Missing from the EO 12333 Discussion: Its Classified Annex Michael Hayden Revised on March 11, 2004
I recommend this ArsTechnica background piece on EO 12333. It describes how Ronnie Reagan issued EO 12333 to loosen the intelligence rules imposed by Jimmy Carter (with links to key historical documents). It includes interviews with the NSA whistleblowers describing how George Bush authorized the collection of telecom data from circuits focused on the US under the guise of EO 12333, calling the bulk of the US person data collected “incidental.” And it describes how Bush and Obama have continued using EO 12333 as a loophole to obtain US person data.
But there’s a key part of the story Ars misses, which I started to lay out here. As this graphic notes, the NSA is governed by a set of interlocking authorities and laws. The precedence of those authorities and laws is not terribly clear — and NSA’s own training programs don’t make them any more clear. Bush’s revision to EO 12333 played on that interlocking confusion.
Perhaps most alarming, however, the NSA continued to use a classified annex to EO 123333 written by Michael Hayden the day he reauthorized the illegal wiretap program at least until recent years — and possibly still. And that classified annex asserts an authority to wiretap Americans on the Attorney General’s authorization for periods of up to 90 days, and wiretap “about” collection based solely on NSA Director authority.
Among the documents released to ACLU and EFF via FOIA was an undated “Core Intelligence Oversight Training” program that consists of nothing more than printouts of the authorities governing NSA activities (as I noted in this post, with one exception, the NSA training programs we’ve seen are unbelievably horrible from a training efficacy standpoint). It includes, in part, EO 12333, DOD 5240.1-R, and NSA/CSS Policy 1-23 (that is, several of the authorities NSA considers among its signature authorities). As part of a 2009 issuance of the latter document (starting on page 110), the training documents also include the classified annex to EO 12333 (starting on page 118). And although both documents are part of that 2009 issuance (which incorporated language reflecting the FISA Amendments Act), they are dated March 11, 2004 — the day after the hospital confrontation, when the Bush Administration continued its illegal wiretap program without DOJ sanction — and signed by then DIRNSA Michael Hayden.
That is, as part of the FOIA response to ACLU and EFF, DOJ revealed how it was secretly applying EO 12333 at least as recently as 2009.
And that secret application of EO 12333 includes two provisions that illustrate how the government was abusing EO 12333, even in the face of revisions to FISA. They include provisions permitting the wiretapping of Americans for 90-day periods based on AG certification, and the wiretapping of “about” communications for apparently unlimited periods based on DIRNSA certification. (see page 123)
Here’s the AG-certified 90-day provision.
(4) with specific prior approval by the Attorney General based on a finding by the Attorney General that there is probable cause to believe the United States person is an agent of a foreign power and that the purpose of the interception or selection is to collect significant foreign intelligence. Such approvals shall be limited to a period of time not to exceed ninety days for individuals and one year for entities.
The illegal wiretap program operated on 45-day authorizations from the AG. We don’t know from this what changes Hayden made the day after DOJ refused to reauthorize the program, but if Hayden changed it to 90 days, it effectively extended the previous authorization for another period.
And here’s the part of the “about” collection that is not redacted.
(b) Communications of, or concerning (1) [redacted] of a foreign power, or powers, as defined in Section 101 (a) (1) – (3) of FISA or (2) [redacted] may be intercepted intentionally, or selected deliberately (through the use of a selection term or otherwise), upon certification in writing by the Director, NSA to the Attorney General. Such certification shall take the form of the Certification Notice appended thereto. An information copy shall be forwarded to the Deputy Secretary of Defense. Collection may commence upon the Director, NSA’s certification. In addition, the Director, NSA shall advise the Attorney General and the Deputy Secretary of Defense on an annual basis of all such collection.
This “about” collection is ostensibly not targeted at US persons, but we know from the problems NSA confessed to in the 2011 702 upstream program that “about” collection ensnares a good deal of US person data — so much so NSA could not or would not count it when John Bates asked them to.
At least 5 years after the hospital confrontation and 2 years after Congress purportedly passed laws addressing the underlying issue, NSA’s own secret interpretation of how it implemented EO 12333 said it could continue to do the same domestic wiretapping, authorized by either the AG (for wiretapping targeting US persons for up to 90-day periods) or the DIRNSA (for wiretapping targeting communications “about” foreign powers).
The Bush Administration explicitly argued it was not bound by FISA — the law that should govern both these activities. Did the Obama Administration continue that policy?
October 20, 2014 update: As far as I can tell, Hayden’s version of the classified annex was identical to the annex as issued in 1988, released here (there are different redactions in the release). Given this language, it appears to reflect a reversion to the earlier policy, overriding Clinton-era changes.
This Policy 1-23 supersedes Directive 10-30, dated 20 September 1990, and Change One thereto, dated June 1998. The Associate Director for Policy endorsed an administrative update, effective 27 December 2007 to make minor adjustments to this policy. This 29 May 2009 administrative update includes changes due to the FISA Amendments Act of 2008 and in core training requirements.