic address, such as an electronic mail address, temporarily assigned network address, or Internet protocol address.
That’s my first concern. IP addresses can represent entire companies. And who knows what the NSA might consider “temporarily assigned network addresses”?
Then there’s the difference between that definition of “specific selection term” and the more narrow one used with the prospective contact chaining at telecoms, which is:
CALL DETAIL RECORD APPLICATIONS.—For purposes of an application submitted under subsection (b)(2)(C), the term ‘specific selection term’ means a term that specifically identifies an individual, account, or personal device. [my emphasis]
You’ll note the bill targets “individual” for its contact chaining, but “person” for the rest of Section 215 collection. The obvious reason to do that is if you’re collecting on an entire corporate person, like Western Union (which WSJ and NYT reported CIA uses Section 215 to collect on).
The bill does include limits on what kinds of corporate persons can be collected. The bill explicitly prohibits using electronic communication service providers and cloud providers as specific selection terms, unless they are being investigated.
(II) a term identifying an electronic communication service provider (as that term is defined in section 701) or a provider of remote computing service (as that term is defined in section 2711 of title 18, United States Code), when not used as part of a specific identifier as described in clause (i), unless the provider is itself a subject of an authorized investigation for which the specific selection term is used as the basis of production.
That still seems to leave a whole slew of corporate persons who can be the selection term for collection.
The bill limits that collection in another way, through minimization procedures.
‘(C) for orders in which the specific selection term does not specifically identify an individual, account, or personal device, procedures that prohibit the dissemination, and require the destruction within a reasonable time period (which time period shall be specified in the order), of any tangible thing or information therein that has not been determined to relate to a person who is—
(i) a subject of an authorized investigation;
(ii) a foreign power or a suspected agent of a foreign power;
(iii) reasonably likely to have information about the activities of—
(I) a subject of an authorized investigation; or
(II) a suspected agent of a foreign power who is associated with a subject of an authorized investigation; or
(iv) in contact with or known to—
(I) a subject of an authorized investigation; or
(II) a suspected agent of a foreign power who is associated with a subject of an authorized investigation,
unless the tangible thing or information therein indicates a threat of death or serious bodily harm to any person or is disseminated to another element of the intelligence community for the sole purpose of determining whether the tangible thing or information therein relates to a person who is described in clause (i), (ii), (iii), or (iv)
This language is almost certainly not new — as CDT’s otherwise decent analysis suggests. We know the FISC has been modifying orders more and more in recent years. We don’t know — we have to rely on Congress, blindly — whether these minimization procedures are more strict or (likely, because other parts of this bill are) less restrictive than what the FISC itself has been imposing.
But even the existence of this language — and the differential use of “person” and “individual” — makes it clear the bill still permits the bulk collection of data. It just requires the agency in question to purge the data … sometime.
The question is whether this “agency protocol” — what Chief Justice John Roberts said was not enough to protect Americans’ privacy — is sufficient to protect Americans’ privacy.
I don’t think it is.
First, it doesn’t specify how long the NSA and FBI and CIA can keep and sort through these corporate records (or what methods it can use to do so, which may themselves be very invasive).
It also permits the retention of data that gets pretty attenuated from actual targets of investigation: agents of foreign powers that might have information on subjects of investigation and people “in contact with or known to” suspected agents associated with a subject of an investigation.
Known to?!?! Hell, Barack Obama is known to all those people. Is it okay to keep his data under these procedures?
Also remember that the government has secretly redefined “threat of death or serious bodily harm” to include “threats to property,” which could be Intellectual Property.
So CIA could (at least under this law — again, we have no idea what the actual FISC orders this is based off of) keep 5 years of Western Union money transfer data until it has contact chained 3 degrees out from the subject of an investigation or any new subjects of investigation it has identified in the interim.
In other words, probably no different and potentially more lenient than what it does now.
Leahy Freedom Act Exempts FBI from Counting Its Back Door Searches
As I said in my post last night, Pat Leahy’s version of USA Freedom Act is a significant improvement over USA Freedumber, the watered down House version. But it includes language that no one I’ve met has been able to explain. I believe it may permit the NSA to have its immunized telecom providers contact chain on (at least) location, and possibly worse. Thus, it may well be everyone applauding the bill — including privacy NGOs — are applauding increased use of techniques like location spying even as judges around the country are deeming such spying unconstitutional. I strongly believe this bill may expand the universe of US persons who will be thrown into the corporate store indefinitely, to be subjected to the full brunt of NSA’s analytical might.
But that’s not the part of the bill that disturbs me the most. It’s this language:
‘(3) FEDERAL BUREAU OF INVESTIGATION.—
Subparagraphs (B)(iv), (B)(v), (D)(iii), (E)(iii), and (E)(iv) of paragraph (1) of subsection (b) shall not apply to information or records held by, or queries conducted by, the Federal Bureau of Investigation.
The language refers, in part, to requirements that the government report to Congress:
(B) the total number of orders issued pursuant to section 702 and a good faith estimate of—
(iv) the number of search terms that included information concerning a United States person that were used to query any database of the contents of electronic communications or wire communications obtained through the use of an order issued pursuant to section 702; and
(v) the number of search queries initiated by an officer, employee, or agent of the United States whose search terms included information concerning a United States person in any database of noncontents information relating to electronic communications or wire communications that were obtained through the use of an order issued pursuant to section 702;
These are back door searches on US person identifiers of Section 702 collected data — both content (iv) and metadata (v).
In other words, after having required the government to report how many back door searches of US person data it conducts, the bill then exempts the FBI.
The FBI — the one agency whose use of such data can actually result in a prosecution of the US person in question.
We already know the government has not provided all defendants caught using 702 data notice. And yet, having recognized the need to start counting how many Americans get caught in back door searches, Patrick Leahy has decided to exempt the agency that uses back door searches the most.
And if they’re not giving defendants notice (and they’re not), then this is an illegal use of Section 702.
There is no reason to exempt the FBI for this. On the contrary, if we’re going to count back door searches on US persons, the first place we should start counting is at FBI, where it likely matters most. But the Chair of the Senate Judiciary Committee has decided it’s a good idea to exempt precisely those back door searches from reporting requirements.
How Much Does Keith Alexander’s Patented Solution for Creating Fear Depend on CISA?
Keith Alexander has attempted to explain his million dollar salary demands for cyber consulting to Shane Harris. This story doesn’t necessary hang together any better than his claims about NSA’s spying.
Alexander is worth a million a month, he says (though he already dropped his price to $600K) because he has a unique approach to detecting persistent threats that he plans to patent.
The answer, Alexander said in an interview Monday, is a new technology, based on a patented and “unique” approach to detecting malicious hackers and cyber-intruders that the retired Army general said he has invented, along with his business partners at IronNet Cybersecurity Inc., the company he co-founded after leaving the government and retiring from military service in March.
Alexander developed the technologies behind these patents — which Alexander says would address precisely the kind of attacks he facetiously argues have carried out the greatest transfer of wealth in history, the ones attacking the US — in his spare time.
A source familiarly [sic] with Alexander’s situation, who asked not to be identified, said that the former director developed this new technology on his private time, and that he addressed any potential infractions before deciding to seek his patents.
To which Harris asked the obvious question: if this solution is so great, then why not implement it while he was still in government? Why not save America from that greatest transfer of wealth in history?
Alexander then added that his solution relies on behavioral analysis one of his partners contributed.
Alexander said that his new approach is different than anything that’s been done before because it uses “behavioral models” to help predict what a hacker is likely to do.
[snip]
Alexander said the key insight about using behavior models came from one of his business partners, whom he also declined to name, and that it takes an approach that the government hadn’t considered. It’s these methods that Alexander said he will seek to patent.
Perhaps the best (anonymous) quote Harris includes in his story is a “former national security official with decades of experience in security technology” who says such behavioral models are highly speculative and have never before worked.
So it’s possible that Keith Alexander is simply going to sell his new approach to a bunch of chumps who have gotten rich trading off of algorithms — proof behavioral models “work” even if they don’t work! — and therefore believe they will work to find persistent threats.
The guy who couldn’t find Edward Snowden absconding with thousands of files and his friends the big banks are going to start policing their networks by using algos to find suspicious behavior.
Harris sort of alludes to one problem with this scheme. Alexander used his perch at DIRNSA to create this market. As Harris points out, that’s in part because Wiper — a variant of the StuxNet attack developed under Alexander’s tenure — is what the banks are so afraid of.
That will come as a supreme irony to many computer security experts, who say that Wiper is a cousin of the notorious Stuxnet virus, which was built by the NSA — while Alexander was in charge — in cooperation with Israeli intelligence.
That is, Alexander will get rich helping banks defeat the weapons he released in the first place.
More generally, too, this fear exists because Alexander sowed it. The banks are responding to the intelligence claims Alexander has been making for years, whether or not a real threat exists behind it (and whether not resilience would be a better defense than Alexander’s algos).
One more thing: as far as we know, in addition to inventing this purportedly new technology in his free time, Alexander was consulting with his partners — which as far as we know include Promontory Financial Group and Chertoff — while he was DIRNSA. So it’s not just the underlying technology, but the discussions of partnership, that likely derive from Alexander’s time at DIRNSA.
And that seems to be the fourth part of Alexander’s magic sauce (in addition to the tech developed on the government dime, his ability to sow fear, and partnerships laid out while still in the private sector). After all, with Alexander out of his NSA, where will he and his profitable partners get the data they need to model threats? How much of this model will depend on the Cyber Information sharing plan that Alexander has demanded for years? How much will Alexander’s privatized solutions to the problem he couldn’t solve at NSA depend on access to all the information the government has, along with immunity?
To what degree is CISA about making Keith Alexander rich?
Improved USA Freedom Retains “Connection” Chaining and “Foreign Intelligence” Retention
Thanks to this NYT editorial, everyone is talking about Patrick Leahy’s version of USA Freedom, which he will introduce tomorrow.
Given what I’ve heard, my impression is the editorial is correct that Leahy’s bill is a significant improvement off of USA Freedumber.
That’s not saying much.
It tightens the definition for Specific Selection Term significantly (though there may still be limited cause for concern).
It improves the FISA Advocate (but not necessarily enough that it would be meaningful).
It improves transparency (but there’s one aspect of “improved” transparency that actually disturbs me significantly).
It pretends to fix concerns I had about the PRTT minimization, but I don’t think it succeeds.
Still, an improvement off of the USA Freedumber.
I’m not convinced that makes it an acceptable improvement off of the status quo (especially the status quo requiring court approval for each seed). That’s because — from what I’ve heard — Leahy’s bill retains the language from USA Freedumber on contact chaining, which reads,
(iii) provide that the Government may require the prompt production of call detail records—
(I) using the specific selection term that satisfies the standard required under subsection (b)(2)(C)(ii) as the basis for production; and
(II) using call detail records with a direct connection to such specific selection term as the basis for production of a second set of call detail records;
Now, I have no idea what this language means, and no one I’ve talked to outside of the intelligence committees does either. It might just mean they will do the same contact chaining they do now, but if it does, why adopt this obscure language? It may just mean they will correlate identities, and do contact chaining off all the burner phones their algorithms say are the same people, but nothing more, but if so, isn’t there clearer language to indicate that (and limit it to that)?
But we know in the equivalent program for DEA – Hemisphere – the government uses location to chain people. So to argue this doesn’t include location chaining, you’d have to argue that NSA is satisfied with less than DEA gets and explain why the language of this bill specifically prohibits it. (The bill — as USA Freedumber before it did — requires NSA to use Call Detail Records at each step; that may or may not impose such limits.)
I remain concerned, too, that such obscure language would permit the contact chaining on phone books and calendars, both things we know NSA obtains overseas, both things NSA might have access to through their newly immunized telecom partners.
In addition, Leahy’s bill keeps USA Freedumber’s retention language tied to Foreign Intelligence purpose, allowing the NSA to keep all records that might have a foreign intelligence purpose.
Why, after having read PCLOB’s 702 report stating that, “when an NSA analyst recognizes that [a communication] involves a U.S. person and determines that it clearly is not relevant to foreign intelligence or evidence of a crime,” destruction of it, which is required by the law, “rarely happens,” would anyone applaud a Section 215 bill that effectively expands retention using that very same utterly meaningless “foreign intelligence” language? And with it may expand the permitted dissemination of such data?
The bill is definitely an improvement over USA Freedumber. But until someone explains what that connection chaining language does — and includes limiting language to make sure that’s all it will ever do — I have no way of knowing whether Leahy’s bill is better than the status quo. As it is, however, it is certainly conceivable Leahy’s bill will result in more innocent Americans ending up in the corporate store.
(I may have two more new concerns about Leahy’s bill, but I’ll hold those until I see what precise language the bill uses for them.)
The Intelligence Propaganda Complex
Matt Apuzzo has a remarkable story about the efforts DOJ is making to protect the records of United Against Nuclear Iran, a purported NGO that shames entities potentially doing business with Iran.
Greek shipping magnate Victor Restis is suing the group for defamation, claiming they falsely accused him of being an Iranian front.
The group said it had uncovered a letter proving there was a plan to do business in Iran. It also accused Mr. Restis of using his ships in support of Iran’s oil industry.
Mr. Restis said the letter was fraudulent, the illicit Iranian deal never existed, and his ships made only authorized humanitarian shipments. He accused the group of shaking down companies for donations; the group in turn accused him of being a “master criminal.”
The group said it based its accusations on “valid research, credible documents, distinguished relationships, and pre-eminent sourcing.” In court, Mr. Restis demanded that the group disclose those documents and its relationships.
Soon after that demand, Mr. Restis said he was approached by an Israeli businessman, Rami Ungar, with no direct connection to United Against Nuclear Iran.
According to court documents filed by Mr. Restis’s lawyers, Mr. Ungar knew details about the case and said he was “authorized to try to resolve the issues” on behalf of the group’s supporters.
It was not clear who those supporters were. Like many nonprofit groups, its donor list is secret. Mr. Restis’s lawyers said in a letter to the judge in April that they had uncovered information that United Against Nuclear Iran “is being funded by foreign interests.”
DOJ suggested they might claim a law enforcement exception to protect the files, though it has not yet formally claimed such a privilege. That might suggest the files are Treasury files that may soon be used to impose sanctions on Restis. Or perhaps it means they have files that don’t meet Treasury’s standards for imposing sanctions, and UANI exists to shame people where sanctions are unavailable. In any case, Restis wants to know how Ungar got them; I’d like to know precisely what UANI is getting from whom.
Apuzzo lists some of the characters who are behind the group: former Mideast Peace Envoy Dennis Ross, Fran Townsend, and Joe Lieberman. Otto Reich, whose role in Iran-Contra (as opposed to his role in trying to overthrow Hugo Chavez in the 2002 coup) involved illegally funneling taxpayer dollars for the purposes of lobbying, is of particular note. Restis is particularly interested in interviewing UANI advisor Meir Dagan, the long-time head of Mossad; Restis believes Dagan provided the documents to Ungar. In addition, Richard Dearlove, who was in charge of sexing up the British case for war in 2003 when he was MI6, also advises the group.
in other words, it’s a classic case of a quasi-governmental group, one that apparently plays an extra-legal purpose in the campaign to isolate Iran (to be fair, most, though not all, of its advisors have worked hard to stave off war). And Restis’ efforts to get some kind of justice against it may be stymied by US claims they’ve got privileged interests in the case.
The entire episode raises some very good questions about what goes into isolating our adversaries.
Cofer Black Gets to Rebut Torture Report that Shouldn’t Include Him
In a piece that gets at some of the points of leverage between the White House and CIA over torture, Mark Mazzetti describes George Tenet’s effort to “challenge” the torture report.
It suggests Brennan’s close ties to Tenet — Brennan was once Tenet’s Chief of Staff – led the CIA Director to reach out to Tenet to lead pushback. It describes how Brennan’s close ties to Obama Chief of Staff Denis McDonough from when he served as White House Counterterrorism Czar led McDonough to intervene when Dianne Feinstein tried to require any CIA review to take place in Senate Intelligence Committee space.
All that’s beside the real source of CIA’s power over the White House — the fact that torture operated as a Presidentially-authorized covert op for years, as has the drone program, which means CIA has the ability to implicate both George Bush personally (and Obama, in illegal drone strikes), as well as the Office of the President more generally.
My favorite detail, however, is that Cofer Black has also been involved in this pushback campaign.
Just after the Senate Intelligence Committee voted in April to declassify hundreds of pages of a withering report on the Central Intelligence Agency’s detention and interrogation program, C.I.A. Director John O. Brennan convened a meeting of the men who had played a role overseeing the program in its seven-year history.
The spies, past and present, faced each other around the long wooden conference table on the seventh floor of the C.I.A.’s headquarters in Northern Virginia: J. Cofer Black, head of the agency’s counterterrorism center at the time of the Sept. 11 attacks; the undercover officer who now holds that job; and a number of other former officials from the C.I.A.’s clandestine service. Over the speakerphone came the distinctive, Queens-accented voice of George J. Tenet.
Over the past several months, Mr. Tenet has quietly engineered a counterattack against the Senate committee’s voluminous report, which could become public next month. [my emphasis]
According to Ken Dilianian’s version of the same story, Black will not be allowed to preview the report — he’s probably among the dozen people who thought they could review it but recently learned they would not be able to.
About a dozen officials were called in recent days and told they could read the executive summary at a secure room at the Office of Director of National Intelligence, as long as they agreed not to discuss it, four former officials said.
Then, on Friday, CIA officials called them and told them that due to a miscommunication, only former CIA directors and deputy directors would be given that privilege. Former directors Michael Hayden, Porter Goss and George Tenet have been invited to read it, as have former acting directors John McLaughlin and Michael Morell.
Black’s involvement, of course, should be a story unto itself.
According to the CIA’s official version of torture, it got authorized under the September 17, 2001 Finding by language authorizing the capture and detention of top Al Qaeda officials. But they didn’t start considering torture until they picked up Abu Zubaydah at the end of March in 2002. They didn’t start torturing, the official story goes, until DOJ gave them the green light in August 1, 2002.
Why, then, would Black need to be involved in the torture pushback?
He left the Counterterrorism Director spot in May 2002, well before the torture started — at least according to the CIA version, but not the personal experience of Ibn Sheikh al-Libi and Binyam Mohamed, both of whom got tortured before Black’s departure. In his book Jose Rodriguez claims, falsely, the torture program started in June, and he led it. If this official CIA chronology is correct, Black should have had no role — and no personal interest — in the torture program.
And yet there he is with the other torturers, leading pushback.
Even in their pushback effort, then, the CIA proves that they’ve been lying for years.
NSA Got Into Bed with the Saudis Just Before Our Technical Cooperation Agreement Expanded
In February 2011, around the time the CIA took over the hunt for Anwar al-Awlaki, NSA started collaborating with Saudi Arabia’s Ministry of Interior’s (MOI) Technical Assistance Directorate (TAD), under the umbrella of CIA’s relationship with MOI (it had previously cooperated primarily with the Kingdom’s Ministry of Defense).
On August 15, 2011, hackers erased the data on two-thirds of the computers at Saudi Aramco; American sources claim Iran was the culprit.
On September 30, 2011, CIA killed Anwar al-Awlaki, using drones operated from a base on Saudi soil.
On November 5, 2012, King Abdullah named close John Brennan ally Mohammed bin Nayef (MbN) Minister of the Interior; MbN had for some time been our top counterterrorism partner in the Kingdom.
On December 11, 2012, James Clapper expanded NSA’s Third Party SIGINT relationship with the Kingdom of Saudi Arabia, for the first time formally including the Ministry of Interior’s Technical Affairs Directorate.
Between January 14 and 16, 2013 MbN traveled to Washington and met with just about every top National Security person (many of whom, including Brennan, were just assuming new jobs). On January 16, MbN and Hillary Clinton renewed and expanded the Technical Cooperation Agreement initiated in 2008. The TCA was modeled on the JECOR program used from the late 1970s until 2000 to recycle US dollars into development programs in Saudi Arabia; in this more recent incarnation, the Saudis recycle dollars into things like a 30,000 mercenary army and other military toys for internal stability and border control. Last year’s renewal — signed just over a month after Clapper made the Saudis full Third Person partners – added cybersecurity to the portfolio. The TCA — both the existing security resources and its expansion under close ally MbN — shored up the power base of one of our closest partners (and at a time when we were already panicking about Saudi succession).
In other words, in addition to expanding Saudi capabilities at a time when it has been cracking down on peaceful dissent, which is what the Intercept story on this document discusses, by giving the Saudi MOI Third Party status, we added to the power of a key ally within the royal family, and did so at a time when the TCA was already shoring up his power base.
We did so, the Information Paper makes clear, in part because MOI has access to internal Saudi telecommunications. While the Information paper talks about AQAP and Iran’s Republican Guard, they are also targeting Saudi targets.
And these new capabilities? They get coordinated through Chief of Station in Riyadh, the CIA. John Brennan’s agency.
It’s all very tidy, don’t you think?
NSA’s Disingenuous Claims about EO 12333 and the First Amendment
Thanks to John Napier Tye’s Sunday op-ed, some surveillance watchers are just now discovering EO 12333, which I’ve written some 50 posts about over the last year.
Back in January, I focused on one of the most alarming disclosures of the 2009 phone dragnet problems, that 3,000 presumed US person identifiers were on an alert list checked against each day’s incoming phone dragnet data. That problem — indeed, many of the problems reported at the beginning of 2009 — arose because the NSA dumped their Section 215 phone dragnet data in with all the rest of their metadata, starting at least as early as January 4, 2008. It took at least the better part of 2009 for the government to start tagging data, so the NSA could keep data collected under different authorities straight, though once they did that, NSA trained analysts to use those tags to bypass the more stringent oversight of Section 215.
One thing that episode revealed is that US person data gets collected under EO 12333 (that’s how those 3,000 identifiers got on the alert list), and there’s redundancy between Section 215 and EO 12333. That makes sense, as the metadata tied to the US side of foreign calls would be collected on collection overseas, but it’s a detail that has eluded some of the journalists making claims about the scope of phone dragnet.
Since I wrote that early January post, I’ve been meaning to return to a remarkable exchange from the early 2009 documents between FISC Judge Reggie Walton and the government. In his order for more briefing, Walton raised questions about tasking under NSA’s SIGNIT (that is, EO 12333) authority.
The preliminary notice from DOJ states that the alert list includes telephone identifiers that have been tasked for collection in accordance with NSA’s SIGINT authority. What standard is applied for tasking telephone identifiers under NSA’s SIGINT authority? Does NSA, pursuant to its SIGINT authority, task telephone identifiers associated with United States persons? If so, does NSA limit such identifiers to those that were not selected solely upon the basis of First Amendment protected activities?
The question reveals how little Walton — who had already made the key judgments on the Protect America Act program 2 years earlier — knew about EO 12333 authority.
I’ve put NSA’s complete response below the rule (remember “Business Records” in this context is the Section 215 phone dragnet authority). But basically, the NSA responded,
- Even though the alert list included IDs that had not been assessed or did not meet Reasonable Articulable Suspicion of a tie to one of the approved terrorist groups, they at least had to have foreign intelligence value. And occasionally NSA’s counterterrorism people purge the list of non-CT IDs.
- Usually, NSA can only task (a form of targeting!) a US person under a FISA authority.
- Under EO 12333 and other related authorities, NSA can collect SIGINT information for foreign and counterintelligence purposes; its collection, retention, and dissemination of US person is governed by Department of Defense Regulation 5240.1-R and a classified annex. (see page 45 for the unclassified part of this)
- Since 2008, if the NSA wants to target a US person overseas they need to get and comply with a FISA order.
- NSA provides First Amendment protection in two ways — first, by training analysts to spy “with full consideration of the rights of United States persons.”
- NSA provides First Amendment protection under EO 12333 by prohibiting NSA “from collecting or disseminating information concerning US persons’ ‘domestic activities’ which are defined as ‘activities that take place in the domestic United States that do not involve a significant connection to a foreign power, organization, or person.’”
The First Amendment claims in the last two bullets are pretty weak tea, as they don’t actually address First Amendment issues and contact chaining is, after all, chaining on associations.
That’s all the more true given what we know had already been approved by DOJ. In the last months of 2007, they approved the contact chaining through US person identifiers of already-collected data (including FISA data). They did so by modifying DOD 5240.1 and its classified annex so as to treat what they defined (very broadly) as metadata as something other than interception.
The current DOD procedures and their Classified Annex may be read to restrict NSA’s ability to conduct the desired communications metadata analysis, at least with respect to metadata associated with United States persons. In particular, this analysis may fall within the procedures’ definition of, and thus restrictions on, the “interception” and “selection” of communications. Accordingly, the Supplemental Procedures that would govern NSA’s analysis of communications metadata expressly state that the DOD Procedures and the Classified Annex do not apply to the analysis of communications metadata. Specifically, the Supplemental Procedures would clarify that “contact chaining and other metadata analysis do not qualify as the ‘interception’ or ‘selection’ of communications, nor do they qualify as ‘us[ing] a selection term,’ including using a selection term ‘intended to intercept a communication on the basis of. .. [some] aspect of the content of the communication.” Once approved, the Supplemental Procedures will clarify that the communications metadata analysis the NSA wishes to conduct is not restricted by the DOD procedures and their Classified Annex.
Michael Mukasey approved that plan just as NSA was dumping all the Section 215 data in with EO 12333 data at the beginning of 2008 (though they did not really roll it out across the NSA until later in 2009).
Nowhere in the government’s self-approval of this alternate contact chaining do they mention First Amendment considerations (or even the domestic activities language included in their filing to Walton). And in the rollout, they explicitly permitted starting chains with identifiers of any nationality (therefore presumably including US person) and approved the use of such contact chaining for purposes other than counterterrorism. More importantly, they expanded the analytical function beyond simple contact chaining, including location chaining.
All with no apparent discussion of the concerns a FISC judge expressed when data from EO 12333 had spoiled Section 215 data.
We will, I expect, finally start discussing how NSA has been using EO 12333 authorities — and how they’ve represented their overlap with FISA authorized collection. This discussion is an important place to start. Continue reading
Emptywheel Twitterverse
emptywheel
RT @JasonLeopold: Today is National Whistleblower Appreciation Day. Good timing cause here's a rpt you should read https://t.co/5WmoImBquz
emptywheel
@onekade Next thing you know you'll be eating brown rice.
JimWhiteGNV
RT @jricole: Israel Bombs Gaza back to Stone Age: Razes only Power Plant & ... - http://t.co/R0nRJ4HCQh http://t.co/e71HDnb6jT
bmaz
RT @OrinKerr: @bmaz Compare to pre-911 CA4 op w no redactions but no analysis. http://t.co/0DDAnFqZIf @JoshMBlackman
JimWhiteGNV
RT @WilliamsJon: Remarkable @AFP photo: not snow but #IDF evacuation notices warning residents in #Gaza to leave their homes. http://t.co/I…
bmaz
RT @actongriscom: A few days ago @wolfblitzer was actually formulating the IDF spokesman's talking point for him, on camera. #Gaza @bmaz @…
JimWhiteGNV
RT @SIGARHQ: US has funded $104 billion for Afghan reconstruction & requested another $5.8 billion for 2015 http://t.co/arPiZa1qM4
JimWhiteGNV
RT @erinmcunningham: UN: fragment analysis says Israel artillery hit Jabaliya school w/at least 3 impacts http://t.co/MII58tGqAh UN informe…
bmaz
@SpaceCoastLaw @CNN Exactly. The sanitization and promotion of war crimes. It's all so regular!
bmaz
RT @SpaceCoastLaw: @bmaz @CNN One with a lovely & authoritative Brit accent which makes everything seem so proper. Good job, casting!