Ron Wyden

1 2 3 19

Feinstein Wants to Introduce Reporting Mandate Jim Comey Says We Don’t Need

I’ll have a piece in Salon shortly about the two hearings on whether FBI should be able to mandate back doors (they call them front doors because that fools some Senators about the security problems with that) in software.

One thing not in there, however, has to do with a bill the Senate Intelligence Committee is considering that would require Facebook and Twitter and other social media to report terrorist content to authorities. ABC News, quoting Richard Clarke (who hasn’t had an official role in government for some years but is on ABC’s payroll) reported that the social media companies were not now reporting terrorist content.

In the middle of the SSCI hearing on this topic, Dianne Feinstein asked Jim Comey whether social media companies were reporting such content. Comey said they are (he did say they’ve gotten far better of late). Feinstein asked whether there ought to be a law anyway, to mandate behavior the companies are already doing. Comey suggested it wasn’t necessary. Feinstein said maybe they should mandate it anyway, like they do for child porn.

All of which made it clear that such a law is unnecessary, even before you get into the severe problems with the law (such as defining who is a terrorist and what counts as terrorist content).

SSCI will probably pass it anyway, because that’s how they respond to threats of late: by passing legislation that won’t address it.

Note, Feinstein also got visibly and audibly and persistently pissed at Ron Wyden for accurately describing what Deputy Attorney General Sally Yates had said she wanted in an earlier hearing: for providers to have keys that the FBI could use. Feinstein seems to believe good PR will eliminate all the technical problems with a back door plan, perhaps because then she won’t be held responsible for making us less secure as a result.

Update: The measures is here, in the Intelligence Authorization.

Update: Title changed for accuracy.

The Timing of the Contemplated Upstream Cyber-Grab

There’s an aspect missing thus far from the discussion of NSA’s possible bid for a cyber certification under Section 702 for primary use in the collection of attack signatures that could not be attributed to a foreign government.

The timing.

The discussion of creating a new Section 702 certificate came in the aftermath of the 6-month back and forth between DOJ and the FISA Court over NSA having collected US person data as part of its upstream collection (for more detail than appears in the timeline below, see this post). During that process, John Bates ruled parts of the program — what he deemed the intentional collection of US person data within the US — to be unconstitutional. That part of his opinion is worth citing at length, because of the way Bates argues that the inability to detach entirely domestic communications that are part of a transaction does not mean that those domestic communications were “incidentally” collected. Rather, they were “intentionally” collected.

Specifically, the government argues that NSA is not “intentionally” acquiring wholly domestic communications because the government does not intend to acquire transactions containing communications that are wholly domestic and has implemented technical means to prevent the acquisition of such transactions. See June 28 Submission at 12. This argument fails for several reasons.

NSA targets a person under Section 702 certifications by acquiring communications to, from, or about a selector used by that person. Therefore, to the extent NSA’s upstream collection devices acquire an Internet transaction containing a single, discrete communication that is to, from, or about a tasked selector, it can hardly be said that NSA’s acquisition is “unintentional.” In fact, the government has argued, that the Court has accepted, that the government intentionally acquires communications to and from a target, even when NSA reasonably — albeit mistakenly — believes that the target is located outside the United States. See Docket No. [redacted]

[snip]

The fact that NSA’s technical measures cannot prevent NSA from acquiring transactions containing wholly domestic communications under certain circumstances does not render NSA’s acquisition of those transactions “unintentional.”

[snip]

[T]here is nothing in the record to suggest that NSA’s technical means are malfunctioning or otherwise failing to operate as designed. Indeed, the government readily concedes that NSA will acquire a wholly domestic “about” communication if the transaction containing the communication is routed through an international Internet link being monitored by NSA or is routed through a foreign server.

[snip]

By expanding its Section 702 acquisitions to include the acquisition of Internet transactions through its upstream collection, NSA has, as a practical matter, circumvented the spirit of Section 1881a(b)(4) and (d)(1) with regard to that collection. (44-45, 48)

There are a number of ways to imagine that victim-related data and communications obtained with an attack signature might be considered “intentional” rather than “incidental,” especially given the Snowden document acknowledging that so much victim data gets collected it should be segregated from regular collection. Add to that the far greater likelihood that the NSA will unknowingly target domestic hackers — because so much of hacking involves obscuring attribution — and the likelihood upstream collection targeting hackers would “intentionally” collect domestic data is quite high.

Plus, there’s nothing in the 2011 documents released indicating the FISC knew upstream collection included cyber signatures — and related victim data — in spite of the fact that “current Certifications already allow for the tasking of these cyber signatures.” No unredacted section discussed the collection of US person data tied to the pursuit of cyberattackers that appears to have been ongoing by that point.

Similarly, the white paper officially informing Congress about 702 didn’t mention cyber signatures either. There’s nothing public to suggest it did so after the Senate rejected a Cybersecurity bill in August, 2012, either. That bill would have authorized less involvement of NSA in cybersecurity than appears to have already been going on.

With all that in mind, consider the discussions reflected in the documents released last week. The entire discussion to use FBI’s stated needs to apply as backup to apply for a cyber certificate came at the same time as NSA is trying to decide what to do with the data it illegally collected. Before getting that certificate, DOJ approved the collection of cyber signatures under other certificates. It seems likely that this collection would violate the spirit of the ruling from just the prior year.

And NSA’s assistance to FBI may have violated the prior year’s orders in another way. SSO contemplated delivering all this data directly to FBI.

Screen Shot 2015-06-11 at 9.42.56 AM

Yet one of the restrictions imposed on upstream collection — voluntarily offered up by DOJ — was that no raw data from NSA’s upstream collection go to FBI (or CIA). If there was uncertainty where FBI’s targeting ended and NSA’s began, this would create a violation of prior orders.

Meanwhile, the reauthorization process had already started, and as part of that (though curiously timed to coincide with the release of DOJ’s white paper on 702 collection) Ron Wyden and Mark Udall were trying to force NSA to figure out how much US person data they were collecting. Not only did the various Inspectors General refuse to count that data (which would have, under the logic of Bates’ opinions finding that illegally collected data was only illegal if the government knew it was US person data, made the data illegal), but the Senate Intelligence Committee refused to consider reconstituting their Technical Advisory Committee which might be better able to assess whether NSA claims were correct.

Sometime in that period, just as Wyden was trying to call attention to the fact that NSA was collecting US person data via its upstream collection, NSA alerted the Intelligence Committees to further “overcollection” under upstream collection.

2012 Upstream Notice

As I suggested here, the length of the redaction and mention of “other authorities” may reflect the involvement of another agency like FBI. One possibility, given the description of FBI collecting on cyber signatures using both PRTT and (presumably) traditional FISA in the discussions of SSO helping the FBI conduct this surveillance (note, I find it interesting though not conclusive that there is no mention of Section 215 to collect cybersecurity data), is that the initial efforts to go after these signatures in some way resulted in overcollection. If FISC interpreted victim-related data to be overcollection — as would be unsurprising under Bates’ 2011 upstream opinion — then it would explain the notice to Congress.

One more point. In this post, I noted that USA F-ReDux authorized FISC to let the government use data it had illegally collected but which FISC had authorized by imposing additional minimization procedures. It’s just a wildarseguess, but I find it plausible that this 2012 overcollection involved cyber signatures (because we know NSA was collecting it and there is reason to believe it violated Bates’ 2011 opinion), and that any victim data now gets treated under minimization procedures and therefore that any illegal data from 2012 may now, as of last week, be used.

All of which is to say that the revelation of NSA and FBI’s use of upstream collection to target hackers involves far more legal issues than commentary on the issue has made out. And these legal issues may well have been more appropriate for the government to reveal before passage of USA F-ReDux. Continue reading

On Carrots, Sticks, and Rand Paul

Now that USA F-ReDux has become USA FreeDone, I wanted to look at Steve Vladeck’s two bizarre posts attacking Rand Paul’s opposition to USA F-ReDux as a way of doing a post-mortem on the process.

I say bizarre because Vladeck complains that Paul “seize[d] the national spotlight in order to focus everyone’s attention on a hyper-specific question” — that of the Section 215 dragnet — when Vladeck has, at this late date, joined those of us who have long been pushing a focus on broader issues, specifically EO 12333 and Section 702. To support his claim that Paul is singularly focused on Section 215, Vladeck links to a second-hand report of a sentence in Paul’s campaign announcement, rather than to the announcement itself which (while more muddled than in other statements where Paul has named EO 12333 directly) invokes surveillance authorized by Executive Order, not the PATRIOT Act.

The president created this vast dragnet by executive order. And as president on day one, I will immediately end this unconstitutional surveillance.

Contrary to Vladeck’s miscitation, in this and other comments, Paul seized the national spotlight, in significant part, to talk about the broader issues, specifically EO 12333 and Section 702, that those pushing USA F-ReDux had set aside for future fights. Indeed, big parts of Paul’s filibuster speech — including his 10 and Ron Wyden’s 2 references to EO 12333 and his 18 and Wyden’s 3 references to 702 — sounds a lot like Vladeck’s series of posts worrying that this will be the only shot at reform and therefore regretting that we didn’t talk about the bigger issues as part of it.

Another deficiency of the USA FREEDOM Act is that it does not address bulk collection under Executive Order 12333. The bill also fails to address bulk collection under section 702 of the FISA Amendments Act.

One could say: What are you complaining about? You are getting some improvement. You still have problems, but you are getting some improvement.

I guess my point is that we are having this debate, and we don’t have it very often. We are having the debate every 3 years, and some people have tried to make this permanent, where we would never have any debate. Even though we are only having it every3 years, it is still uncertain whether I will be granted any amendments to this bill.

So, yes, I would like to address everything while we can. I think we ought to address section 702. I think we ought to–for goodness’ sake, why won’t we have some hearings on Executive Order 12333? I think they may be having them in secret, but I go back to what Senator Wyden said earlier. I think the principles of the law could be discussed in public. We don’t have to reveal how we do stuff. Do we think anybody in the world thinks we are not looking at their stuff? Why don’t we
explore the legality and the law of how we are doing it as opposed to leaving it unsaid and unknown in secret?

In other words, unlike the drone filibuster Vladeck points to as proof of “libertarian hijacking” — where Paul definitely defined his terms narrowly (but in a later iteration did succeed in getting more response from Jim Comey than Ron Wyden making demands) — Paul was arguing for precisely what Vladeck said we should be arguing about. He just has cooties, I guess is the substance of Vladeck’s argument, so Vladeck doesn’t want him as an ally.

Equally bizarre is Vladeck’s claim that, “it was the very same Senator Paul who all-but-singlehandedly torpedoed the Leahy bill back in November, helping to force the entirely unnecessary political and legal brinkmanship of the past week.” That’s bizarre because, as a matter of fact, Paul did not “singlehandedly” torpedo the bill; Bill Nelson played an equal role (and that’s even assuming the bill had enough votes to pass, which given that I know of 1 pro-cloture vote who was a no vote on passage and a significant number who weren’t committed to vote for it without improving amendment, was never a foregone conclusion). It’s easy to blame Paul because it absolves whoever it was that whipped a bill but didn’t even count all the Democratic votes on it, but Paul was in no way singlehandedly responsible.

But the view all the more bizarre, coming from Vladeck, because if Paul singlehandedly torpedoed the bill (he didn’t) he also singlehandedly made the 2nd Circuit ruling for ACLU possible (he didn’t, but that is Vladeck’s logic). And unlike most USA F-ReDux champions, Vladeck has been very attentive– if, at times, arguably mistaken in his understanding of it — to the interaction of USA F-ReDux legislation and the courts. While USA F-ReDux is — important additional Congressional reporting requirements on PRTT and bulky 215 collection notwithstanding — definitely a worse bill than its predecessor, that’s not the measure. So long as the 2nd Circuit decision ruling against “relevant to” and finding a Fourth Amendment interest at the moment of collection rather than review stands (the government still has a few weeks to challenge it), the measure is USA F-ReDux plusthe 2nd Circuit decision as compared to USAF without the additional leverage of an appellate court ruling. There are very important things the 2nd Circuit decision may add to USA F-ReDux. Every commenter is entitled to weigh that measure themselves, but if you’re going to hold Paul responsible for torpedoing the legislation last fall you also have to credit him with buying time so the 2nd Circuit could weigh in.

Which brings me to leverage.

I was not a fan of any version of USAF because all left every key provision save the CDR function (and even some of that was left dangerously open to interpretation until HJC wrote its final bill report) subject to the whim of the Executive and/or the FISC, and the bill itself jettisoned necessary leverage over the Executive (Vladeck has written about the gutting of the FISC advocate, and a parallel gutting has happened on transparency provisions from the start). That is, rather than exercise some kind of authority over the Executive, Congress basically wrote down what the Executive wanted and passed it in a way that the Executive still had a lot of leeway to decide what it wanted to do.

I get why that happened and I don’t mean to diminish the work of those who pushed for more: the votes and leadership buy-in simply isn’t there yet to actually start limiting what Article II will do in secret.

But that means none of the other things Vladeck wants will be possible until we get more leverage. And while the outcome of the bill may be the same and/or worse, what is different about the passage of USA F-ReDux is that leadership in both house of Congress barely kept it together.

And Rand Paul, whether he has cooties or not, was key to that process.

That’s true, in large part, because Mitch McConnell was aiming to set up an urgent crisis as a way to scare people into making the bill worse. He succeeded in doing so by delaying consideration of the bill until the last minute, but when Paul — and Ron Wyden and Martin Heinrich — prevented him from getting a short-term extension to do so without lapsing the dragnet, that changed the calculus of the crisis. It meant those who had bought into the idea you need a dragnet to keep the country safe could be pressured to vote against McConnell’s efforts to weaken USA F-ReDux. (Note, there are some who have claimed that Paul objected to immediately considering USA F-ReDux Sunday night, giving McConnell his opportunity to amend the bill, but the congressional record doesn’t support that; McConnell didn’t call for immediate consideration of the bill itself until he had already filled the tree with amendments.)

And while I don’t want to minimize the utterly crucial efforts of Mike Lee to actually whip the vote, that effort was made easier by the very real threat that if the bill had to go back to the House it would die, resulting in a more permanent lapse to Section 215 and the other expired authorities. Leahy and others used that threat repeatedly, in fact, to argue that surveillance hawks needed to support an amended bill. And the threat was heightened because John Boehner had real worries that if he tried something funny, his own leadership would be at risk.

Last year, the privacy community was mostly fighting with carrots against an Executive branch that was dictating what it was willing to give up. Now, it’s fighting with carrots and sticks. We haven’t gotten the Executive branch to give up anything it didn’t already want to give up yet. But having dealt McConnell a big defeat and having the threat to do so with Boehner might make that possible going forward.

Having someone like Rand Paul, who is not afraid to be accused of having cooties, to make that possible is a critical part of that process. That doesn’t negate the efforts of anyone else (again, I’m really encouraged by Mike Lee’s role in all this). But it does mean people holding carrots but demanding things that will only be obtained with some sticks, too, ought not to dismiss the efforts to make the threat of a stick real.

 

Mitch McConnell and Richard Burr’s Authoritarian Power Grab Fails

Last night, Mitch McConnell dealt himself a humiliating defeat. As I correctly predicted a month before events played out, McConnell tried to create a panic that would permit him and Richard Burr to demand changes — including iMessage retention, among other things — to USA F-ReDux. That is, in fact, what Mitch attempted to do, as is evident from the authoritarian power grab Burr released around 8:30 last night (that is, technically after the Administration had already missed the FISA Court deadline to renew the dragnet).

Contrary to a lot of absolutely horrible reporting on Burr’s bill, it does not actually resemble USA F-ReDux.

As I laid out here, it would start by gutting ECPA, such that the FBI could resume using NSLs to do the bulky Internet collection that moved to Section 215 production in 2009.

It also vastly expanded the application of the call record function (which it very explicitly applied to electronic communications providers, meaning it would include all Internet production, though that is probably what USA F-ReDux does implicitly), such that it could be used against Americans for any counterterrorism or counterintelligence (which includes leaks and cybersecurity) function, and for foreigners (which would chain onto Americans) for any foreign intelligence purpose. The chaining function includes the same vague language from USA F-ReDux which, in the absence of the limiting language in the House Judiciary Committee bill report, probably lets the government chain on session identifying information (like location and cookies, but possibly even things like address books) to do pattern analysis on providers’ data. Plus, the bill might even permit the government to do this chaining in provider data, because it doesn’t define a key “permit access” term.

Burr’s bill applies EO 12333 minimization procedures (and notice), not the stronger Section 215 ones Congress mandated in 2006; while USA F-ReDux data will already be shared far more widely than it is now, this would ensure that no defendant ever gets to challenge this collection. It imposes a 3-year data retention mandate (which would be a significant new burden on both Verizon and Apple). It appears to flip the amicus provision on its head, such that if Verizon or Apple challenged retention or any other part of the program, the FISC could provide a lawyer for the tech companies and tell that lawyer to fight for retention. And in the piece de la resistance, the bill creates its very own Espionage Act imposing 10 year prison terms for anyone who reveals precisely what’s happening in this expanded querying function at providers.

It is, in short, the forced-deputization of the nation’s communications providers to conduct EO 12333 spying on Americans within America.

Had Mitch had his way, after both USA F-ReDux and his 2-month straight reauthorization failed to get cloture, he would have asked for a week extension, during which the House would have been forced to come back to work and accept — under threat of “going dark” — some of the things demanded in Burr’s bill.

It didn’t work out.

Sure, both USA F-ReDux (57-42) and the short-term reauthorization (45-54) failed cloture votes.

But as it was, USA F-ReDux had far more support than the short-term reauthorization. Both McConnell and Rand Paul voted against both, for very different reasons. The difference in the vote results, however, was that Joe Donnelly (D), Jeff Flake (R), Ron Johnson (R), James Lankford (R), Bill Nelson (D), Tim Scott (R), and Dan Sullivan (R) voted yes to both. McConnell’s preferred option didn’t even get a majority of the vote, because he lost a chunk of his members.

Then McConnell played the hand he believed would give himself and Burr leverage. The plan — as I stated — was to get a very short term reauthorization passed and in that period force through changes with the House (never mind that permitting that to happen might have cost Boehner his Speakership, that’s what McConnell and Burr had in mind).

First, McConnell asked for unanimous consent to pass an extension to June 8. (h/t joanneleon for making the clip) But Paul, reminding that this country’s founders opposed General Warrants and demanding 2 majority vote amendments, objected. McConnell then asked for a June 5 extension, to which Ron Wyden objected. McConnell asked for an extension to June 3. Martin Heinrich objected. McConnell asked for an extension to June 2. Paul objected.

McConnell’s bid failed. And he ultimately scheduled the Senate to return on Sunday afternoon, May 31.

By far the most likely outcome at this point is that enough Senators — likely candidates are Mark Kirk, Angus King, John McCain, Joni Ernst, or Susan Collins — flip their vote on USA F-ReDux, which will then be rushed to President Obama just hours before Section 215 (and with it, Lone Wolf and Roving Wiretaps) expires on June 1. But even that (because of when McConnell scheduled it) probably requires Paul to agree to an immediate vote.

But if not, it won’t be the immediate end of the world.

On this issue, too, the reporting has been horrible, even to almost universal misrepresentation of what Jim Comey said about the importance of expiring provisions — I’ve laid out what he really said and what it means here. Comey cares first and foremost about the other Section 215 uses, almost surely the bulky Internet collection that moved there in 2009. But those orders, because they’re tied to existing investigations (of presumably more focused subject than the standing counterterrorism investigation to justify the phone dragnet), they will be grand-fathered at least until whatever expiration date they have hits, if not longer. So FBI will be anxious to restore that authority (or move it back to NSLs as Burr’s bill would do), especially since unlike the phone dragnet, there aren’t other ways to get the data. But there’s some time left to do that.

Comey also said the Roving Wiretap is critical. I’m guessing that’s because they use it to target things like Tor relays. But if that’s the primary secretly redefined function, they likely have learned enough about the Tor relays they’re parked on to get individual warrants. And here, too, the FBI likely won’t have to detask until expiration days on these FISA orders come due.

As for the phone dragnet and the Lone Wolf? Those are less urgent, according to Comey.

Now, that might help the Republicans who want to jam through some of Burr’s demands, since most moderate reformers assume the phone dragnet is the most important function that expires. Except that McConnell and others have spent so long pretending that this is about a phone dragnet that in truth doesn’t really work, that skittish Republicans are likely to want to appear to do all they can to keep the phone dragnet afloat.

As I said, the most likely outcome is that a number of people flip their vote and help pass USA F-ReDux.

But as with last night’s “debate,” no one really knows for sure.

Wyden et al: Spot the Lie in Brennan’s CFR Speech Contest!

As the Daily Dot reported, Senators Wyden, Heinrich, and Hirono wrote John Brennan a letter trying to get him to admit that he lied about hacking the Senate Intelligence Committee.

But, as often happens with Wyden-authored letters, they also included this oblique paragraph at the end:

Additionally, we are attaching a separate classified letter regarding inaccurate public statements that you made on another topic in March 2015. We ask that you correct the public record regarding these statements immediately.

A game!!! Find the lies Brennan told in March!!!

The most likely place to look for Brennan lies comes in this appearance at the Council on Foreign Relations, where Brennan took questions from the audience.

While you might think Brennan lied about outsourcing torture to our allies, his answer on CIA involvement with interrogations conducted by our partners was largely truthful, even if he left out the part of detainees being tortured in custody.

But on a related issue, Brennan surely lied. He claimed — in response to a questions from an HRW staffer — not to partner with those who commit atrocities.

QUESTION: I’m going to try to stand up. Sarah Leah Whitson, Human Rights Watch. Two days ago, ABC News ran some video and images of psychopathic murderers, thugs in the Iraqi security forces, carrying out beheadings, executions of children, executions of civilians. Human Rights Watch has documented Iraqi militias carrying out ISIS-like atrocities, executions of hundreds of captives and so forth.

And some of the allies in the anti-ISIS coalition are themselves carrying out ISIS-like atrocities, like beheadings in Saudi Arabia, violent attacks on journalists in Saudi Arabia—how do you think Iraqi Sunni civilians should distinguish between the good guys and the bad guys in this circumstance?

BRENNAN: It’s tough sorting out good guys and bad guys in a lot of these areas, it is. And human rights abuses, whether they take place on the part of ISIL or of militias or individuals who are working as part of formal security services, needs to be exposed, needs to be stopped.

And in an area like Iraq and Syria, there has been some horrific, horrific human rights abuses. And this is something that I think we need to be able to address. And when we see it, we do bring it to the attention of authorities. And when we see it, we do bring it to the attention of authorities. And we will not work with entities that are engaged in such activities.

As I noted at the time, Brennan totally dodged the question about Saudi atrocities. But it is also the case that many of the “moderates” we’ve partnered with in both Syria and Iraq have themselves engaged in atrocities.

So I suspect his claim that “we will not work with entities that are engaged in such activities” is one of the statements Wyden et al were pointing to.

A potentially related alternative candidate (the letter did say Brennan had made false statements, plural) is this exchange. When Brennan claimed, at the time, he has no ties to Qasim Soleimani, I assumed he was lying, not just because we’re actually fighting a way in IRGC’s vicinity but also because Brennan seemed to exhibit some of the “tells” he does when he lies.

QUESTION: James Sitrick, Baker & McKenzie. You spent a considerable amount of your opening remarks talking about the importance of liaison relationships. Charlie alluded to this in one of his references to you, on the adage—the old adage has it that the enemy of your enemy is your friend. Are we in any way quietly, diplomatically, indirectly, liaisoning with Mr. Soleimani and his group and his people in Iraq?

BRENNAN: I am not engaging with Mr. Qasem Soleimani, who is the head of the Quds Force of Iran. So no, I am not.

I am engaged, though, with a lot of different partners, some of close, allied countries as well as some that would be considered adversaries, engaged with the Russians on issues related to terrorism.

We did a great job working with the Russians on Sochi. They were very supportive on Boston Marathon. We’re also looking at the threat that ISIL poses both to the United States as well as to Russia.

So I try to take advantage of all the different partners that are out there, because there is a strong alignment on some issues—on proliferation as well as on terrorism and others as well.

I happen to think it an exaggeration that the Russians “were very supportive on Boston Marathon,” but maybe that’s because FSB was rolling up CIA spies who were investigating potentially related groups in Russia.

Finally, while less likely, I think this might be a candidate.

QUESTION: Thank you. Paula DiPerna, NTR Foundation. This is probably an unpopular suggestion, but is it feasible or how feasible would it be to do a little selective Internet disruption in the areas concerned, a la a blockade, digital blockade, and then an international fund to indemnify business loss?

BRENNAN: OK. First of all, as we all know, the worldwide web, the Internet, is a very large enterprise. And trying to stop things from coming out, there are political issues, there are legal issues here in the United States as far as freedom of speech is concerned. But even given that consideration, doing it technically and preventing some things from surfacing is really quite challenging.

And we see that a number of these organizations have been able to immediately post what they’re doing in Twitter. And the ability to stop some things from getting out is really quite challenging.

As far as, you know, indemnification of various companies on some of these issues, there has been unfortunately a very, very long, multi-year effort on the part of the Congress to try to pass some cybersecurity legislation that addressed some of these issues. There has been passage in the Senate.

I think it’s overdue. We need to update our legal structures as well as our policy structures to deal with the cyber threats we face.

Remember, Ron Wyden has been pointing to an OLC opinion on Common Commercial Services (which, however, CIA’s now General Counsel Carolyn Krass said publicly she wouldn’t rely on) for years. I suspect indemnity is one of the things it might cover.

Plus, I do think it likely that we’ve disrupted the Internet in various circumstances.

Who knows? Maybe Brennan just told a lot of lies.

It wouldn’t be the first time.

Update: NatSec sources are already dismissing this Sy Hersh piece on the real story behind the bin Laden killing. But if there’s truth to this detail, then it would suggest I was overly optimistic when I suggested Brennan was truthful about outsourcing our interrogation to allies.

The retired official told me that the CIA leadership had become experts in derailing serious threats from Congress: ‘They create something that is horrible but not that bad. Give them something that sounds terrible. “Oh my God, we were shoving food up a prisoner’s ass!” Meanwhile, they’re not telling the committee about murders, other war crimes, and secret prisons like we still have in Diego Garcia. The goal also was to stall it as long as possible, which they did.’

If we do still have a secret prison in Diego Garcia, then the claim that we outsource everything to allies would be the key lie here.

Government’s Assassination of Anwar al-Awlaki Used “Significantly Different” EO 12333 Analysis

Jameel Jaffer has a post on the government’s latest crazy-talk in the ongoing ACLU and NYT effort to liberate more drone memos. He describes how — in the government’s response to their appeal of the latest decisions on the Anwar al-Awlaki FOIA — the government claims the Court’s release of an OLC memo does not constitute official release of that memo. (Note, I wouldn’t be surprised if the government is making this claim in anticipation of orders to release torture pictures in ACLU’s torture FOIA suit that’s about to head to the 2nd Circuit.)

But there’s another interesting aspect of that brief. It provides heavily redacted discussion of the things Judge Colleen McMahon permitted the government to withhold. But it makes it clear that one of those things is a March 2002 OLC memo that offers different analysis about the assassination ban than the analysis used to kill Anwar al-Awlaki.

The district court also upheld the withholding of a March 2002 OLC Memorandum analyzing the assassination ban in Executive Order 12,333 (the “March 2002 Memorandum”). (CA 468-70; see CA 315-29). Although the district court noted that the OLC-DOD Memorandum released by this Court contained a “brief mention” of Executive Order 12,333, the district court concluded that the analysis in the March 2002 Memorandum is significantly different from any legal analysis that this Court held has been officially disclosed and for which privilege has been waived.

The statement here is carefully worded, probably for good reason. That’s because the February 19, 2010 memo McMahon permitted the government to almost entirely redact clearly explains EO 123333 and its purported ban on assassinations in more depth than the July 16, 2010 one; the first paragraph ends,

Under the conditions and factual predicates as represented by the CIA and in the materials provided to us from the Intelligence Community, we believed that a decisionmaker, on the basis of such information, could reasonably conclude that the use of lethal force against Aulaqi would not violate the assassination ban in Executive Order 12333 or any application constitutional limitations due to Aulaqi’s United States citizenship.

I pointed out that there must be more assassination analysis here. It almost certainly resembles what Harold Koh said about a month later, for which activists at NYU are now calling into question his suitability as an international law professor.

Fourth and finally, some have argued that our targeting practices violate domestic law, in particular, the long-standing domestic ban on assassinations. But under domestic law, the use of lawful weapons systems—consistent with the applicable laws of war—for precision targeting of specific high-level belligerent leaders when acting in self-defense or during an armed conflict is not unlawful, and hence does not constitute “assassination.”

But the government is claiming that because that didn’t get disclosed in the July 2010 memo, it doesn’t have to be disclosed in the February 2010 memo, and the earlier “significantly different” analysis from OLC doesn’t have to be disclosed either.

At a minimum, ACLU and NYT ought to be able to point to the language in the white paper that addresses assassinations that doesn’t appear in the later memo to show that the government has already disclosed it.

But I’m just as interested that OLC had to change its previous stance on assassinations to be able to kill Awlaki.

Of course, the earlier memo was written during a period when John Yoo and others were pixie dusting EO 12333, basically saying the President didn’t have to abide by EO 12333, but could instead violate it and call that modifying it. Perhaps that’s the difference — that David Barron invented a way to say that killing a high ranking leader (whether or not he’s a citizen) didn’t constitute assassination because of the weapons systems involved, as distinct from saying the President could blow off his own EOs in secret and not tell anyone.

I suggested Dick Cheney had likely pixie dusted EO 12333’s ban on assassinations back in 2009.

But there’s also the possibility the government had to reverse the earlier decision in some other fashion. After all, when Kamal Derwish was killed in a drone strike in Yemen on November 9, 2002, the government claimed Abu Ali al-Harithi was the target, a claim the government made about its December 24, 2009 attempt to kill Anwar al-Awlaki, but one they dropped in all subsequent attempts, coincident with the February 2010 memo. That is, while I think it less likely than the alternative, it is possible that the 2010 analysis is “significantly different” because they had to interpret the assassination ban even more permissively. While I do think it less likely, it might explain why Senators Wyden, Udall, and Heinrich keep pushing for more disclosure on this issue.

One thing is clear, however. The fact that the government can conduct “significantly different” analysis of what EO 12333 means, in secret, anytime it wants to wiretap or kill a US citizen makes clear that it is not a meaningful limit on Executive power.

The Unopened Torture Report and Trusting CIA on Other Covert Operations

Yesterday, Pat Leahy issued a Sunshine Week statement criticizing Richard Burr for attempting to reclaim all copies of the Torture Report, but also complaining that State and DOJ haven’t opened their copy of the Torture Report.

I also was appalled to learn that several of the agencies that received the full report in December have not yet opened it.  In a Freedom of Information Act (FOIA) lawsuit seeking release of the full report, Justice Department and State Department officials submitted declarations stating that their copies remain locked away in unopened, sealed envelopes.  I do not know if this was done to attempt to bolster the government’s position in the FOIA lawsuit, or to otherwise avoid Federal records laws.  I certainly hope not.  Regardless of the motivation, it was a mistake and needs to be rectified.

The executive summary of the torture report makes clear that both the State Department and the Justice Department have much to learn from the history of the CIA’s torture program.  Both agencies were misled by the CIA about the program.  Both should consider systemic changes in how they deal with covert actions.  Yet neither agency has bothered to open the final, full version of the report, or apparently even those sections most relevant to them.

Today, Ron Wyden issued a Sunshine Week release linking back to a February 3 letter Eric Holder is still ignoring.  The letter — which I wrote about here — addresses 4 things: 1) the unclear limits on the President’s ability to kill Americans outside of war zones 2) the common commercial service agreement OLC opinion that should be withdrawn 3) some action the Executive took that Wyden and Russ Feingold wrote Holder and Hillary about in late 2010 and 4) DOJ’s failure to even open the Torture Report. Wyden’s statement, lumps all these under “secret law.”

U.S. Senator Ron Wyden, D-Ore., renewed his call for Attorney General Eric Holder to answer crucial questions on everything from when the government believes it has the right to kill an American to secret interpretations of law. The Justice Department has ignored these questions or declined to answer them, in some cases for years.

[snip]

“It is never acceptable to keep the basic interpretations of U.S. law secret from the American people. It doesn’t make our country safer, and erodes the public’s confidence in the government and intelligence agencies in particular,” Wyden said. “While it is appropriate to keep sources, methods and operations secret, the law should never be a mystery. Sunshine Week is the perfect time for the Justice Department to pull back the curtains and let the light in on how our government interprets the law.”

This may be secret law.

But I find it interesting that both Wyden’s letter and Leahy’s statement tie covert operations to the lessons from the Torture Report.

There are many reasons DOJ (and FBI) are probably refusing to open the Torture Report. The most obvious — the one everyone is pointing to — is that by not opening it, these Agencies keep it safe from the snooping FOIAs of the ACLU and Jason Leopold.

But the other reason DOJ and FBI might want to keep this report sealed is what it says about the reliability of the CIA.

The CIA lied repeatedly to DOJ, FBI, and FBI Director Jim Comey (when he was Deputy Attorney General) specifically. Specifically, they lied to protect the conduct of what was structured as a covert operation, CIA breaking the law at the behest of the President.

Of course, both DOJ generally and FBI specifically continue to partner with CIA as if nothing has gone on, as if the spooks retain the credibility they had back in 2001, as if they should retain that credibility. (I’m particularly interested in the way FBI participated in the killing of Anwar al-Awlaki, perhaps relying on CIA’s claims there, too, but it goes well beyond that.)

That’s understandable, to a point. If DOJ and the FBI are going to continue pursuing (especially) terrorists with CIA, they need to be able to trust them, to trust they’re not being lied to about, potentially, everything.

Except that ignores the lesson of the Torture Report, which is that CIA will lie about anything to get DOJ to rubber stamp criminal behavior.

No wonder DOJ and FBI aren’t opening that report.

Bob Litt Tried to Stuff Ron Wyden down Alice In Wonderland’s Rabbit Hole

Screen Shot 2015-03-05 at 5.59.31 PM

Man, I must have written about this letter Ron Wyden sent to John Brennan during his confirmation process 15 times (of which just a few are linked below). Which is why I’m so fascinated by the back and forth between Wyden’s office (the staffer’s name is redacted) and ODNI, largely Bob Litt, both before and after Wyden sent the letter on January 14, 2013. (Many many kudos to Zack Sampson who FOIAed it through MuckRock.)

Wyden’s office submitted the letter for a declassification review on January 11, 2013. Wyden’s office did not get an answer before he sent it. And on January 15, Bob Litt complained,

I have a concern that there are several references in this letter that are not only classified but compartmented.

So the staffer writes back letting Litt know that he or she had unclassified comments by Executive Branch officials for all the references, and he or she will happily share it. To which Litt responded (on January 17),

Although I am dubious, since there are statements in there that assume as fact things that we have recently succeeded in convincing a judge remain classified, I’ll take a look.

It went on for a while (the email thread is from page 21 to 24), with Litt complaining some more, promising Brennan wouldn’t answer questions about it, and the staffer ultimately pointing out that the reason they keep asking publicly is because ODNI won’t provide answers even in classified form (this exchange precedes Clapper’s lies about the dragnet — about which most of the other documents released under this FOIA pertain — by two months).

What Litt was talking about, clearly, was the Administration’s killing of Anwar al-Awlaki, the memos authorizing which Judge Colleen McMahon, citing Alice in Wonderland for the bizarreness of it all, had just ruled remained exempt from FOIA on January 2, 2013.

In other words, Litt was suggesting that Wyden should not have said the following — which cites McMahon!! — because McMahon had ruled that the government did not have to give the OLC memos authorizing the Awlaki killing to ACLU and NYT, which is rather different from ruling they didn’t have to share such information with the Intelligence Committee or claiming that Wyden could not refer to official comments in a letter to someone who made those comments because citing back those comments made them classified.

I have asked repeatedly over the past two years to see the secret legal opinions that contain the executive branch’s understanding of the President’s authority to kill American citizens in the course of counterterrorism operations. Senior intelligence officials have said publicly that they have the authority to knowingly use lethal force against Americans in the course of counterterrorism operations, and have indicated that there are secret legal opinions issued by the Justice Department’s Office of Legal Counsel that explain the basis for this authority. I have asked repeatedly to see these opinions and I have been provided with some relevant information on the topic, but I have yet to see the opinions themselves.

Both you and the Attorney General gave public speeches on this topic early last year, and these speeches were a welcome step in the direction of more transparency and openness, but as I noted at the time, these speeches left a large number of important questions unanswered. A federal judge recently noted in a Freedom of Information Act case that “no lawyer worth his salt would equate Mr. Holder’s statements with the sort of robust analysis that one finds in a properly constructed legal opinion,” and I assume that Attorney General Holder would agree that this was not his intent.

As Wyden noted, both Brennan and Holder had given big dog-and-pony shows that were clearly about killing Awlaki, and yet Bob Litt wanted to prevent Wyden from pressuring Brennan to turn over the actual legal authorizations to the Intelligence Community’s oversight committee? Really?

Ah well, it all worked out for the forces of good, as when the Committee threatened to hold up Brennan’s confirmation, someone leaked the White Paper to Mike Isikoff that therefore had to be shared with Jason Leopold that ultimately led McMahon to liberate the opinions themselves.

Which is probably precisely what Bob Litt was worried about.
Continue reading

Dianne Feinstein Calls Out NCTC Head for Bullshit Torture Report Threat Assessment

Screen Shot 2015-02-12 at 4.23.40 PMToday’s SSCI public hearing was remarkably useful, in spite of Chairman Burr’s interrupting a chain of serious questions to ask a clown question of National Counterterrorism Center head Nick Rasmussen. Roy Blunt, Marco Rubio, and Angus King all asked questions about Authorizations to Use Military Force that will be useful in the upcoming debate.

The highlight, however, came when Dianne Feinstein asked Rasmussen whether the claims of great harm — provided to her just before she released the Torture Report in December — had proven to be correct.

Feinstein: And I have one other question to ask the Director. Um, Mr. Director, days before the public release of our report on CIA detention and interrogation, we received an intelligence assessment predicting violence throughout the world and significant damage to United States relationships. NCTC participated in that assessment. Do you believe that assessment proved correct?

Rasmussen: I can speak particularly to the threat portion of that rather than the partnership aspect of that because I would say that’s the part NCTC would have the most direct purchase on, and I can’t say that I can disaggregate the level of terrorism and violence we’ve seen in the period since the report was issued, disaggregate that level from what we might have seen otherwise because, as you know, the turmoil roiling in those parts of the world, not that part of the world, those parts of the world, the Middle East, Africa, South Asia, there’s a number of factors that go on creating the difficult threat environment we face.

So the assessment we made at the time as a community was that we would increase or add to the threat picture in those places. I don’t know that looking backwards now, I can say it did by X% or it didn’t by X%. We were also, I think, clear in saying that there’s parts of the impact that we will not know until we have the benefit of time to see how it would play out in different locations around the world.

Feinstein: Oh boy do I disagree with you. But that’s what makes this arena I guess. The fact in my mind was that the threat assessment was not correct.

Note, Ron Wyden used his one question to get Rasumussen to admit that he had only read the Torture Report summary in enough detail to conduct the threat assessment. Wyden informed Rasmussen there were other parts in the still-classified sections that he should be aware of as NCTC head.

Why Aren’t Tech Companies Demanding the Common Commercial Service Agreement OLC?

As noted, Ron Wyden used Eric Holder’s imminent departure as an opportunity to point to some secrets that he believes should be told. One of those pertains to what the 2003 OLC opinion on common commercial service agreements refers to.

Second, I have written to you on multiple occasions about a particular legal opinion from the Justice Department’s Office of Legal Counsel (OLC) interpreting common commercial service agreements. As I have said, I believe that opinion is inconsistent with the public’s understanding of the law, and should be withdrawn. I also believe that this opinion should be declassified and released to the public, so that anyone who is party to one of these agreements can consider whether their agreement should be revised or modified.

In her December 2013 confirmation hearing to be General Counsel of the CIA, the deputy head of the OLC stated that she would not rely on this opinion today. While I appreciate her restraint, I believe the wisest course of action would be for you to withdraw and declassify this opinion, so that other government officials are not tempted to rely on it in the future. I urge you to take these actions as soon as practicable, since I believe it will be difficult for Congress to have a fully informed debate on cybersecurity legislation if it does not understand how these agreements have been interpreted by the Executive Branch.

As I laid out in October 2013, Wyden has been trying to liberate this memo since before summer 2012, and he has (as he now is doing) renewed his request every time cybersecurity bills come up (and then some).

Some time last summer, Ron Wyden wrote Attorney General Holder, asking him (for the second time) to declassify and revoke an OLC opinion pertaining to common commercial service agreements. He said at the time the opinion “ha[d] direct relevance to ongoing congressional debates regarding cybersecurity legislation.”

That request would presumably have been made after President Obama’s April 25, 2012 veto threat of CISPA, but at a time when several proposed Cybersecurity bills, with different information sharing structures, were floating around Congress.

Wyden asked for the declassification and withdrawal of the memo again this January as part of his laundry list of requests in advance of John Brennan’s confirmation. Then, after having been silent about this request for 8 months (at least in public), Wyden asked againon September 26.

Since then, we’ve learned that the memo dates to 2003, and was a matter of first impression when it was written.

I’ve been writing about this memo since 2013, but I don’t have the legal support to FOIA something DOJ is obviously pretty embarrassed about.

But why hasn’t big tech? Why haven’t other companies that sign common commercial service agreements? Why hasn’t some lawyered up company — or lawyered up trade group — sued for this thing, as it clearly may affect their businesses?

Or would they just rather prefer not to know?

1 2 3 19
Emptywheel Twitterverse
bmaz @Reillax @foolintheforest @djsziff I am hoping, but.....
1hreplyretweetfavorite
bmaz @foolintheforest @djsziff Dude, already had that quote in mind if an insurance carrier atty doesn't take over!
1hreplyretweetfavorite
bmaz @Reillax @foolintheforest @djsziff Yes, it is. But this is not under the "dog bite statute", but under ARS §11-1020 http://t.co/syYDOzwvZR
1hreplyretweetfavorite
bmaz @foolintheforest @djsziff ...a bite or an "attack" by the animal, not just presence and being tripped over.
2hreplyretweetfavorite
bmaz @foolintheforest @djsziff but where the fuck does that fit in with "strict animal liability" law, which almost universally contemplates...
2hreplyretweetfavorite
bmaz @djsziff @foolintheforest at least this is what I believe *so far*. But I trust this client pretty far.
2hreplyretweetfavorite
bmaz @djsziff @foolintheforest Yes, as to both of you. Was in very enclosed school playground under teacher supervision. Kid admits was klutz.
2hreplyretweetfavorite
bmaz @foolintheforest @djsziff welp, yeah putatively. Heres statute plaintiff claiming http://t.co/syYDOzwvZR Ergo dog involved/presto liability!
2hreplyretweetfavorite
bmaz @djsziff @foolintheforest well, I may be! Still, don't like that. Is old client who is genuinely innocent teacher. I'm prob on my own here.
2hreplyretweetfavorite
bmaz @djsziff @foolintheforest Also, this is my focus on "enclosed", because "enclosed area" may take animal out of "at large" status.
2hreplyretweetfavorite
August 2015
S M T W T F S
« Jul    
 1
2345678
9101112131415
16171819202122
23242526272829
3031