emptywheel

1 2 3 835

No, Obama Doesn’t Need Legislation to Fix the Dragnet–Unless the “Fix” Isn’t One

In an editorial calling on Congress to pass the USA Freedom Act, the USA Today makes this claim.

Obama’s proposal last January — to leave the data with phone companies, instead of with the government — can’t happen without a new law. And, as in so many other areas, the deeply divided Congress has failed to produce one.

I don’t know whether that is or is not the case.

I do know 3 Senate Intelligence Committee members say it is not the case.

Ron Wyden, Mark Udall, and Martin Heinrich wrote Obama a letter making just this point in June. They argued that Obama could accomplish most, if not all, of what he claimed he wanted without legislation, largely with a combination of Section 215 Orders to get hops and Pen Registers to get prospective collection.

[W]e believe that, in the meantime, the government already has sufficient authorities today to implement most, if not all, of the Section 215 reforms laid out in your proposal without delay in a way that does not harm our national security. More comprehensive congressional action is vital, but the executive branch need not wait for Congress to end the dragnet collection of millions of Americans’ phone records for a number of reasons.

First, we believe that the Foreign Intelligence Surveillance Court’s (FISC) expansive interpretation of the USA PATRIOT Act to allow the collection of millions of Americans’ phone records makes it likely that the FISC would also agree to a more narrowly-drawn interpretation of the law, without requiring further congressional action. Certainly, it seems likely that the FISC would permit the executive branch to use its current authorities to obtain phone records up to two “hops” from a suspicious phone number or to compel technical assistance by and compensation for recipients of court orders. Unless the FISC has already rejected such a request from the government, it does not seem necessary for the executive branch to wait for Congress before taking action.

Second, we believe that the FISC would likely approve the defined and limited prospective searches for records envisioned under your proposal pursuant to current USA PATRIOT Act Section 214 pen register authorities, given how broadly it has previous interpreted these authorities. Again, we believe it is vital for Congress to enact reforms, but we also believe that the government has sufficient authorities today under the USA PATRIOT Act to conduct these targeted prospective searches in the interim.

Finally, although we have seen no evidence that the government has needed the bulk phone records collection program to attain any time-sensitive objectives, we agree that new legislation should provide clear emergency authorities to allow the government to obtain court approval of individual queries after the fact under specific circumstances. The law currently allows prospective emergency acquisitions of call records under Section 403 of the Foreign Intelligence Surveillance Act (FISA), and the acquisition of past records without judicial review under national security letter authorities. While utilizing a patchwork of authorities is not ideal, it could be done on an interim basis, while Congress works to pass legislation.

Just weeks before they sent this, Deputy Attorney General James Cole had seemed to say they could (if not already were) getting hybrid orders, in that case mixing phone and location. So it seems like DOJ is confident they could use such hybrid orders, using Section 215 for the hops and Pen Registers for the prospective collection (though, given that they’re already using Section 215 for prospective collection, I’m not sure why they’d need to use hybrids to get anything but emergency orders).

And it makes sense. After all, the public claims about what the Call Detail Record provision would do, at least, describe it as a kind of Pen Register on steroids, 2-degrees of Pen Register. As the Senators suggest, FBI already gets two-degree information of historical records with mere NSLs, so it’d be surprising if they couldn’t get 2 degrees prospectively with a court order.

So at least according to three members of the Senate Intelligence Committee, USA Today is simply wrong.

Mind you, I’m not entirely convinced they’re right.

That’s because I suspect the new CDR provision is more than a Pen Register on steroids, is instead something far more intrusive, one that gets far beyond mere call records. I suspect the government will ask the telecoms to chain on location, address books, and more — as they do overseas — which would require far more than a prospective Pen Register and likely would require super immunity, as the bill provides.

I suspect the Senators are wrong, but if they are, it’s because Obama (or his Intelligence Community) wants something that is far more invasive then they’ve made out.

Still, for USAF supporters, there seems no question. If all Obama wants to replace the phone dragnet is prospective 2-degree call (not connection) chaining on RAS targets, he almost certainly has that authority.

But if he needs more authority, then chances are very good he’s asking for something far more than he has let on.

Update: Note, USAT makes at least one other clear error in this piece, as where it suggests the “the program” — the phone dragnet — imposes costs on cloud companies like Microsoft and Google.

Another Attorney-Client Conversation Spied On

Last month, I laid out the several attorney client conversations to which Raez Qadir Khan was party that the government wiretapped. Among the 7 privileged conversations wiretapped by the government was a January 2010 conversation he had with his immigration attorney after being told by the FBI he could not travel to see his family.

One of the defendants in a key CO terrorism case just revealed in a filing that he, too, was wiretapped when conversing with his immigration attorney’s office.

Bakhtiyor Jumaev, who through co-defendant Jamshid Muhtorov was the first to get notice his prosecution stemmed from FISA Amendments Act collection, revealed in a filing that a conversation he had with his retained immigration counsel’s paralegal was recorded even after the FBI had first questioned him.

FBI agents interrogated Mr. Jumaev at his Philadelphia apartment on February 14, 2012; at that time, Mr. Jumaev had been charged with an immigration violation, had posted bond that included electronic monitoring, was represented by an immigration attorney, Francois Mazur, Esq., and for approximately two years, unbeknownst to him, had also been under investigation for activities related to this case.15 The next day, February 15, 2012, Mr. Jumaev called Mr. Mazur and spoke with the attorney’s paralegal, seeking legal advice relating to Mr. Jumaev’s having been questioned the day prior by the FBI. A copy of the recording of the call, labeled as S2675971321_20120215194017_416.WAV, has been provided in discovery.16

15 The criminal Complaint filed against Mr. Jumaev notes that the FBI had been investigating him in this matter since shortly after his arrest in February 2010 for immigration charges. See Doc. 1 at ¶ 13.

16 Based upon information and belief, to date, the government has not provided all of Mr. Jumaev’s intercepted communications. It is therefore currently unknown whether other communications between Mr. Jumaev and his immigration attorney were intercepted.

As the footnotes make clear, at this point the FBI had already been investigating him for years, but didn’t have the caution to avoid recording his conversations with his immigration attorney (something which, in the Khan case, the government admitted should have been treated as a privileged conversation).

Call me crazy, but this is beginning to look like a pattern — the FBI wiretapping the earliest privileged conversations after their targets get alerted to the FBI investigation into them.

Maybe NSA “Moonlighting” Is Another Name for “Public-Private Partnership”?

As you’ve likely read, NSA’s Chief Technology Officer has so little to keep him busy he’s also planning on working 20 hours a week for Keith Alexander’s new boondoggle.

Under the arrangement, which was confirmed by Alexander and current intelligence officials, NSA’s Chief Technical Officer, Patrick Dowd, is allowed to work up to 20 hours a week at IronNet Cybersecurity Inc, the private firm led by Alexander, a retired Army general and his former boss.

The arrangement was approved by top NSA managers, current and former officials said. It does not appear to break any laws and it could not be determined whether Dowd has actually begun working for Alexander, who retired from the NSA in March.

Dowd is the guy with whom Alexander filed 7 patents for work developed at NSA.

During his time at the NSA, Alexander said he filed seven patents, four of which are still pending, that relate to an “end-to-end cybersecurity solution.” Alexander said his co-inventor on the patents was Patrick Dowd, the chief technical officer and chief architect of the NSA. Alexander said the patented solution, which he wouldn’t describe in detail given the sensitive nature of the work, involved “a line of thought about how you’d systematically do cybersecurity in a network.”

That sounds hard to distinguish from Alexander’s new venture. But, he insisted, the behavior modeling and other key characteristics represent a fundamentally new approach that will “jump” ahead of the technology that’s now being used in government and in the private sector.

Presumably, bringing Dowd on board will both make Alexander look more technologically credible and let Dowd profit off all the new patents Alexander is filing for, which he claims don’t derive from work taxpayers paid for.

Capitalism, baby! Privatizing the profits paid for by the public!

All that said, I’m wondering whether this is about something else — and not just greed.

Yesterday, as part of a bankster cybersecurity shindig, one of Alexander’s big named clients, SIFMA, rolled out its “Cybersecurity Regulatory Guidance.” It’s about what you’d expect from a bankster organization: demands that the government give what it needs, use a uniform light hand while regulating, show some flexibility in case that light hand becomes onerous, and never ever hold the financial industry accountable for its own shortcomings.

Bullet point 2 (Bullet point 1 basically says the US government has a big role to play here which may be true but also sounds like a demand for a handout) lays out the kind of public-private partnership SIFMA expects.

Principle 2: Recognize the Value of Public–Private Collaboration in the Development of Agency Guidance

Each party brings knowledge and influence that is required to be successful, and each has a role in making protections effective. Firms can assist regulators in making agency guidance better and more effective as it is in everyone’s best interests to protect the financial industry and the customers it serves.

The NIST Cybersecurity Framework is a useful model of public-private cooperation that should guide the development of agency guidance. NIST has done a tremendous job reaching out to stakeholders and strengthening collaboration with financial critical infrastructure. It is through such collaboration that voluntary standards for cybersecurity can be developed. NIST has raised awareness about the standards, encouraged its use, assisted the financial sector in refining its application to financial critical infrastructure components, and incorporated feedback from members of the financial sector.

In this vein, we suggest that an agency working group be established that can facilitate coordination across the agencies, including independent agencies and SROs, and receive industry feedback on suggested approaches to cybersecurity. SIFMA views the improvement of cybersecurity regulatory guidance and industry improvement efforts as an ongoing process.

Effective collaboration between the private and public sectors is critical today and in the future as the threat and the sector’s capabilities continue to evolve.

Again, this public-private partnership may be necessary in the case of cybersecurity for critical infrastructure, but banks have a history of treating such partnership as lucrative handouts (and the principle document’s concern about privacy has more to do with hiding their own deeds, and only secondarily discusses the trust of their customers). Moreover, experience suggests that when “firms assist regulators in making agency guidance better,” it usually has to do with socializing risk.

In any case, given that the banks are, once again, demanding socialism to protect themselves, is it any wonder NSA’s top technology officer is spending half his days at a boondoggle serving these banks?

And given the last decade of impunity the banks have enjoyed, what better place to roll out an exotic counter-attacking cybersecurity approach (except for the risk that it’ll bring down the fragile house of finance cards by mistake)?

Alexander said that his new approach is different than anything that’s been done before because it uses “behavioral models” to help predict what a hacker is likely to do. Rather than relying on analysis of malicious software to try to catch a hacker in the act, Alexander aims to spot them early on in their plots.

One of the most recent stories on the JP Morgan hack (which actually appears to be the kind of Treasuremapping NSA does of other country’s critical infrastructure all the time) made it clear the banksters are already doing the kind of data sharing that Keith Alexander wailed he needed immunity to encourage.

The F.B.I., after being contacted by JPMorgan, took the I.P. addresses the hackers were believed to have used to breach JPMorgan’s system to other financial institutions, including Deutsche Bank and Bank of America, these people said. The purpose: to see whether the same intruders had tried to hack into their systems as well. The banks are also sharing information among themselves.

So clearly SIFMA’s call for sharing represents something more, probably akin to the kind of socialism it benefits from in its members’ core business models.

In the intelligence world, they use the term “sheep dip” to describe how they stick people subject to one authority — such as the SEALs who killed Osama bin Laden — under a more convenient authority — such as CIA’s covert status. Maybe that’s what’s really going on here: sheep dipping NSA’s top tech person into the private sector where his work will evade even the scant oversight given to NSA.

If SIFMA’s looking for the kind of socialistic sharing akin to free money, then why should we be surprised the boondoggle at the center of it plans to share actual tech personnel?

Update: Reuters reports the deal’s off. Apparently even Congress (beyond Alan Grayson, who has long had questions about Alexander’s boondoggle) had a problem with this.

FISCR Used an Outdated Version of EO 12333 to Rule Protect America Act Legal

If the documents relating to Yahoo’s challenge of Protect America Act released last month are accurate reflections of the documents actually submitted to the FISC and FISCR, then the government submitted a misleading document on June 5, 2008 that was central to FISCR’s ultimate ruling.

As I laid out here in 2009, FISCR relied on the the requirement  in EO 12333 that the Attorney General determine there is probable cause a wiretapping technique used in the US is directed against a foreign power to judge the Protect America Act met probable cause requirements.

The procedures incorporated through section 2.5 of Executive Order 12333, made applicable to the surveillances through the certifications and directives, serve to allay the probable cause concern.

The Attorney General hereby is delegated the power to approve the use for intelligence purposes, within the United States or against a United States person abroad, of any technique for which a warrant would be required if undertaken for law enforcement purposes, provided that such techniques shall not be undertaken unless the Attorney General has determined in each case that there is probable cause to believe that the technique is directed against a foreign power or an agent of a foreign power.

44 Fed. Reg. at 59,951 (emphasis supplied). Thus, in order for the government to act upon the certifications, the AG first had to make a determination that probable cause existed to believe that the targeted person is a foreign power or an agent of a foreign power. Moreover, this determination was not made in a vacuum. The AG’s decision was informed by the contents of an application made pursuant to Department of Defense (DOD) regulations. See DOD, Procedures Governing the Activities of DOD Intelligence Components that Affect United States Persons, DOD 5240.1-R, Proc. 5, Pt. 2.C.  (Dec. 1982).

Yahoo didn’t buy this argument. It had a number of problems with it, notably that nothing prevented the government from changing Executive Orders.

While Executive Order 12333 (if not repealed), provides some additional protections, it is still not enough.

[snip]

Thus, to the extent that it is even appropriate to examine the protections in the Executive Order that are not statutorily required, the scales of the reasonableness determination sway but do not tip towards reasonableness.

Yahoo made that argument on May 29, 2008.

Sadly, Yahoo appears not to have noticed the best argument that Courts shouldn’t rely on EO 12333 because the President could always change it: Sheldon Whitehouse’s revelation on December 7, 2007 (right in the middle of this litigation) that OLC had ruled the President could change it in secret and not note the change publicly. Whitehouse strongly suggested that the Executive in fact had changed EO 12333 without notice to accommodate its illegal wiretap program.

But the government appears to have intentionally withheld further evidence about how easily it could change EO 12333 — and in fact had, right in the middle of the litigation.

This is the copy of the Classified Annex to EO 12333 that (at least according to the ODNI release) the government submitted to FISCR in a classified appendix on June 5, 2008 (that is, after Yahoo had already argued that an EO, and the protections it affords, might change). It is a copy of the original Classified Appendix signed by Ed Meese in 1988.

As I have shown, Michael Hayden modified NSA/CSS Policy 1-23 on March 11, 2004, which includes and incorporates EO 12333, the day after the hospital confrontation. The content of the Classified Annex released in 2013 appears to be identical, in its unredacted bits, to the original as released in 1988 (see below for a list of the different things redacted in each version). So the actual content of what the government presented may (or may not be) a faithful representation of the Classified Appendix as it currently existed.

But the version of NSA/CSS Policy 1-23 released last year (starting at page 110) provides this modification history:

This Policy 1-23 supersedes Directive 10-30, dated 20 September 1990, and Change One thereto, dated June 1998. The Associate Director for Policy endorsed an administrative update, effective 27 December 2007 to make minor adjustments to this policy. This 29 May 2009 administrative update includes changes due to the FISA Amendments Act of 2008 and in core training requirements.

That is, Michael Hayden’s March 11, 2004 modification of the Policy changed to the Directive as existed before 2 changes made under Clinton.

Just as importantly, the modification history reflects “an administrative update” making “minor adjustments to this policy” effective December 27, 2007 — a month and a half after this challenge started.

By presenting the original Classified Appendix — to which Hayden had apparently reverted in 2004 — rather than the up-to-date Policy, the government was presenting what they were currently using. But they hid the fact that they had made changes to it right in the middle of this litigation. A fact that would have made it clear that Courts can’t rely on Executive Orders to protect the rights of Americans, especially when they include Classified Annexes hidden within Procedures.

In its language relying on EO 12333, FISCR specifically pointed to DOD 5240.1-R. The Classified Annex to EO 12333 is required under compliance with part of that that complies with the August 27, 2007 PAA compliance.

That is, this Classified Annex is a part of the Russian dolls of interlocking directives and orders that implement EO 12333.

And they were changing, even as this litigation was moving forward.

Only, the government appears to have hidden that information from the FISCR.

Update: Clarified that NSA/CSS Policy 1-23 is what got changed.

Update: Hahaha. The copy of DOD 5240.1 R which the government submitted on December 11, 2007, still bears the cover sheet labeling it as an Annex to NSA/CSS Directive 10-30. Which of course had been superseded in 2004.

Note how they cut off the date to hide that it was 1990?

Note how they cut off the date to hide that it was 1990?

Continue reading

The Obama Administration Debate on the Convention Against Torture and Anas al-Libi

For some reason, the NYT decided to bury this article from Charlie Savage on page A21. It explains that the Obama Administration is debating internally whether to overturn Obama’s ban against cruelty (which is also mandated by the Detainee Treatment Act). Some intelligence lawyers, apparently, believe Obama’s torture ban and the DTA are too limiting.

It is considering reaffirming the Bush administration’s position that the treaty imposes no legal obligation on the United States to bar cruelty outside its borders, according to officials who discussed the deliberations on the condition of anonymity.

[snip]

State Department lawyers are said to be pushing to officially abandon the Bush-era interpretation. Doing so would require no policy changes, since Mr. Obama issued an executive order in 2009 that forbade cruel interrogations anywhere and made it harder for a future administration to return to torture.

But military and intelligence lawyers are said to oppose accepting that the treaty imposes legal obligations on the United States’ actions abroad. They say they need more time to study whether it would have operational impacts. They have also raised concerns that current or future wartime detainees abroad might invoke the treaty to sue American officials with claims of torture, although courts have repeatedly thrown out lawsuits brought by detainees held as terrorism suspects.

There were remarkable amounts of denial in response to this, from people who seem totally unaware of the kind of practices — that appear to include isolation, sleep deprivation, food manipulation, and other forms of coercion — currently used by High Value Interrogation Group (HIG), the inter-Agency group used to interrogate terrorist suspects. And this post from David Luban, which lays out some of the loopholes the government might be using to engage in abuse, misses a few.

We know, for example, that there are 2 OLC opinions that say Presidents don’t have to change the text of Executive Orders they choose to ignore, meaning Obama could ignore his torture ban “legally.” There’s also the Appendix M OLC opinion that has approved whatever DOD wants to sneak into the sometimes classified appendix in advance.

All of these issues have been invoked in the case of Anas al-Libi, who recently testified in his challenge to the use of the statements he made to FBI’s Clean Team in his trial, invoking the anxiety produced by the “CIA” interrogation al-Libi experienced on the USS San Antonio. (The interrogation was conducted by the HIG; note that while al-Libi has retained counsel, Bernard Kleinman, I believe he also still has public defenders, including Sabrina Shroff, who has represented HIG-interrogated defendants before, so she can attest to the continuity of the methods involved.)

Al-Libi, a 50-year-old Libyan whose legal name is Nazi Abdul al-Ruqai, testified before U.S. District Judge Lewis Kaplan in an evidentiary hearing tightly focused on the moments following al-Libi’s transfer on October 12, 2013, from military to civilian custody.

Given the situation, “I couldn’t concentrate on anything,” al-Libi told the court through an Arabic translator. When asked by his attorney, Bernard Kleinman, why he signed the papers waving his Miranda rights and paving the way for an FBI interview, al-Libi said, “You have no choice but to sign it.”

And in a filing calling on the government to preserve videotapes and any other records of his shipboard interrogation, al-Libi’s Libyan-retained lawyer invoked precisely the law and Executive Order in question.

18. Upon information and belief he was subjected to daily interrogation by professsional interrogator[s] of the CIA in an unrelenting, hostile, and extraordinary manner.

19.Upon information and belief this interrogation was conducted in a manner in violation of the Defendant’s rights under the Fifth and Sixth Amendments to the federal Constitution, and under applicable treaties and conventions to which the United States is a signatory.2

20.Furthermore, this interrogation was conducted in a manner of inhumane treatment. Notwithstanding the changes effected by both Congress3 and the President4 after the revelations of physical abuse and torture as conducted by the CIA in the name of national security, such measures (even if actually observed by the participants and interrogators) could easily lead to harsh, improper and inhumane treatment that would taint any and all subsequent interrogations, even if preceded by a Miranda warning and waiver execution, and conducted by the FBI or some other federal law enforcement agents.

21. Upon information and belief, these interrogations were videotaped, and otherwise recorded by the CIA, among other U.S. Government agencies.

22.It is, furthermore, reasonable and logical to presume that the interrogator[s] produced hard copy notes of their actions, and provided reports to other representatives of the United States Government (both in the Executive and Legislative branches).

3 In 2005 Congress passed the Detainee Treatment Act, Pub. L. No. 109-148, codified at U.S.C. §§ 2000dd, 2000dd-0, and 2000dd-J, which applied the U.S. Army Field Manual to all military interrogations. It should be noted that the Act specifically provides that

No individual in the custody or under the physical control of the United States Government, regardless of nationality or physical location, shall be subject to cruel, inhuman, or degrading treatment or punishment.

The degree and extent to which the United States Government violated this statute in the kidnapping, abduction, and interrogation of the Defendant are issues to be raised similarly in any subsequent motions made pursuant to Rule 12(b).

4 On January 22, 2009, President Obama issued Executive Order 13491, which directed the CIA to adopt the methods of interrogation as set forth in the U.S. Army Field Manual. See E.O. 13491,74 Fed. Reg. 4893 (Jan. 22, 2009).

5 Both the Detainee Treatment Act and E.O. 13491 refer to the U.S. ARMY FIELD MANUAL, HUMAN INTELLIGENCE COLLECTOR OPERATIONS, referenced as FM 2.22.3 (Sept. 2006 ed.).

I think there are probably a number of HIG-interrogated individuals — including some who were interrogated entirely within the US — who could claim they were subject to degrading treatment. But in this case, the person in question has a privately-retained lawyer, which may present significant concerns for the interrogators in question.

Meanwhile, the government is not providing al-Libi cancer treatment doctors at Duke said during the summer he needs to address liver cancer. Maybe the government is just hoping al-Libi will succumb to cancer before he can press these issues?

Whatever the plan, the government is at least entertaining widening the loopholes that they used in the past to protect torturers.

Why Isn’t FBI Investigating the Hackers Who Broke into Google’s Cables?

At his Brookings event yesterday, Jim Comey claimed that there is a misperception, in the wake of the Snowden releases, about how much data the government obtains.

In the wake of the Snowden disclosures, the prevailing view is that the government is sweeping up all of our communications. That is not true. And unfortunately, the idea that the government has access to all communications at all times has extended—unfairly—to the investigations of law enforcement agencies that obtain individual warrants, approved by judges, to intercept the communications of suspected criminals.

[snip]

It frustrates me, because I want people to understand that law enforcement needs to be able to access communications and information to bring people to justice. We do so pursuant to the rule of law, with clear guidance and strict oversight. 

He goes onto pretend that Apple and Google are default encrypting their phone solely as a marketing gimmick, some arbitrary thing crazy users want.

Both companies are run by good people, responding to what they perceive is a market demand. But the place they are leading us is one we shouldn’t go to without careful thought and debate as a country.

[snip]

Encryption isn’t just a technical feature; it’s a marketing pitch. But it will have very serious consequences for law enforcement and national security agencies at all levels. Sophisticated criminals will come to count on these means of evading detection. It’s the equivalent of a closet that can’t be opened. A safe that can’t be cracked. And my question is, at what cost?

He ends with a plea that “our private sector partners … consider changing course.”

But we have to find a way to help these companies understand what we need, why we need it, and how they can help, while still protecting privacy rights and providing network security and innovation. We need our private sector partners to take a step back, to pause, and to consider changing course.

There’s something missing from Comey’s tale.

An explanation of why the FBI has not pursued the sophisticated criminals who stole Google’s data overseas.

At a recent event with Ron Wyden, the Senator asked Schmidt to weigh in on the phone encryption “kerfuffle.” And Schmidt was quite clear: the reason Google and Apple are doing this is because the NSA’s partners in the UK stole their data, even while they had access to it via PRISM.

The people who are criticizing this should have expected this. After Google was attacked by the British version of the NSA, we were annoyed and so we put end-to-end encryption at rest, as well as through our systems, making it essentially impossible for interlopers — of any kind — to get that information.

Schmidt describes the default encryption on the iPhone, notes that it has been available for the last 3 years on Android phones, and will soon be standard, just like it is on iPhone.

Law enforcement has many many ways of getting information that they need to provide this without having to do it without court orders and with the possible snooping conversation. The problem when they do it randomly as opposed to through a judicial process is it erodes user trust.

If everything Comey said were true, if this were only about law enforcement getting data with warrants, Apple – and Google especially – might not have offered their customers the privacy they deserved. But it turns out Comey’s fellow intelligence agency decided to just go take what they wanted.

And FBI did nothing to solve that terrific hack and theft of data.

I guess FBI isn’t as interested in rule of law as Comey says.

I Con the Record’s International Privacy Guidelines Swallowed Up by Exceptions

Screen Shot 2014-10-17 at 11.23.58 AMSometimes I Con the Record outdoes itself.

On Tuesday, the Guardian noted a scathing report UN Counterterrorism special rapporteur Ben Emmerson issued last month attacking British and US collection of bulk communications.

“Merely to assert – without particularization – that mass surveillance technology can contribute to the suppression and prosecution of acts of terrorism does not provide an adequate human rights law justification for its use. The fact that something is technically feasible, and that it may sometimes yield useful intelligence, does not by itself mean that it is either reasonable or lawful.”

[snip]

“It is incompatible with existing concepts of privacy for states to collect all communications or metadata all the time indiscriminately. The very essence of the right to the privacy of communication is that infringements must be exceptional, and justified on a case-by-case basis.”

Today, I Con the Record released a “Status Report” on an initiative President Obama ordered in his PPD-28 back in January to extend privacy protections to foreigners.

As we work to meet the January 2015 deadline, PPD-28 called on the Director of National Intelligence to prepare an interim report on the status of our efforts and to evaluate, in coordination with the Department of Justice and the rest of the Intelligence Community, additional retention and dissemination safeguards.

The DNI’s interim report is now being made available to the public in line with our pledge to share as much information about sensitive intelligence activities as is possible, consistent with our national security.

One thing this interim report requires is that “elements shall publicly release their PPD-28 implementation policies and procedures to the maximum extent possible.” Which requirement, you might assume, this release fulfills.

Which is why it’s so curious I Con the Record chose not to release an unclassified report mandated and mandating transparency — dated July 2014 — until October 2014.

Lest I be called a cynic, let me acknowledge that there are key parts of this that may represent improvements (or may not). The report asserts:

  • Foreigners will be treated with procedures akin to — though not identical to — those imposed by Section 2.3 of EO 12333
  • Just because someone is a foreigner doesn’t mean their information is foreign intelligence; the IC should “permanently retain or disseminate such personal information only if the personal information relates to an authorized intelligence requirement, is reasonably believed to be evidence of a crime, or meets one of the other standards for retention or dissemination identified in section 2.3″ of EO 12333
  • The IC should consider adopting (though is not required to) retention periods used with US person data for foreign personal information (which is 5 years); the IC may get extensions, but only in 5-year chunks of time
  • When disseminating “unevaluated personal information,” the IC should make that clear so the recipient can protect it as such

Those are good things! Yeah us!

There are, however, a series of exceptions to these rules.

First, the guidelines in this report restate PPD-28′s unbelievably broad approval of the use of bulk data, in full. The report does include this language:

[T]he procedures must also reflect the limitations on the use of SIGINT collected in bulk. Moreover, Intelligence Community element procedures should include safeguards to satisfy the requirements of this section. In developing procedures to comply with this requirement, the Intelligence Community must be mindful that to make full use of intelligence information, an Intelligence Community element may need to use SIGINT collected in bulk together with other lawfully collected information. In such situations, Intelligence Community elements should take care to comply with the limitations applicable to the use of bulk SIGINT collection.

Unless I’m missing something, the only “limits” in this section are those limiting the use of bulk collection to almost all of NSA’s targets, including counterterrorism, cybersecurity, and crime, among other things. Thus, the passage not only reaffirms what amounts to a broad permission to use bulk, but then attaches those weaker handing rules to anything used in conjunction with bulk.

Then there are the other exceptions. The privacy rules in this document don’t apply to:

  • Evaluated intelligence (exempting foreigners’ data from the most important treatment US person data gets, minimization in finished intelligence reports; see footnote 3)
  • Personal information collected via other means than SIGINT (excluding most of what the CIA and FBI do, for example; see page 1)
  • Information collected via SIGINT not collecting communications or information about communications (seemingly excluding things like financial dragnets and pictures and potentially even geolocation, among a great many other things; see footnote 2)

And, if these procedures aren’t loosey goosey enough for you, the report includes this language:

It is important that elements have the ability to deviate from their procedures when national security requires doing so, but only with approval at a senior level within the Intelligence Community element and notice to the DNI and the Attorney General.

OK then.

Congratulations world! We’re going to treat you like Americans. Except in the majority of situations when we’ve decided not to grant you that treatment. Rest easy, though, knowing you’re data is sitting in a database for only 5 years, if we feel like following that rule.

The Forgotten OPR Report Exposing the White House Role in Torture

Brennan with TortureMcClatchy reports today that the Senate Intelligence Report will include no details on the White House role in torture.

The Senate Intelligence Committee report also didn’t examine the responsibility of top Bush administration lawyers in crafting the legal framework that permitted the CIA to use simulated drowning called waterboarding and other interrogation methods widely described as torture, McClatchy has learned.

“It does not look at the Bush administration’s lawyers to see if they were trying to literally do an end run around justice and the law,” the person said.

McClatchy’s story is interesting, in part, because I had heard that the report was going to admit what has been in the public domain for years: the torture program, contrary to almost all reporting, was authorized by Presidential finding, not primarily by the memos that garner all the attention.

If the Torture Report is no longer going to confirm that, it is far bigger news than McClatchy has conveyed. It would mean someone — presumably the White House! (though remember the Finding’s author, Cofer Black, was involved in reviewing the document) — had won concessions in the declassification discussions to hide the role of President Bush in personally authorizing torture.

That would be consistent with President Obama’s rather remarkable efforts to keep a short mention of the September 17, 2001 Gloves Come Off Memorandum of Notification suppressed in ACLU’s torture FOIA (something that’s in the public record, but which I have been the only one to report).

But if President Obama’s White House has, a second time, intervened to prevent public confirmation that the President authorized torture, we really ought to start demanding to know why that’s the case. Remember when the 2nd Circuit backed White House efforts to keep mention of the MON suppressed, the White House said it was still using the MON.

The other reason I find McClatchy’s report curious is because it leaves something utterly central out of its narrative.

As Katherine Hawkins noted yesterday, McClatchy missed a key detail in the chronology of when and how Republicans backed out of the torture review.

Obama DOJ investigation into torture is not “prior” to SSCI report. Launched after SSCI, & is reason GOP withdraws

But there’s one more part of that chronology — one McClatchy might actually review if it wants the things it says it wants: the Office of Public Responsibility report into OLC lawyers’ role in the torture memos. Reporting in 2009 made it clear that Eric Holder launched the John Durham investigation in response to reading the OPR Report. So the chronology goes OPR Report, Durham investigation, GOP withdraws from SSCI Torture Report which (McClatchy argues) is when the Democrats could have turned and pushed to get documents implicating Bush White House figures.

While both David Addington and Tim Flanigan refused to be interviewed for the OPR report, it made it clear (especially Jay Bybee and John Yoo’s rebuttals) that both had had a direct role in setting up the legal loopholes CIA used to conduct torture. Between that and other public (largely unreported by anyone but me) documents, it is fairly clear that in response to concerns raised around July 10, 2002, CIA tried to get DOJ to give “advance” declination of prosecution (though for conduct that surely had already occurred). On July 13, Michael Chertoff refused, probably because Ali Soufan had already raised concerns about the conduct (his concerns probably relate to the use of mock burial) to give advance declination for torture. This led John Yoo to freelance a July 13, 2002 fax laying out how CIA could avoid accountability; that appears to be what Jonathan Fredman relied on in his advice to the torturers, not the more famous Bybee Memos. Nevertheless, at a July 16, 2002 meeting at the White House, it was decided (Yoo and Addington differ, it appears, on who did the deciding, but it is a rock solid bet that Addington did) that the Bybee Memo would include Commander of Chief language on how to avoid prosecution.

There are a number of other moments in the history of the program where White House responsibility is clear. But at that moment on July 16, 2002, David Addington got John Yoo to provide legal cover for anything the President ordered CIA do; he did so, of course, after CIA had been torturing for months on Presidential orders.

The answers to many of the questions McClatchy says have gone unanswered are sitting right there in the OPR report. And those answers are crucial to understanding the dance over declassification going on right now.

Aside from whatever else the Torture Report is, it is also a report that dodges the underlying power structure, in which the President orders the CIA to break the law and later ensures CIA avoids any accountability for doing so. At some point in this Torture Report process — fairly recently too! — Democrats seemed interested in exposing that dynamic, a dynamic President Obama has benefitted from at least as much as Bush did, going so far as to permit him to have CIA kill a US citizen with no due process. (That’s probably why Leon Panetta told some fibs in his memoir on this point.)

Ultimately, we’re never going to rein in CIA until we expose the mutual embrace of complicity the White House and CIA repeatedly rely on. Now it looks like the Senate Intelligence Committee has — in bipartisan fashion — decided to back off doing so here.

Jim Comey’s Confused Defense of Front Door Back Doors and Storage Intercepts

I said somewhere that those wailing about Apple’s new default crypto in its handsets are either lying or are confused about the difference between a phone service and a storage device.

For the moment, I’m going to put FBI Director Jim Comey in the latter category. I’m going to do so, first, because at his Brookings talk he corrected his false statement — which I had pointed out — on 60 Minutes (what he calls insufficiently lawyered) that the FBI cannot get content without an order. Though while Comey admitted that FBI can read content it has collected incidentally, he made another misleading statement. He said FBI does so during “investigations. They also do so during “assessments,” which don’t require anywhere near the same standard of evidence or oversight to do.

I’m also going to assume Comey is having service/device confusion because that kind of confusion permeated his presentation more generally.

There was the confusion exhibited when he tried to suggest a “back door” into a device wasn’t one if FBI simply called it a “front door.”

We aren’t seeking a back-door approach. We want to use the front door, with clarity and transparency, and with clear guidance provided by law. We are completely comfortable with court orders and legal process—front doors that provide the evidence and information we need to investigate crime and prevent terrorist attacks.

And more specifically, when Comey called for rewriting CALEA, he called for something that would affect only a tiny bit of what Apple had made unavailable by encrypting its phones.

Current law governing the interception of communications requires telecommunication carriers and broadband providers to build interception capabilities into their networks for court-ordered surveillance. But that law, the Communications Assistance for Law Enforcement Act, or CALEA, was enacted 20 years ago—a lifetime in the Internet age. And it doesn’t cover new means of communication. Thousands of companies provide some form of communication service, and most are not required by statute to provide lawful intercept capabilities to law enforcement. [my emphasis]

As I have noted, the main thing that will become unavailable under Apple’s new operating system is iMessage chats if the users are not using default iCloud back-ups (which would otherwise keep a copy of the chat).

But the rest of it — all the data that will be stored only on an iPhone if people opt out of Apple’s default iCloud backups — will be unaffected if what Comey is planning to do is require intercept ability for every message sent.

Now consider the 5 examples Comey uses to claim FBI needs this. I’ll return to these later, but in almost all cases, Comey seems to be overselling his case.

First, there’s the case of two phones with content on them.

In Louisiana, a known sex offender posed as a teenage girl to entice a 12-year-old boy to sneak out of his house to meet the supposed young girl. This predator, posing as a taxi driver, murdered the young boy, and tried to alter and delete evidence on both his and the victim’s cell phones to cover up his crime. Both phones were instrumental in showing that the suspect enticed this child into his taxi. He was sentenced to death in April of this year.

On first glance this sounds like a case where the phones were needed. But assuming this is the case in question, it appears wrong. The culprit, Brian Horn, was IDed by multiple witnesses as being in the neighborhood, and evidence led to his cab. There was DNA evidence. And Horn and his victim had exchange texts. Presumably, records of those texts, and quite possibly the actual content, were available at the provider.

Then there’s another texting case.

In Los Angeles, police investigated the death of a 2-year-old girl from blunt force trauma to her head. There were no witnesses. Text messages from the parents’ cell phones to one another, and to their family members, proved the mother caused this young girl’s death, and that the father knew what was happening and failed to stop it.

Text messages also proved that the defendants failed to seek medical attention for hours while their daughter convulsed in her crib. They even went so far as to paint her tiny body with blue paint—to cover her bruises—before calling 911. Confronted with this evidence, both parents pled guilty.

This seems to be another case where the texts were probably available in other places, especially given how many people received them.

Then there’s another texting story — this is the only one where Comey mentioned warrants, and therefore the only real parallel to what he’s pitching.

In Kansas City, the DEA investigated a drug trafficking organization tied to heroin distribution, homicides, and robberies. The DEA obtained search warrants for several phones used by the group. Text messages found on the phones outlined the group’s distribution chain and tied the group to a supply of lethal heroin that had caused 12 overdoses—and five deaths—including several high school students.

Again, these texts were likely available with the providers.

Then Comey lists a case where the culprits were first found with a traffic camera.

In Sacramento, a young couple and their four dogs were walking down the street at night when a car ran a red light and struck them—killing their four dogs, severing the young man’s leg, and leaving the young woman in critical condition. The driver left the scene, and the young man died days later.

Using “red light cameras” near the scene of the accident, the California Highway Patrol identified and arrested a suspect and seized his smartphone. GPS data on his phone placed the suspect at the scene of the accident, and revealed that he had fled California shortly thereafter. He was convicted of second-degree murder and is serving a sentence of 25 years to life.

It uses GPS data, which would surely have been available from the provider. So traffic camera, GPS. Seriously, FBI, do you think this makes your case?

Perhaps Comey’s only convincing example involves exoneration involving a video — though that too would have been available elsewhere on Apple’s default settings.

The evidence we find also helps exonerate innocent people. In Kansas, data from a cell phone was used to prove the innocence of several teens accused of rape. Without access to this phone, or the ability to recover a deleted video, several innocent young men could have been wrongly convicted.

Again, given Apple’s default settings, this video would be available on iCloud. But if it was only available on the phone, and it was the only thing that exonerated the men, then it would count.

Update: I’m not sure, but this sounds like the Daisy Coleman case, which was outside Kansas City, MO, but did involve a phone video that (at least as far as I know) was never recovered. I don’t think the video ever was found. The guy she accused of raping her plead guilty to misdemeanor child endangerment — he dumped her unconscious in freezing weather outside her house.

I will keep checking into these, but none of these are definite cases. All of this evidence would normally, given default settings, be available from providers. Much of it would be available on phones of people besides the culprit. In the one easily identifiable case, there was a ton of other evidence. In two of these cases, the evidence was important in getting a guilty plea, not in solving the crime.

But underlying it all is the key point: Phones are storage devices, but they are primarily communication devices, and even as storage devices the default is that they’re just a localized copy of data also stored elsewhere. That means it is very rare that evidence is only available on a phone. Which means it is rare that such evidence will only be available in storage and not via intercept or remote storage.

60 Minutes Comey Refutes 60 Minutes Comey

Jim ComeyToday, Jim Comey will give what will surely be an aggressively moderated (by Ben Wittes!) talk at Brookings, arguing that Apple should not offer its customers basic privacy tools (congratulations to NYT’s Michael Schmidt for beating the rush of publishing credulous reports on this speech).

Mr. Comey will say that encryption technologies used on these devices, like the new iPhone, have become so sophisticated that crimes will go unsolved because law enforcement officers will not be able to get information from them, according to a senior F.B.I. official who provided a preview of the speech.

Never mind the numbers, which I laid out here. While Apple doesn’t break out its device requests last year, it says the vast majority of the 3,431 device requests it responded to last year were in response to a lost or stolen phone request, not law enforcement seeking data on the holder. Given that iPhones represent the better part of the estimated 3.1 million phones that will be stolen this year, that’s a modest claim. Moreover, given that Apple only provided content off the cloud to law enforcement 155 times last year, it’s unlikely we’re talking a common law enforcement practice.

At least not with warrants. Warrantless fishing expeditions are another issue.

As far back as 2010, CBP was conducting 4,600 device searches at the border. Given that 20% of the country will be carrying iPhones this year, and a much higher number of the Americans who cross international borders will be carrying one, a reasonable guess would be that CBP searches 1,000 iPhones a year (and it could be several times that). Cops used to be able to do the same at traffic stops until this year’s Riley v, California decision; I’ve not seen numbers on how many searches they did, but given that most of those were (like the border searches) fishing expeditions, it’s not clear how many will be able to continue, because law enforcement won’t have probable cause to get a warrant.

So the claims law enforcement is making about needing to get content stored on and only on iPhones with a warrant doesn’t hold up, except for very narrow exceptions (cops may lose access to iMessage conversations if all users in question know not to store those conversations on iCloud, which is otherwise the default).

But that’s not the best argument I’ve seen for why Comey should back off this campaign.

As a number of people (including the credulous Schmidt) point out, Comey repeated his attack on Apple on the 60 Minutes show Sunday.

James Comey: The notion that we would market devices that would allow someone to place themselves beyond the law, troubles me a lot. As a country, I don’t know why we would want to put people beyond the law. That is, sell cars with trunks that couldn’t ever be opened by law enforcement with a court order, or sell an apartment that could never be entered even by law enforcement. Would you want to live in that neighborhood? This is a similar concern. The notion that people have devices, again, that with court orders, based on a showing of probable cause in a case involving kidnapping or child exploitation or terrorism, we could never open that phone? My sense is that we’ve gone too far when we’ve gone there

What no one I’ve seen points out is there was an equally charismatic FBI Director named Jim Comey on 60 Minutes a week ago Sunday (these are actually the same interview, or at least use the same clip to marvel that Comey is 6’8″, which raises interesting questions about why both these clips weren’t on the same show).

That Jim Comey made a really compelling argument about how most people don’t understand how vulnerable they are now that they live their lives online.

James Comey: I don’t think so. I think there’s something about sitting in front of your own computer working on your own banking, your own health care, your own social life that makes it hard to understand the danger. I mean, the Internet is the most dangerous parking lot imaginable. But if you were crossing a mall parking lot late at night, your entire sense of danger would be heightened. You would stand straight. You’d walk quickly. You’d know where you were going. You would look for light. Folks are wandering around that proverbial parking lot of the Internet all day long, without giving it a thought to whose attachments they’re opening, what sites they’re visiting. And that makes it easy for the bad guys.

Scott Pelley: So tell folks at home what they need to know.

James Comey: When someone sends you an email, they are knocking on your door. And when you open the attachment, without looking through the peephole to see who it is, you just opened the door and let a stranger into your life, where everything you care about is.

That Jim Comey — the guy worried about victims of computer crime — laid out the horrible things that can happen when criminals access all the data you’ve got on devices.

Scott Pelley: And what might that attachment do?

James Comey: Well, take over the computer, lock the computer, and then demand a ransom payment before it would unlock. Steal images from your system of your children or your, you know, or steal your banking information, take your entire life.

Now, victim-concerned Jim Comey seems to think we can avoid such vulnerability by educating people not to click on any attachment they might have. But of course, for the millions who have their cell phones stolen, they don’t even need to click on an attachment. The crooks will have all their victims’ data available in their hand.

Unless, of course, users have made that data inaccessible. One easy way to do that is by making easy encryption the default.

Victim-concerned Jim Comey might offer 60 Minute viewers two pieces of advice: be careful of what you click on, and encrypt those devices that you carry with you — at risk of being lost or stolen — all the time.

Of course, that would set off a pretty intense fight with fear-monger Comey, the guy showing up to Brookings today to argue Apple’s customers shouldn’t have this common sense protection.

That would be a debate I’d enjoy Ben Wittes trying to debate.

1 2 3 835
Emptywheel Twitterverse
emptywheel RT @abc7newsBayArea: JUST IN: Dallas nurse Amber Vinson who contracted Ebola from Thomas Duncan is virus-free. http://t.co/mNDQTT1jd3 http:…
5mreplyretweetfavorite
emptywheel @VincePan1 I don't know that they're actually frightened. I think they're astute manipulators of the media.
6mreplyretweetfavorite
emptywheel RT @ryanjreilly: Eric Holder is "exasperated" by "selective leaks" in the Darren Wilson case, a DOJ official tells me. #Ferguson
12mreplyretweetfavorite
emptywheel "The Roman Empire fell because of lead in their pipes," they'll say. "America? That great Empire fell because it scared itself to death."
15mreplyretweetfavorite
emptywheel Increasingly believe when they write epitaph for American Empire they'll say we peed our pants to death.
17mreplyretweetfavorite
emptywheel @pwnallthethings Yes. Bigger question is whether Pen Register on steroid is legal under current law. Or if they want something even more
18mreplyretweetfavorite
emptywheel @Gaius_Publius Listen. This is Guinness. I'm not playing. @bmaz
22mreplyretweetfavorite
emptywheel No, Obama Doesn’t Need Legislation to Fix the Dragnet–Unless the “Fix” Isn’t One https://t.co/kmF08JxVZk
22mreplyretweetfavorite
emptywheel @Gaius_Publius Cause they're looking for people like @bmaz to drink it, not girls like me.
26mreplyretweetfavorite
emptywheel @Martina Doesn't look like they like women sports tweeters much. Not even Serena, prolly cause she really would kick their ass.
43mreplyretweetfavorite
bmaz @BuffyBlogs Clearly.
56mreplyretweetfavorite
bmaz Can no one keep Pandas off the base paths??
1hreplyretweetfavorite
October 2014
S M T W T F S
« Sep    
 1234
567891011
12131415161718
19202122232425
262728293031