2008’s New and Improved EO 12333: Sharing SIGINT

As part of my ongoing focus on Executive Order 12333, I’ve been reviewing how the Bush Administration changed the EO when, shortly after the passage of the FISA Amendments Act, on July 30, 2008, they rolled out a new version of the order, with little consultation with Congress. Here’s the original version Ronald Reagan issued in 1981, here’s the EO making the changes, here’s how the new and improved version from 2008 reads with the changes.

While the most significant changes in the EO were — and were billed to be — the elaboration of the increased role for the Director of National Intelligence (who was then revolving door Booz executive Mike McConnell), there are actually several changes that affected NSA.

Perhaps the most striking of those is that, even while the White House claimed “there were very, very few changes to Part 2 of the order” — the part that provides protections for US persons and imposes prohibitions on activities like assassinations — the EO actually replaced what had been a prohibition on the dissemination of SIGINT pertaining to US persons with permission to disseminate it with Attorney General approval.

The last paragraph of 2.3 — which describes what data on US persons may be collected — reads in the original,

In addition, agencies within the Intelligence Community may disseminate information, other than information derived from signals intelligence, to each appropriate agency within the Intelligence Community for purposes of allowing the recipient agency to determine whether the information is relevant to its responsibilities and can be retained by it.

The 2008 version requires AG and DNI approval for such dissemination, but it affirmatively permits it.

In addition, elements of the Intelligence Community may disseminate information to each appropriate element within the Intelligence Community for purposes of allowing the recipient element to determine whether the information is relevant to its responsibilities and can be retained by it, except that information derived from signals intelligence may only be disseminated or made available to Intelligence Community elements in accordance with procedures established by the Director in coordination with the Secretary of Defense and approved by the Attorney General.

Given that the DNI and AG certified the minimization procedures used with FAA, their approval for any dissemination under that program would be built in here; they have already approved it! The same is true of the SPCMA — the EO 12333 US person metadata analysis that had been approved by both Attorney General Mukasey and Defense Secretary Robert Gates earlier that year. Also included in FISA-specific dissemination, the FBI had either just been granted, or would be in the following months, permission — in minimization procedures approved by both the DNI and AG — to conduct back door searches on incidentally collected US person data.

In other words, at precisely the time when at least 3 different programs expanded the DNI and AG approved SIGINT collection and analysis of US person data, EO 12333 newly permitted the dissemination of that information.

And a more subtle change goes even further. Section 2.5 of the EO delegates authority to the AG to “approve the use for intelligence purposes, within the United States or against a United States person abroad, of any technique for which a warrant would be required if undertaken for law enforcement purposes.” In both the original and the revised EO, that delegation must be done within the scope of FISA (or FISA as amended, in the revision). But in 1981, FISA surveillance had to be “conducted in accordance with that Act [FISA], as well as this Order,” meaning that the limits on US person collection and dissemination from the EO applied, on top of any limits imposed by FISA. The 2008 EO dropped the last clause, meaning that such surveillance only has to comply with FISA, and not with other limits in the EO.

That’s significant because there are at least three things built into known FISA minimization procedures — the retention of US person data to protect property as well as life and body, the indefinite retention of encrypted communications, and the broader retention of “technical data base information” — that does not appear to be permitted under the EO’s more general guidelines but, with this provision, would be permitted (and, absent Edward Snowden, would also be hidden from public view in minimization procedures no one would ever get to see).

Given that Section 2.5 would thus permit the collection of US person data so long as it was dubbed “technical data base information,” consider the way the intelligence mandate for a number of elements of the intelligence community (including DIA, FBI, DOD and its subcomponents generally, Coast Guard, NRO, NGA, and INR, in addition to NSA, but curiously not the CIA) were newly laid out. Each of these elements is permitted to collect intelligence to support national and departmental missions. Here’s how that language appears as it applies to the NSA:

Collect (including through clandestine means), process, analyze, produce, and disseminate signals intelligence information and data for foreign intelligence and counterintelligence purposes to support national and departmental missions;

[snip]

Provide signals intelligence support for national and departmental requirements and for the conduct of military operations;

Curiously, this change comes with the elimination of the 1981 clause authorizing NSA’s “Conduct of research and development to meet the needs of the United States for signals intelligence and communications security” (though there is a similar clause in the 2008 EO applying to both the Intelligence Community as a whole and DOD specifically, which would both apply to NSA). NSA still collects and uses the data it needs to conduct research to advance the SIGINT mission, it appears, but as it seems in the 2008 EO, it does so in the name of advancing the Department’s goals, not the nation’s.

In 1981, only DOD had such a departmental mandate. Extending it to these other agencies and departments seems to give them a recursive purpose, the mandate to collect intelligence to serve their own department.

And all this comes in an EO that seems to envision SIGINT playing a bigger role in US intelligence (which makes sense, given that’s what we know to have happened). The 1981 EO explicitly calls for a balance between, “technical collection efforts and other means.” The 2008 EO eliminates that.

In addition, the 2008 description of both the CIA and FBI’s roles limits their focus to human and human-enabled sources (which is particularly curious given that FBI actually has a key role in SIGINT collection).

(A) The Director of the Federal Bureau of Investigation shall coordinate the clandestine collection of foreign intelligence collected through human sources or through human-enabled means and counterintelligence activities inside the United States;

(B) The Director of the Central Intelligence Agency shall coordinate the clandestine collection of foreign intelligence collected through human sources or through human-enabled means and counterintelligence activities outside the United States;

At the same time, the revised EO designates the Director of NSA as the functional manager for SIGINT, seemingly both within and outside of the US.

As I said, none of that should be surprising: it reflects both what we knew before last June, and has been reinforced with much of what we’ve learned with the Snowden leaks. But it does reflect a codification of that change that I don’t think got much notice at the time, even in spite of the EO’s revision coming so quickly on the heels of FAA.

There are two more items of interest that affect the potential scope of information sharing, and this applies to both NSA and other elements of the intelligence community (including, to the extent permitted by law, CIA).

First, in one of the changes the Bush Administration hailed at the time, the EO envisions information sharing outside of the Federal government, to state, local, and tribal governments, and to the private sector.

(f) State, local, and tribal governments are critical partners in securing and defending the United States from terrorism and other threats to the United States and its interests. Our national intelligence effort should take into account the responsibilities and requirements of State, local, and tribal governments and, as appropriate, private sector entities, when undertaking the collection and dissemination of information and intelligence to protect the United States.

This language is repeated several times in the EO.

In a far more subtle change, section 2.6(d) allows intelligence entities to cooperate not just with domestic law enforcement, but also with “other civil authorities” so long as it is not otherwise legally precluded. I can only begin to grasp what the Bush Administration had in mind with this. But at least in the case of NSA, in the face of endless cyber-fearmongering, I can imagine it might support NSA partnering with civil agencies overseeing critical infrastructure (to the extent that that infrastructure is owned by civil authorities and not the private sector).

In 2008, even as the Bush Administration insisted that protections on US person data didn’t change with EO 12333’s revision, it appears they did change those protections to allow the dissemination of SIGINT on US persons, potentially even to local governments and private entities.

I suspect many, perhaps most, of the changes affecting NSA were not actually new changes. As we know, John Yoo had pixie dusted EO 12333 to hide what the Bush Administration was doing with SIGINT. And at least as late as December 2007, Sheldon Whitehouse believed that pixie dust to remain in effect. So I think it likely that the NSA-related changes simply reflect what Bush had been doing since 2001 in any case.

But in retrospect, the changes to EO 12333 might have raised more alarm about the growing role of the NSA and the dissemination of the data on US persons it collected.

Marcy Wheeler is an independent journalist writing about national security and civil liberties. She writes as emptywheel at her eponymous blog, publishes at outlets including Vice, Motherboard, the Nation, the Atlantic, Al Jazeera, and appears frequently on television and radio. She is the author of Anatomy of Deceit, a primer on the CIA leak investigation, and liveblogged the Scooter Libby trial.

Marcy has a PhD from the University of Michigan, where she researched the “feuilleton,” a short conversational newspaper form that has proven important in times of heightened censorship. Before and after her time in academics, Marcy provided documentation consulting for corporations in the auto, tech, and energy industries. She lives with her spouse in Grand Rapids, MI.

17 replies
  1. axz lmk says:

    ‘Other civil authorities’ refers to E.O. 12656 section 202 COG provisions now in force under authorities issued at the collateral (SCI, SAP) level. Especially the SCI.

  2. CTuttle says:

    OT

    Marcy have you seen this yet…? Pierre Omidyar co-funded Ukraine revolution groups with US government, documents show

    Marcy Wheeler, who is the new site’s “senior policy analyst,” speculated that the Ukraine revolution was likely a “coup” engineered by “deep forces” on behalf of “Pax Americana”: {…}

    Now Wheeler has her answer — that, yes, the revolutionary groups were part-funded by Uncle Sam, but also by her boss — one assumes awkward follow up questions will be asked on that First Look internal messaging system.

    Whether Wheeler, Scahill and their colleagues go on to share their concerns publicly will speak volumes about First Look’s much-trumpeted independence, both from Omidyar’s other business interests and from Omidyar’s co-investors in Ukraine: the US government.

  3. Snoopdido says:

    @CTuttle: From a February 23, 2010 Vanity Fair piece by James Verini comes this seminal appraisal of the author of that Pando piece, Mark Ames:

    “Ames likes to indulge a grandiose paranoia whenever possible”

    And there’s more. Far more:

    “Ames is angry—he’s often angry—about how it all ended. He’d always pictured some exultant, bloody end for The Exile. But he can’t claim to be surprised. “I always assumed that every issue would be the last,” he says. Indeed, it’s a mystery to many why Mark Ames didn’t end up in jail or a grave years ago. In its time The Exile was arguably the most abusive, defamatory, un-evenhanded, and crassest publication in Russia, and Ames and his staff had paid for that fact, or at least for the fact that they were arrogant reprobates, many times before. Columnist Edward Limonov, the 66-year-old political provocateur in whom the Federal Service officials were particularly interested, filed his copy from prison for two years after being convicted of possessing arms, which he admits he intended to smuggle into Kazakhstan in an effort to incite a coup there. Writer Kevin McElwee, an American expatriate, had both legs broken when he was torn from the side of a building he was scaling to escape an angry mob of Muscovites, an incident that had nothing to do with anything he’d written—McElwee, The Exile’s film reviewer, was just a rambunctious drunk. On another occasion, a deranged and slighted man sent a letter promising to kill the “frat boy” Ames. Ames in turn published an editorial urging the loon to instead off his co-editor, Matt Taibbi. True, the many death threats Ames received took less of a physical toll on him than loading up on Viagra and attempting to bed nine Moscow prostitutes in nine hours, which he wrote about to commemorate The Exile’s ninth anniversary, but that was only because Ames approached the assignment with a rigor befitting a Consumer Reports exposé—“There really was no other way to tell whether these drugs actually worked,” he recalls with sincerity and audible exhaustion.”

  4. Snoopdido says:

    @CTuttle: In my opinion, that piece by Mark Ames falls apart all by its conspiracy theorist self. I’m not suggesting that Marcy won’t do a piece on it, but frankly I don’t believe it’s even necessary.

    Take this paragraph from that piece:

    “But what is more immediately alarming is what makes Omidyar different. Unlike other billionaires, Omidyar has garnered nothing but uncritical, fawning press coverage, particularly from those he has hired. By acquiring a “dream team” of what remains of independent media — Greenwald, Jeremy Scahill, Wheeler, my former partner Matt Taibbi — not to mention press “critics” like Jay Rosen — he buys both silence and fawning press.”

    Has anyone who has read her work ever known Marcy to be silent or fawning? For that matter, can anyone imagine Greenwald, Jeremy Scahill, or Matt Taibbi keeping silent or being fawning? What planet does Mark Ames live on?

    I don’t doubt Marcy’s independence nor her scruples. The suggestion that Mark Ames implies that any of these journalists would submit their independent and critical abilities to some type of censorship by Pierre Omidyar is laughable to the extreme.

    Mark Ames sets up a ridiculous strawman when he suggests there is any doubt about their independence and tenacity to speak truth to power.

    Pierre Omidyar will explain himself or he won’t. But the idea that the First Look journalists are tainted merely by association is utter nonsense, and after all, that seems to really be the motivation in the Mark Ames story.

    That, and more than a little sour grapes jealousy.

  5. P J Evans says:

    @CTuttle:
    I figure that if Marcy believes there’s anything hinky about First Look, that she wouldn’t have agreed to write for them, and she’d be out of there fast enough there’d be a sonic boom.

  6. abby says:

    Dear good, this piece is far more deserving of our focus than dragging ourselves aside to converse about someone making monkey shines at us. While it is tempting to want to buzz off a fly, it only deflects from THIS very important piece which is difficult enough to digest without the sidebars. I knew there was a reason I don’t like arguing about memes, even in their childish infancy.

    It is pure genius for those who prefer we not understand how it is our nation claims to both follow the law and pervert it simultaneously to offer us “Oh, golly, Marcy. Lets take our eye of the ball and fly off to handle a bad bee’s bumps.” This is more deserving of the quiet I typically detest. Shhh, people are READING!

    So, It’s not really so much 12333 as the way DoJ’s handed off qualifiers under NSA to make data into some other format they can just pass out like printer paper to any division of the federal government? It’s got to be summarized so that SpongeBob or a typical USAF General can read it and we see their glasses get steamed. How off base am I, colonel?

  7. abby says:

    Would it be bad form for this site to have a tab at the Intercept? I don’t mean to be blind to anyone’s ambition, but Glenn’s got a big foot print and others are part of this smartie party, too, aren’t they? Should we see what other members of the squad are up to at their own sites or will they be cited at the Intecept as new stories? I’d like to be able to tab up all ya’lls’ work under one umbrella at the beach.

Comments are closed.