A Radical Proposal of Following the Law

Mieke Eoyang, the Director of Third Way’s National Security Program, has what Ben Wittes bills as a “disruptive” idea: to make US law the exclusive means to conduct all surveillance involving US companies.

But reforming these programs doesn’t address another range of problems—those that relate to allegations of overseas collection from US companies without their cooperation.

Beyond 215 and FAA, media reports have suggested that there have been collection programs that occur outside of the companies’ knowledge. American technology companies have been outraged about media stories of US government intrusions onto their networks overseas, and the spoofing of their web pages or products, all unbeknownst to the companies. These stories suggest that the government is creating and sneaking through a back door to take the data. As one tech employee said to me, “the back door makes a mockery of the front door.”

As a result of these allegations, companies are moving to encrypt their data against their own government; they are limiting their cooperation with NSA; and they are pushing for reform.  Negative international reactions to media reports of certain kinds of intelligence collection abroad have resulted in a backlash against American technology companies, spurring data localization requirements, rejection or cancellation of American contracts, and raising the specter of major losses in the cloud computing industry. These allegations could dim one of the few bright spots in the American economic recovery: tech.

[snip]

How about making the FAA the exclusive means for conducting electronic surveillance when the information being collected is in the custody of an American company? This could clarify that the executive branch could not play authority shell-games and claim that Executive Order 12333 allows it to obtain information on overseas non-US person targets that is in the custody of American companies, unbeknownst to those companies.

As a policy matter, it seems to me that if the information to be acquired is in the custody of an American company, the intelligence community should ask for it, rather than take it without asking. American companies should be entitled to a higher degree of forthrightness from their government than foreign companies, even when they are acting overseas.

Now, I have nothing against this proposal. It seems necessary but wholly inadequate to restoring trust between the government and (some) Internet companies. Indeed, it represents what should have been the practice in any case.

Let me first take a detour and mention a few difficulties with this. First, while I suspect this might be workable for content collection, remember that the government was not just collecting content from Google and Yahoo overseas — they were also using their software to hack people. NSA is going to still want the authority to hack people using weaknesses in such software, such as it exists (and other software companies probably still are amenable to sharing those weaknesses).  That points to the necessity to start talking about a legal regime for hacking as much as anything else — one that parallels what is going on with the FBI domestically.

Also, this idea would not cover the metadata collection from telecoms which are domestically covered by Section 215, which will surely increasingly involve cloud data that more closely parallels the data provided by FAA providers but that would be treated as EO 12333 overseas (because thus far metadata is still treated under the Third Party doctrine here). This extends to the Google and Yahoo metadata taken off switches overseas. So, such a solution would be either limited or (if and when courts domestically embrace a mosaic theory approach to data, including for national security applications) temporary, because some of the most revealing data is being handed over willingly by telecoms overseas.

And before we institute this, we ought to know why the government was stealing overseas anyway. Was it to get around already broadly defined FISA Amendments Act certifications, including a Foreign Government one that can and apparently has been used for other purposes? Was it to collect on Americans who otherwise couldn’t be picked up via a legitimate target? I’ve been told the government was stealing algorithms, as much as content. That raises real questions about whether it is proper for the government to demand that kind of proprietary analysis done by Internet companies, one that would also need to be resolved in any such law.

Finally, one other problem with this is the criminal counterpart, the fact that DOJ is demanding Microsoft respond to domestic warrants for content stored in Ireland. What will restore other countries’ trust — and therefore the international viability of these companies — is sovereignty, which is something the government has been assiduously chipping away at even in the criminal context. Thus, while a lot of intelligence people poo poo the notion of sovereignty in spying, until you solve that on the overt stuff, you’re still going to be killing your tech base. So again, this only solves part of the problem, and even since the Snowden leaks started, DOJ seems intent only to double down.

Moreover, I don’t think this is the sphere in which the response to NSA’s theft overseas will play out, it will be the technological sphere, at least in the near term. What no one within the National Security establishment wants to admit is how badly NSA already shat the bed by stealing Google’s data overseas. Google is a worthy technical adversary to NSA (which is not to say it’s not a voracious spy in its own right, serving its own needs). And it will take a lot — far more than simply agreeing to what should have been the practice in any case — to get Google to not treat the government as an technical adversary, at least insofar as protecting its own networks generally. That’s as it should be, frankly. If NSA can steal from Google, so can, in the medium term, China.

Google, Apple, and Facebook have the heft and resources that a lot of the countries reacting to the NSA disclosures don’t have. They also have an urgent market need to respond, or at least create a credible illusion of responding. Few in DC seem to get that yet. That the proposed solutions to the damage NSA did to Google are so modest (effectively throwing table scraps to a wounded lion) is, in my mind, evidence that the NatSec world doesn’t yet grasp how badly NSA’s hubris has already hurt the Agency.

image_print
6 replies
  1. Anon says:

    That the proposed solutions to the damage NSA did to Google are so modest (effectively throwing table scraps to a wounded lion) is, in my mind, evidence that the NatSec world doesn’t yet grasp how badly NSA’s hubris has already hurt the Agency.

    Sadly this should not surprise anyone in the least. Insularity and self-delusion seem to be par for the course for DC. Consider that Obama announced an “end” to combad in Afghanistan 6 months ago and we now learn he has secretly authorized expanding combat operations. We are still operating against ISIL without legal authorization, and Eirc Holder is taking a victory lap on his “get tough on Wall St.” approach even as it becomes apparent that he has been helping to suppress evidence of fraud for the benefit of people like Goldman.

    How would they know how badly they’ve shat the bed since they listen to noone? And even if they were to know who cares, what consequences do they face?

  2. mzchief says:

    Tangential–

    There’s a canary in the digital coal mine!

    Has anybody noticed how Twitter is not only doing sophisticated association mapping and real time surveillance with the tool but also grooming off dissenters without big numbers of followers s.t. the reliance on Twitter is disconnecting communications– especially between blogs? Meanwhile, Ello simply blocks anonymous viewers so that makes it a closed system. Either we whip this problem by taking the glue of Twitter and replacing it with an encrypted, privacy-sensitive system run by a saavy tech cooperative or remove telephony from the overly centralized system the Internet now represents. Game over if Net Neutrality fails.

    • Anon says:

      Actually Net Neutrality applies to the network operators not the services. Even if broadband is classified as Title II Twitter would still be permitted to kick off anyone they want.

      • mzchief says:

        Great comment to unscore my implied point that basic communication services should be placed back in the public commons separate from the Internet and removed from the global privatization nightmare.

        • P J Evans says:

          Internet needs to be public commons, too. There are so many places and people who depend on it any more – most businesses would shut down without access, and they are mostly want net neutrality – how can you run a business with many locations, if you can’t depend on your connections?

  3. mzchief says:

    Hey, Marcy, you might have already seen these data points but I thought I’d drop them by:

    + “Global RFID Middleware Market 2014-2018” – http://dissenter.firedoglake.com/2014/11/17/undercover-supreme-court-police-deployed-outside-courthouse-to-spy-on-protests/#comment-77667

    + Interpol’s global fusion center in Singapore – http://dissenter.firedoglake.com/2014/11/17/undercover-supreme-court-police-deployed-outside-courthouse-to-spy-on-protests/#comment-77668

    + Vupen’s flight to Maryland, Luxembourg & Singapore – https://twitter.com/cryptoron/status/536652589509914625

Comments are closed.