Posts

The Dragnet Donald Trump Will Wield Is Not Just the Section 215 One

I’ve been eagerly anticipating the moment Rick Perlstein uses his historical work on Nixon to analyze Trump. Today, he doesn’t disappoint, calling Trump more paranoid than Nixon, warning of what Trump will do with the powerful surveillance machine laying ready for his use.

Revenge is a narcotic, and Trump of all people will be in need of a regular, ongoing fix. Ordering his people to abuse the surveillance state to harass and destroy his enemies will offer the quickest and most satisfying kick he can get. The tragedy, as James Madison could have told us, is that the good stuff is now lying around everywhere, just waiting for the next aspiring dictator to cop.

But along the way, Perlstein presents a bizarre picture of what happened to the Section 215 phone dragnet under Barack Obama.

That’s not to say that Obama hasn’t abused his powers: Just ask the journalists at the Associated Press whose phone records were subpoenaed by the Justice Department. But had he wanted to go further in spying on his enemies, there are few checks in place to stop him. In the very first ruling on the National Security Administration’s sweeping collection of “bulk metadata,” federal judge Richard Leon blasted the surveillance as downright Orwellian. “I cannot imagine a more ‘indiscriminate’ and ‘arbitrary’ invasion than this collection and retention of personal data,” he ruled. “Surely, such a program infringes on ‘that degree of privacy’ that the founders enshrined in the Fourth Amendment.”

But the judge’s outrage did nothing to stop the surveillance: In 2015, an appeals court remanded the case back to district court, and the NSA’s massive surveillance apparatus—soon to be under the command of President Trump—remains fully operational. The potential of the system, as former NSA official William Binney has described it, is nothing short of “turnkey totalitarianism.”

There are several things wrong with this.

First, neither Richard Leon nor any other judge has reviewed the NSA’s “sweeping collection of ‘bulk metadata.'” What Leon reviewed — in Larry Klayman’s lawsuit challenging the collection of phone metadata authorized by Section 215 revealed by Edward Snowden — was just a small fraction of NSA’s dragnet. In 2013, the collection of phone metadata authorized by Section 215 collected domestic and international phone records from domestic producers, but even there, Verizon had found a way to exclude collection of its cell records.

But NSA collected phone records — indeed, many of the very same phone records, as they collected a great deal of international records — overseas as well. In addition, NSA collected a great deal of Internet metadata records, as well as financial and anything else records. Basically, anything the NSA can collect “overseas” (which is interpreted liberally) it does, and because of the way modern communications works, those records include a significant portion of the metadata of Americans’ everyday communications.

It is important for people to understand that the focus on Section 215 was an artificial creation, a limited hangout, an absolutely brilliant strategy (well done, Bob Litt, who has now moved off to retirement) to get activists to focus on one small part of the dragnet that had limitations anyway and NSA had already considered amending. It succeeded in pre-empting a discussion of just what the full dragnet entailed.

Assessments of whether Edward Snowden is a traitor or a saint always miss this, when they say they’d be happy if Snowden had just exposed the Section 215 program. Snowden didn’t want the focus to be on just that little corner of the dragnet. He wanted to expose the full dragnet, but Litt and others succeeded in pretending the Section 215 dragnet was the dragnet, and also pretending that Snowden’s other disclosures weren’t just as intrusive on Americans.

Anyway, another place where Perlstein is wrong is in suggesting there was just one Appeals Court decision. The far more important one is the authorized by Gerard Lynch in the Second Circuit, which ruled that Section 215 was not lawfully authorized. It was a far more modest decision, as it did not reach constitutional questions. But Lynch better understood that the principle involved more than phone records; what really scared him was the mixing of financial records with phone records, which is actually what the dragnet really is.

That ruling, on top of better understanding the import of dragnets, is important because it is one of the things that led to the passage of USA Freedom Act, a law that, contrary to Perlstein’s claim, did change the phone dragnet, both for good and ill.

The USA Freedom Act, by imposing limitations on how broadly dragnet orders (for communications but not for financial and other dragnets) can be targeted, adds a check at the beginning of the process. It means only people 2 degrees away from a terrorism suspect will be collected under this program (even while the NSA continues to collect in bulk under EO 12333). So the government will have in its possession far fewer phone records collected under Section 215 (but it will still suck in massive amounts of phone records via EO 12333, including massive amounts of Americans’ records).

All that said, Section 215 now draws from a larger collection of records. It now includes the Verizon cell records not included under the old Section 215 dragnet, as well as some universe of metadata records deemed to be fair game under a loose definition of “phone company.” At a minimum, it probably includes iMessage, WhatsApp, and Skype metadata, but I would bet the government is trying to get Signal and other messaging metadata (note, Signal metadata cannot be collected retroactively; it’s unclear whether it can be collected with standing daily prospective orders). This means the Section 215 collection will be more effective in finding all the people who are 2 degrees from a target (because it will include any communications that exist solely in Verizon cell or iMessage networks, as well as whatever other metadata they’re collecting). But it also means far more innocent people will be impacted.

To understand why that’s important, it’s important to understand what purpose all this metadata collection serves.

It was never the case that the collection of metadata, however intrusive, was the end goal of the process. Sure, identifying someone’s communications shows when you’ve been to an abortion clinic or when you’re conducting an affair.

But the dragnet (the one that includes limited Section 215 collection and EO 12333 collection limited only by technology, not law) actually serves two other primary purposes.

The first is to enable the creation of dossiers with the click of a few keys. Because the NSA is sitting on so much metadata — not just phone records, but Internet, financial, travel, location, and other data — it can put together a snapshot of your life as soon as they begin to correlate all the identifiers that make up your identity. One advantage of the new kind of collection under USAF, I suspect, is it will draw from the more certain correlations you give to your communications providers, rather than relying more heavily on algorithmic analysis of bulk data. Facebook knows with certainty what email address and phone number tie to your Facebook account, whereas the NSA’s algorithms only guess that with (this is an educated guess) ~95+% accuracy.

This creation of dossiers is the same kind of analysis Facebook does, but instead of selling you plane tickets the goal is government scrutiny of your life.

The Section 215 orders long included explicit permission to subject identifiers found via 2-degree collection to all the analytical tools of the NSA. That means, for any person — complicit or innocent — identified via Section 215, the NSA can start to glue together the pieces of dossier it already has in its possession. While not an exact analogue, you might think of collection under Section 215 as a nomination to be on the equivalent of J Edgar Hoover’s old subversives list. Only, poor J Edgar mostly kept his list on index cards. Now, the list of those the government wants to have a network analysis and dossier on is kept in massive server farms and compiled using supercomputers.

Note, the Section 215 collection is still limited to terrorism suspects — that was an important win in the USA Freedom fight — but the EO 12333 collection, with whatever limits on nominating US persons, is not. Plus, it will be trivial for Trump to expand the definition of terrorist; the groundwork is already being laid to do so with Black Lives Matter.

The other purpose of the dragnet is to identify which content the NSA will invest the time and energy into reading. Most content collected is not read in real time. But Americans’ communications with a terrorism suspect will probably be, because of the concern that those Americans might be plotting a domestic plot. The same is almost certainly true of, say, Chinese-Americans conversing with scientists in China, because of a concern they might be trading US secrets. Likewise it is almost certainly true of Iranian-Americans talking with government officials, because of a concern they might be dealing in nuclear dual use items. The choice to prioritize Americans makes sense from a national security perspective, but it also means certain kinds of people — Muslim immigrants, Chinese-Americans, Iranian-Americans — will be far more likely to have their communications read without a warrant than whitebread America, even if those whitebread Americans have ties to (say) NeoNazi groups.

Of course, none of this undermines Perlstein’s ultimate categorization, as voiced by Bill Binney, who created this system only to see the privacy protections he believed necessary get wiped away: the dragnet — both that authorized by USAF and that governed by EO 12333 — creates the structure for turnkey totalitarianism, especially as more and more data becomes available to NSA under EO 12333 collection rules.

But it is important to understand Obama’s history with this dragnet. Because while Obama did tweak the dragnet, two facts about it remain. First, while there are more protections built in on the domestic collection authorized by Section 215, that came with an expansion of the universe of people that will be affected by it, which must have the effect of “nominating” more people to be on this late day “Subversives” list.

Obama also, in PPD-28, “limited” bulk collection to a series of purposes. That sounds nice, but the purposes are so broad, they would permit bulk collection in any area of the world, and once you’ve collected in bulk, it is trivial to then call up that data under a more broad foreign intelligence purpose. In any case, Trump will almost certainly disavow PPD-28.

Which makes Perlstein’s larger point all the more sobering. J Edgar and Richard Nixon were out of control. But the dragnet Trump will inherit is far more powerful.

The Second Circuit Attempts to Reassert Its Non-Definition of Relevant

Orin Kerr and Steve Vladeck got in a bit of a squabble last week over the Second Circuit’s decision not to reach the constitutionality of the phone dragnet. Vladeck called it wrong-headed, because even if the constitutional injury of the dragnet is temporary (that is, only until November 29), it’s the kind of injury that can recur. Kerr reads both this — and the Second Circuit’s original opinion — to be nothing more than a pragmatic nudge to Congress. “If you liked that opinion, it’s a little hard to object to the Second Circuit’s pragmatic, politically savvy, we-got-Congress-to-act-on-this-so-we’re-done moves in the second opinion.”

But I think both are misreading what the Second Circuit tried to do with this.

Take Kerr’s suggestion that the initial ruling from the Second Circuit got Congress to act.  He doesn’t say what he means by that (or which civil libertarians he had in mind when asserting that). The earlier decision certainly added pressure to get the bill through Congress.

But look at how Gerard Lynch, in his opinion, describes the relationship: Congress not just passed a bill to prohibit bulk telephone collection, but it “endorsed our understanding of the key term ‘relevance.'”

Congress passed the Freedom Act in part to prohibit bulk telephone metadata collection, and in doing so endorsed our understanding of the key term “relevance.”  See H.R. Rep. No. 114‐109, at 19.

Lynch goes on to cite the House report on the bill to support this claim.

Section 103 of the Freedom Act, titled “Prohibition on Bulk Collection of Tangible Things,” states that “[n]o order issued under this subsection may authorize the collection of tangible things without the use of a specific selection term” that meets certain requirements.  Id.  The purpose of § 103 is to “make[] clear that the government may not engage in indiscriminate bulk collection of any tangible thing or any type of record.”  H.R. Rep. No. 114‐109, pt. 1, at 18 (2015).  Section 103 is also intended to “restore meaningful limits to the ‘relevance’ requirement of Section 501, consistent with the opinion of the U.S. Court of Appeals for the Second Circuit in ACLU v. Clapper.”  Id. at 19.

He cites language point to an entire section that the House says will restore limits to the relevance requirement of a section of a law “consistent” with his own earlier opinion.

All that said, it’s not clear that USA F-ReDux, as written, does do that. That’s true, first of all, because while the House report specifically states, “Congress’ decision to leave in place the ‘relevance’ standard for Section 501 orders should not be construed as Congress’ intent to ratify the FISA Court’s interpretation of that term” (Lynch cites this language in his opinion), it also doesn’t state that Congress intended to override that definition. What the bill did instead was leave the word “relevant” (still potentially meaning “all” as FISC defined it) in place, but place additional limits for its application under FISA.

Moreover, I’m not convinced the limits as written in USA F-ReDux accomplish all that the Second Circuit’s earlier opinion envisioned, which is perhaps best described in the ways the dragnets didn’t resemble warrants or subpoenas.

Moreover, the distinction is not merely one of quantity – however vast the quantitative difference – but also of quality.  Search warrants and document subpoenas typically seek the records of a particular individual or corporation under investigation, and cover particular time periods when the events under investigation occurred.  The orders at issue here contain no such limits.  The metadata concerning every telephone call made or received in the United States using the services of the recipient service provider are demanded, for an indefinite period extending into the future.  The records demanded are not those of suspects under investigation, or of people or businesses that have contact with such subjects, or of people or businesses that have contact with others who are in contact with the subjects – they extend to every record that exists, and indeed to records that do not yet exist, as they impose a continuing obligation on the recipient of the subpoena to provide such records on an ongoing basis as they are created.

Even setting aside my concern that USA F-ReDux only explicitly prohibits the use of communications company names like Verizon and AT&T as a specific selection term — thus leaving open the possibility FISC will continue to let the government use financial company names as specific selection terms — USA F-ReDux certainly envisions the government imposing “a continuing obligation on the recipient of the subpoena to provide such records on an ongoing basis.” It also permits the collection of records that “are not those of suspects under investigation.”

In other words, Lynch used this second opinion to do more than say the Second Circuit was “done with it.” He used it to interpret USA F-ReDux — and the word “relevant” generally, outside of FISA, and to do so in ways that go beyond the clear language of the bill.

Vladeck is wrong when he suggested the Second Circuit would assess “whether and to what extent the Fourth Amendment applies to information we voluntarily provide to third parties” — that is, the Third Party Doctrine generally. The Second Circuit made it quite clear throughout that they were interested in the application of “relevant,” not whether the Third Party Doctrine still applied generally, which is probably why Lynch isn’t that worried about the injury recurring.

And I think Lynch used this opinion — one the government can’t really appeal — to suggest the application of USA F-ReDux is broader than it necessarily is, and to suggest the narrowing of “relevant to” is more general than it would be under USA F-ReDux (which applies just to certain sections of FISA, but not to the definition of “relevant” generally).

It’s not clear how useful the opinion will be in restricting other over-broad uses of the word “relevant” (especially given DEA claims it has eliminated its dragnet). But I do suspect, having interpreted the law as having narrowed the meaning of the law, Lynch felt like he had limited the egregious constitutional injury.

The Awkward Timing of the 2nd Circuit Denial of ACLU’s Request for a Phone Dragnet Injunction

The 2nd circuit just denied the ACLU’s request for an injunction in the phone dragnet, finding that Congress intended to let the dragnet continue for 6 months after passage of USA F-ReDux.

That’s not all that surprising, but it also means the 2nd circuit is dodging constitutional issues for now (in part by claiming Congress had adopted their reasoning on the meaning of “relevant to,” which it did not; I will return to this).

But the court remanded the case on one main issue: what happens on November 29, when the 6 month transition period ends.

Appellants and the government disagree, however, regarding the mootness of the final relief requested after November 29: an injunction that would require the government to end the telephone metadata program and purge records collected unlawfully.  Appellants argue that the government intends to retain the records “indefinitely,” and are under no outside obligation to purge them, and thus that their claims for relief will not become moot on November 29.  The government argues that the claims will be moot on November 29, because the telephone metadata program will cease at that time, and an order enjoining the telephone metadata program will have no effect.

Further, the government notes that the Office of the Director of National Intelligence has announced that the government will not use § 215 data for law enforcement or investigatory purposes after November 29.  See Statement by the ODNI on Retention of Data Collected Under Section 215 of the USA PATRIOT Act (July 27, 2015).  Additionally, the government states that it will destroy all records as soon as possible after the government’s litigation‐preservation obligations end, id., and thus Appellants’ requests that their information no longer be queried and that their records be purged will also be moot.

[snip]

We do not address whether Appellants’ claims will become moot on November 29, and leave this, and all other remaining questions, to the district court in the first instance.

While I don’t expect much to come of this question either, it is rather awkward that the court has chosen to remand that decision today, of all days.

As it is, the 2nd circuit misses one development in this case, which is that after declaring on July 27 that they were going to keep the data but not use it for law enforcement purposes, the FISC then refused the government’s request to just rubber stamp that decision. So the question of what will happen with the data is still being review at the FISC.

Not only that, but today is also the deadline Michael Mosman set for FISC-appointed amicus Preston Burton to submit his first brief on this question.

So Burton will submit something — there’s no reason to think we’ll get to see all of his brief — without the benefit of knowing that ACLU may still contest whatever he argues for regarding the use of the data past November 29. And of course, one reason the government may need to keep that data past November 29 is because EFF has a protection order that requires they keep it for their lawsuit(s).

That still doesn’t mean anything all that interesting will come of this, but we do have two courts addressing the same question at the same time, without full notice of the other.

DOJ Doesn’t Care What the Text of the Law or the 2nd Circuit Says, Dragnet Edition

Since USA F-ReDux passed JustSecurity has published two posts about how the lapse of Section 215 might create problems for the dragnet. Megan Graham argued that technically USA F-ReDux would have amended Section 215 as it existed in 2001, meaning the government couldn’t obtain any records but those that were specifically authorized before the PATRIOT Act passed. And former SSCI staffer Michael Davidson argued that a technical fix would address any uncertainty on this point.

DOJ, however, doesn’t much give a shit about what USA F-ReDux actually amends. In its memorandum of law accompanying a request to restart the dragnet submitted the night USA F-ReDux passed, DOJ asserted that of course Section 215 as it existed on May 31 remains in place.

Its brief lapse notwithstanding, the USA FREEDOM Act also expressly extends the sunset of Section 215 of the USA PATRIOT Act, as amended, until December 15, 2019, id.§ 705(a), and provides that, until the effective date of the amendments made by Sections 101through103, it does not alter or eliminate the Government’s authority to obtain an order under Section 1861 as in effect prior to the effective date of Sections 101through103 of the USA FREEDOM Act. Id.§ 109(b). Because the USA FREEDOM Act extends the sunset for Section 215 and delays the ban on bulk production under Section 1861until180 days from its enactment, the Government respectfully submits that it may seek and this Court may issue an order for the bulk production of tangible things under Section 1861 as amended by Section 215 of the USA PATRIOT Act as it did in docket number BR 15-24 and prior related dockets.

It cites comments Pat Leahy and Chuck Grassley made on May 22 (without, curiously, quoting either Rand Paul or legislative record from after Mitch McConnell caused the dragnet to lapse) showing that the intent of the bill was to extend the current dragnet.

While I think most members of Congress would prefer DOJ’s argument to hold sway, I would expect a more robust argument from DOJ on this point.

Likewise their dismissal of the Second Circuit decision in ACLU v. Clapper (which they say they’re still considering appealing). While it notes the Second Circuit did not immediately issue an injunction, DOJ’s base argument is weaker: it likes FISC’s ruling better and so it thinks FISC’s District Court judges should consider but ultimately ignore what the Second Circuit said.

The Government believes that this Court’s analysis of Section 215 reflects the better interpretation of the statute, see, e.g., In Re Application of the FBI for an Order Requiring the Production of Tangible Things, docket no. BR 13-109, Amended Mem. Op., 2013 WL 5741573 (FISA Ct. Aug. 29, 2013) (Eagan, J.) and In Re Application of the FBI for an Order Requiring the Production of Tangible Things, docket no. BR 13-158, Mem. (FISA Ct. Oct. 11, 2013) (McLaughlin, J.), disagrees with the Second Circuit panel’s opinion, and submits that the request for renewal of the bulk production authority is authorized under the statute as noted above.

[snip]

The Government submits that this Court’s analysis continues to reflect the better reading of Section 1861.

This is where, incidentally, the flaccid report language attached to USA F-ReDux is so problematic. In a filing affirming the importance of legislative language, had the HJC report said something more than “Congress’ decision to leave in place the ‘‘relevance’’ standard for Section 501 orders should not be construed as Congress’ intent to ratify the FISA Court’s interpretation of that term,” DOJ might have to take notice of the language. But as it is, without affirmatively rejecting FISC’s opinion, the government will pretend it doesn’t matter.

I’m no more surprised with DOJ’s argument about the Second Circuit decision than I am its insistence that lapsing a bill doesn’t have legal ramifications.

But I would expect both arguments to make some effort to appear a bit less insolent. I guess DOJ is beyond that now.

The Section 215 Rap Sheet

Marco Rubio, who is running for President as an authoritarian, claims that “There is not a single documented case of abuse of this program.”

He’s not alone. One after another defender of the dragnet make such claims. FBI witnesses who were asked specifically about abuses in 2011 claimed FBI did not know of any abuses (even though FBI Director Robert Mueller had had to justify FBI’s use of the program to get it turned back on after abuses discovered in 2009).

Comment — Russ Feingold said that Section 215 authorities have been abused. How does the FBI respond to that accusation?

A — To the FBI’s knowledge, those authorities have not been abused.

Though Section 215 boosters tend to get sort of squishy on their vocabulary, changing language about whether this was illegal, unconstitutional, or abusive.

Here’s what we actually know about the abuses, illegality, and unconstitutionality of Section 215, both the phone dragnet program and Section 215 more generally.

Judges

First, here’s what judges have said about the program:

1) The phone dragnet has been reapproved around 41 times by at least 17 different FISC judges

The government points to this detail as justification for the program. It’s worth noting, however, that FISC didn’t get around to writing an opinion assessing the program legally until 10 judges and 34 orders in.  Since Snowden exposed the program, the FISC appears to have made a concerted effort to have new judges sign off on each new opinion.

2) Three Article III courts have upheld the program:

Judges William Pauley and Lynn Winmill upheld the constitutionality of the program (but did not asses the legality of it); though Pauley was reversed on statutory, not constitutional grounds. Judge Jeffrey Miller upheld the use of Section 215 evidence against Basaaly Moalin on constitutional grounds.

3) One Article III court — Judge Richard Leon in Klayman v. Obama — found the program unconstitutional.

4) The Second Circuit (along with PCLOB, including retired Circuit Court judge Patricia Wald, though they’re not a court), found the program not authorized by statute.

The latter decision, of course, is thus far the binding one. And the 2nd Circuit has suggested that if it has to consider the program on constitution grounds, it might well find it unconstitutional as well.

Statutory abuses

1) As DOJ’s IG confirmed yesterday, for most of the life of the phone dragnet (September 2006 through November 2013), the FBI flouted a mandate imposed by Congress in 2006 to adopt Section 215-specific minimization procedures that would give Americans additional protections under the provision (note–this affects all Section 215 programs, not just the phone dragnet). While, after a few years, FISC started imposing its own minimization procedures and reporting requirements (and rejected proposed minimization procedures in 2010), it nevertheless kept approving Section 215 orders.

In other words, in addition to being illegal (per the 2nd Circuit), the program also violated this part of the law for 7 years.

2) Along with all the violations of minimization procedures imposed by FISC discovered in 2009, the NSA admitted that it had been tracking roughly 3,000 presumed US persons against data collected under Section 215 without first certifying that they weren’t targeted on the basis of First Amendment protected activities, as required by the statute.

Between 24 May 2006 and 2 February 2009, NSA Homeland Mission Coordinators (HMCs) or their predecessors concluded that approximately 3,000 domestic telephone identifiers reported to Intelligence Community agencies satisfied the RAS standard and could be used as seed identifiers. However, at the time these domestic telephone identifiers were designated as RAS-approved, NSA’s OGC had not reviewed and approved their use as “seeds” as required by the Court’s Orders. NSA remedied this compliance incident by re-designating all such telephone identifiers as non RAS-approved for use as seed identifiers in early February 2009. NSA verified that although some of the 3,000 domestic identifiers generated alerts as a result of the Telephony Activity Detection Process discussed above, none of those alerts resulted in reports to Intelligence Community agencies.

NSA did not fix this problem by reviewing the basis for their targeting; instead, it simply moved these US person identifiers back onto the EO 12333 only list.

While we don’t have the background explanation, in the last year, FISC reiterated that the government must give First Amendment review before targeting people under Emergency Provisions. If so, that would reflect the second time where close FISC review led the government to admit it wasn’t doing proper First Amendment reviews, which may reflect a more systematic problem. That would not be surprising, since the government has already been chipping away at that First Amendment review via specific orders.

Minimization procedure abuses

1) The best known abuses of minimization procedures imposed by the FISC were disclosed to the FISC in 2009. The main item disclosed involved the fact that NSA had been abusing the term “archive” to create a pre-archive search against identifiers not approved for search. While NSA claimed this problem arose because no one person knew what the requirements were, in point of fact, NSA’s Inspector General warned that this alert function should be disclosed to FISC, and it was a function from the Stellar Wind program that NSA simply did not turn off when FISC set new requirements when it rubber-stamped the program.

But there were a slew of other violations of FISC-imposed minimization procedures disclosed at that time, almost all arising because NSA treated 215 data just like it treats EO 12333, in spite of FISC’s clear requirements that such data be treated with additional protections. That includes making query results available to CIA and FBI, the use of automatic search functions, and including querying on any “correlated” identifiers. These violations, in sum, are very instructive for the USA F-ReDux debate because NSA has never managed to turn these automated processes back on since, and one thing they presumably hope to gain out of moving data to the providers is to better automate the process.

2) A potentially far more egregious abuse of minimization procedures was discovered (and disclosed) in 2012, when NSA discovered that raw data NSA’s techs were using over 3,000 files of phone dragnet data on their technical server past the destruction date.

As of 16 February 2012, NSA determined that approximately 3,032 files containing call detail records potentially collected pursuant to prior BR Orders were retained on a server and been collected more than five years ago in violation of the 5-year retention period established for BR collection. Specifically, these files were retained on a server used by technical personnel working with the Business Records metadata to maintain documentation of provider feed data formats and performed background analysis to document why certain contact chaining rules were created. In addition to the BR work, this server also contains information related to the STELLARWIND program and files which do not appear to be related to either of these programs. NSA bases its determination that these files may be in violation of BR 11-191 because of the type of information contained in the files (i.e., call detail records), the access to the server by technical personnel who worked with the BR metadata, and the listed “creation date” for the files. It is possible that these files contain STELLARWIND data, despite the creation date. The STELLARWIND data could have been copied to this server, and that process could have changed the creation date to a timeframe that appears to indicate that they may contain BR metadata.

But rather than investigate this violation — rather than clarify how much data this entailed, whether it had been mingled with Stellar Wind data, whether any other violations had occurred — NSA destroyed the data.

In one incident, NSA technical personnel discovered a technical server with nearly 3,000 files containing call detail records that were more than five years old, but that had not been destroyed in accordance with the applicable retention rules. These files were among those used in connection with a migration of call detail records to a new system. Because a single file may contain more than one call detail record, and because the files were promptly destroyed by agency technical personnel, the NSA could not provide an estimate regarding the volume of calling records that were retained beyond the five-year limit. The technical server in question was not available to intelligence analysts.

From everything we’ve seen the tech and research functions are not audited, not even when they’re playing with raw data (which is, I guess, why SysAdmin Edward Snowden could walk away with so many records). So not only does this violation show that tech access to raw data falls outside of the compliance mechanisms laid out in minimization procedures (in part, with explicit permission), but that NSA doesn’t try very hard to track down very significant violations that happen.

Overall sloppiness

Finally, while sloppiness on applications is not a legal violation, it does raise concerns about production under the statute. The IG Report reviewed just six case files which used Section 215 orders. Although the section is heavily redacted, there are reasons to be significantly concerned about four of those.

  • An application made using expedited approval that made a material misstatement about where FBI obtained a tip about the content of a phone call. The FBI agent involved “is no longer with the FBI.” The target was prosecuted for unlawful disclosure of nuke information, but the Section 215 evidence was not introduced into trial and therefore he did not have an opportunity to challenge any illegal investigative methods.
  • A 2009 application involving significant minimization concerns and for which FBI rolled out a “investigative value” exception for access limits on Section 215 databases. This also may involve FBI’s secret definition of US person, which I suspect pertains to treating IP addresses as non-US persons until they know it is a US person (this is akin to what they do under 702 MPs). DOJ’s minimization report to FISC included inaccuracies not fixed until June 13, 2013.
  • A 2009 application for a preliminary investigation that obtained medical and education records from the target’s employer. FBI ultimately determined the target “had no nexus to terrorism,” though it appears FBI kept all information on the target (meaning he will have records at FBI for 30 years). The FBI’s minimization report included an error not fixed until June 13, 2013, after the IG pointed it out.
  • A cyber-investigation for which the case agent could not locate the original production, which he claims was never placed in the case file.

And that’s just what can be discerned from the unredacted bits.

Remember, too: the inaccuracies (as opposed to the material misstatement) were on minimization procedures. Which suggests FBI was either deceitful — or inattentive — to how it was complying with FISC-mandated minimization procedures designed to protect innocent Americans’ privacy.

And remember — all this is just Section 215. The legal violations under PRTT were far more egregious, and there are other known violations and misstatements to FISC on other programs.

This is a troubling program, one that several judges have found either unconstitutional or illegal.

 

2nd Circuit Decision Striking Down Dragnet Should Require Tighter “Specific Selection Term” Language in USA F-ReDux

When I wrote up the hearing in ACLU v. Clapper back in September, I noted that Judge Gerard Lynch got the problem with the definition of “relevant to” FISC had rubber stamped in secret. There’s nothing distinct about phone records. So if the government can hoover up all of those, then it can collect everything.

… You can collect everything there is to know about everybody and have it all in one big government cloud.

[snip]

I just don’t understand an argument as to what’s so special about telephone records that makes them so valuable, so uniquely interactive or whatever, that the same arguments you’re making don’t apply to every record in the hands of a third party business entity of every American’s everything.

Lynch made a very similar, albeit extended, observation in his opinion ruling the dragnet violated the Section 215 statute.

The interpretation urged by the government would require a drastic expansion of the term “relevance,” not only with respect to § 215, but also as that term is construed for purposes of subpoenas, and of a number of national security‐related statutes, to sweep further than those statutes have ever been thought to reach. For example, the same language is used in 18 U.S.C. § 2709(b)(1) and 20 U.S.C. § 1232g(j)(1)(A), which authorize, respectively, the compelled production of telephone toll‐billing and educational records relevant to authorized investigations related to terrorism. There is no evidence that Congress intended for those statutes to authorize the bulk collection of every American’s toll‐billing or educational records and to aggregate them into a database — yet it used nearly identical language in drafting them to that used in § 215. The interpretation that the government asks us to adopt defies any limiting principle. The same rationale that it proffers for the “relevance” of telephone metadata cannot be cabined to such data, and applies equally well to other sets of records. If the government is correct, it could use § 215 to collect and store in bulk any other existing metadata available anywhere in the private sector, including metadata associated with financial records, medical records, and electronic communications (including e‐mail and social media information) relating to all Americans.

Such expansive development of government repositories of formerly private records would be an unprecedented contraction of the privacy expectations of all Americans. Perhaps such a contraction is required by national security needs in the face of the dangers of contemporary domestic and international terrorism. But we would expect such a momentous decision to be preceded by substantial debate, and expressed in unmistakable language.

This is important because the “relevant to” language not only does show up elsewhere (as Lynch notes) but has been used elsewhere to conduct dragnets (as with the DEA’s dragnet).

It’s also the most important part of the opinion for the ongoing debate about USA F-ReDux. That’s because USA F-ReDux does not actually change that “relevant to” definition. And as I have argued (though bill boosters dispute this), because the bill only prohibits the use of communications corporate person names as specific selection terms, but not other kinds of corporations, the bill doesn’t actually prohibit bulk collection of non-communication tangible things.

In an ideal world, the decision would give reformers the opportunity to tighten up that part of the SST and provide a bit more guidance about what a suitably narrow SST constitutes. That’s probably not going to happen, but it should.

2nd Circuit Rules Phone Dragnet Exceeds Section 215

Here’s the opinion. This will be a working thread.

(27) LOL! I love this line, which was surely written for Sam Alito.

Appellants here need not speculate that the government has collected, or may in the future collect, their call records.

(28) And they directly address Amnesty v. Clapper on the next page.

Amnesty International does not hold otherwise.  There, the Supreme Court, reversing our decision, held that respondents had not established standing because they could not show that the government was surveilling them, or thatsuch surveillance was “certainly impending.”  131 S. Ct. at 1148‐1150.  Instead, the Supreme Court stated that respondents’ standing arguments were based on a “speculative chain of possibilities” that required that:  respondents’ foreign contacts be targeted for surveillance; the surveillance be conducted pursuant to the statute challenged, rather than under some other authority; the FISC approve the surveillance; the government actually intercept the communications of the foreign contacts; and among those intercepted communications be those involving respondents.  Id.  Because respondents’ injury relied on that chain of events actually transpiring, the Court held that the alleged injury was not “fairly traceable” to the statute being challenged.  Id. at 1150.  As to costs incurred by respondents to avoid surveillance, the Court characterized those costs as “a product of their fear of surveillance” insufficient to confer standing.  Id. at 1152.

Here, appellants’ alleged injury requires no speculation whatsoever as to how events will unfold under § 215 – appellants’ records (among those of numerous others) have been targeted for seizure by the government; the government has used the challenged statute to effect that seizure; the orders have been approved by the FISC; and the records have been collected.  Amnesty International’s “speculative chain of possibilities” is, in this context, a reality.That case in no way suggested that such data would need to be reviewed or analyzed in order for respondents to suffer injury.

(38) Really interesting argument about whether secrecy can preclude standing.

These secrecy measures, the government argues, are evidence that Congress did not intend that § 215 orders be reviewable in federal court upon suit by an individual whose metadata are collected.

Upon closer analysis, however, that argument fails.  The government has pointed to no affirmative evidence, whether “clear and convincing” or “fairly discernible,” that suggests that Congress intended to preclude judicial review. Indeed, the government’s argument from secrecy suggests that Congress did not contemplate a situation in which targets of § 215 orders would become aware of those orders on anything resembling the scale that they now have.  That revelation, of course, came to pass only because of an unprecedented leak of classified information.  That Congress may not have anticipated that individuals like appellants, whose communications were targeted by § 215 orders, would become aware of the orders, and thus be in a position to seek judicial review, is not evidence that Congress affirmatively decided to revoke the right to judicial review otherwise provided by the APA in the event the orders were publicly revealed.

The government’s argument also ignores the fact that, in certain (albeit limited) instances, the statute does indeed contemplate disclosure.  If a judge finds that “there is no reason to believe that disclosure may endanger the national security of the United States, interfere with a criminal, counterterrorism, or counterintelligence investigation, interfere with diplomatic relations, or endanger the life or physical safety of any person,” he may grant a petition to modify or set aside a nondisclosure order.  50 U.S.C. § 1861(f)(2)(C)(i).  Such a petition could presumably only be brought by a § 215 order recipient, because only the recipient, not the target, would know of the order before such disclosure. But this provision indicates that Congress did not expect that all § 215 orders would remain secret indefinitely and that, by providing for such secrecy, Congress did not intend to preclude targets of § 215 orders, should they happen to learn of them, from bringing suit

(42) Court argues that because telecoms get immunity their interests are not coincident with their customers’.

As appellants point out, telecommunications companies have little incentive to challenge § 215 orders – first, because they are unlikely to want to antagonize the government, and second, because the statute shields them from any liability arising from their compliance with a § 215 order.  See 50 U.S.C. § 1861(e).  Any interests that they do have are distinct from those of their customers.  The telephone service providers’ primary interest would be the expense or burden of complying with the orders; only the customers have a direct interest in the privacy of information revealed in their telephone records.

(47) Court rebuts govt worry that millions of people would challenge this by pointing out that that’s only because millions of people had been collected on.

That argument, however, depends on the government’s argument on the merits that bulk metadata collection was contemplated by Congress and authorized by § 215.  The risk of massive numbers of lawsuits challenging the same orders, and thus risking inconsistent outcomes and confusion about the legality of the program, occurs only in connection with the existence of orders authorizing the collection of data from millions of people.

(48) Some of this is LOL funny.

While constitutional avoidance is a judicial doctrine, the principle should have considerable appeal to Congress:  it would seem odd that Congress would preclude challenges to executive actions that allegedly violate Congress’s own commands, and thereby channel the complaints of those aggrieved by such actions into constitutional challenges that threaten Congress’s own authority.  There may be arguments in favor of such an unlikely scheme, but it cannot be said that any such reasons are so patent and indisputable that Congress can be assumed, in the face of the strong presumption in favor of APA review, to have adopted them without having said a word about them.

(52) Court’s final kick at the claim that Congress has prohibited review.

In short, the government relies on bits and shards of inapplicable statutes, inconclusive legislative history, and inferences from silence in an effort to find an implied revocation of the APA’s authorization of challenges to government actions.  That is not enough to overcome the strong presumption of the general command of the APA against such implied preclusion.  Congress, of course, has the ability to limit the remedies available under the APA; it has only to say so. But it has said no such thing here.  We should be cautious in inferring legislative action from legislative inaction, or inferring a Congressional command from Congressional silence.  At most, the evidence cited by the government suggests that Congress assumed, in light of the expectation of secrecy, that persons whose information was targeted by a § 215 order would rarely even know of such orders, and therefore that judicial review at the behest of such persons was a non‐ issue.  But such an assumption is a far cry from an unexpressed intention to withdraw rights granted in a generally applicable, explicit statute such as the APA.

(59) This is the key passage.

Thus, the government takes the position that the metadata collected – a vast amount of which does not contain directly “relevant” information, as the government concedes – are nevertheless “relevant” because they may allow the NSA, at some unknown time in the future, utilizing its ability to sift through the trove of irrelevant data it has collected up to that point, to identify information that is relevant.5 We agree with appellants that such an expansive concept of “relevance” is unprecedented and unwarranted.

The statutes to which the government points have never been interpreted to authorize anything approaching the breadth of the sweeping surveillance at issue here.6   The government admitted below that the case law in analogous contexts “d[id] not involve data acquisition on the scale of the telephony metadata collection.”  ACLU v. Clapper, No. 13 Civ. 3994 (S.D.N.Y. Aug. 26, 2013), ECF No. 33 (Mem. of Law of Defs. in Supp. of Mot. to Dismiss) at 24.  That concession is well taken.  As noted above, if the orders challenged by appellants do not require the collection of metadata regarding every telephone call made or received in the United States (a point asserted by appellants and at least nominally contested by the government), they appear to come very close to doing so.  The sheer volume of information sought is staggering; while search warrants and subpoenas for business records may encompass large volumes of paper documents or electronic data, the most expansive of such evidentiary demands are dwarfed by the volume of records obtained pursuant to the orders in question here.

Moreover, the distinction is not merely one of quantity – however vast the quantitative difference – but also of quality.  Search warrants and document subpoenas typically seek the records of a particular individual or corporation under investigation, and cover particular time periods when the events under investigation occurred.  The orders at issue here contain no such limits.  The metadata concerning every telephone call made or received in the United States using the services of the recipient service provider are demanded, for an indefinite period extending into the future.  The records demanded are not those of suspects under investigation, or of people or businesses that have contact with such subjects, or of people or businesses that have contact with others who are in contact with the subjects – they extend to every record that exists, and indeed to records that do not yet exist, as they impose a continuing obligation on the recipient of the subpoena to provide such records on an ongoing basis as they are created.  The government can point to no grand jury subpoena that is remotely comparable to the real‐time data collection undertaken under this program.

(66)  And more.

The government’s emphasis on the potential breadth of the term “relevant,” moreover, ignores other portions of the text of § 215.  “Relevance” does not exist in the abstract; something is “relevant” or not in relation to a particular subject.  Thus, an item relevant to a grand jury investigation may not be relevant at trial.  In keeping with this usage, § 215 does not permit an investigative demand for any information relevant to fighting the war on terror, or anything relevant to whatever the government might want to know.  It permits demands for documents “relevant to an authorized investigation.”  The government has not attempted to identify to what particular “authorized investigation” the bulk metadata of virtually all Americans’ phone calls are relevant.  Throughout its briefing, the government refers to the records collected under the telephone metadata program as relevant to “counterterrorism investigations,” without identifying any specific investigations to which such bulk collection is relevant.  See, e.g., Appellees’ Br. 32, 33, 34.8   The FISC orders, too, refer only to “authorized investigations (other than threat assessments) being conducted by the FBI . . . to protect against international terrorism,” see, e.g., 2006 Primary Order at 2; Joint App’x 127, 317, merely echoing the language of the statute.  The PCLOB report explains that the government’s practice is to list in § 215 applications multiple terrorist organizations, and to declare that the records being sought are relevant to the investigations of all of those groups.  PCLOB Report 59.  As the report puts it, that practice is “little different, in practical terms, from simply declaring that they are relevant to counterterrorism in general. . . . At its core, the approach boils down to the proposition that essentially all telephone records are relevant to essentially all international terrorism investigations.”  Id. at 59‐60.  Put another way, the government effectively argues that there is only one enormous “anti‐terrorism” investigation, and that any records that might ever be of use in developing any aspect of that investigation are relevant to the overall counterterrorism effort.

(70) I’ll come back to this but this language on assessments could actually pose a problem for USAF.

The government’s approach also reads out of the statute another important textual limitation on its power under § 215.  Section 215 permits an order to produce records to issue when the government shows that the records are “relevant to an authorized investigation (other than a threat assessment).”  50 U.S.C. § 1861(b)(2)(A) (emphasis added).  The legislative history tells us little or nothing about the meaning of “threat assessment.”  The Attorney General’s Guidelines for Domestic FBI Operations, however, tell us somewhat more.  The Guidelines divide the category of “investigations and intelligence gathering” into three subclasses: assessments, predicated investigations (both preliminary and full), and enterprise investigations.  See Attorney General’s Guidelines for Domestic FBI Operations 16‐18 (2008), https://www.ignet.gov/sites/default/files/files/invprg1211appg1.pdf. Assessments are distinguished from investigations in that they may be initiated without any factual predication.

[snip]

In limiting the use of § 215 to “investigations” rather than “threat assessments,” then, Congress clearly meant to prevent § 215 orders from being issued where the FBI, without any particular, defined information that would permit the initiation of even a preliminary investigation, sought to conduct an inquiry in order to identify a potential threat in advance.  The telephone metadata program, however, and the orders sought in furtherance of it, are even more remote from a concrete investigation than the threat assessments that – however important they undoubtedly are in maintaining an alertness to possible threats to national security – Congress found not to warrant the use of § 215 orders.  After all, when conducting a threat assessment, FBI agents must have both a reason to conduct the inquiry and an articulable connection between the particular inquiry being made and the information being sought.  The telephone metadata program, by contrast, seeks to compile data in advance of the need to conduct any inquiry (or even to examine the data), and is based on no evidence of any current connection between the data being sought and any existing inquiry.

(74) As I pointed out here, this is what really concerned Lynch during the argument.

The interpretation urged by the government would require a drastic expansion of the term “relevance,” not only with respect to § 215, but also as that term is construed for purposes of subpoenas, and of a number of national security‐related statutes, to sweep further than those statutes have ever been thought to reach.  For example, the same language is used in 18 U.S.C. § 2709(b)(1) and 20 U.S.C. § 1232g(j)(1)(A), which authorize, respectively, the compelled production of telephone toll‐billing and educational records relevant to authorized investigations related to terrorism.  There is no evidence that Congress intended for those statutes to authorize the bulk collection of every American’s toll‐billing or educational records and to aggregate them into a database — yet it used nearly identical language in drafting them to that used in § 215.  The interpretation that the government asks us to adopt defies any limiting principle.  The same rationale that it proffers for the “relevance” of telephone metadata cannot be cabined to such data, and applies equally well to other sets of records.  If the government is correct, it could use § 215 to collect and store in bulk any other existing metadata available anywhere in the private sector, including metadata associated with financial records, medical records, and electronic communications (including e‐mail and social media information) relating to all Americans.

Such expansive development of government repositories of formerly private records would be an unprecedented contraction of the privacy expectations of all Americans.  Perhaps such a contraction is required by national security needs in the face of the dangers of contemporary domestic and international terrorism.  But we would expect such a momentous decision to be preceded by substantial debate, and expressed in unmistakable language.  There is no evidence of such a debate in the legislative history of § 215, and the language of the statute, on its face, is not naturally read as permitting investigative agencies, on the approval of the FISC, to do any more than obtain the sorts of information routinely acquired in the course of criminal investigations of “money laundering [and] drug dealing.”

(78) This language on ratification may be as important as the language on “relevant to.”

Third, as the above precedents suggest, the public nature of an interpretation plays an important role in applying the doctrine of legislative ratification.  The Supreme Court has stated that “[w]here an agency’s statutory construction has been fully brought to the attention of the public and the Congress, and the latter has not sought to alter that interpretation although it has amended the statute in other respects, then presumably the legislative intent has been correctly discerned.”  North Haven Bd. of Educ. v. Bell, 456 U.S. 512, 535 (1982) (internal quotation marks omitted); see also United States v. Chestman, 947 F.2d 551, 560 (2d Cir. 1991).  Congressional inaction is already a tenuous basis upon which to infer much at all, even where a court’s or agency’s interpretation is fully accessible to the public and to all members of Congress, who can discuss and debate the matter among themselves and with their constituents.  But here, far from the ordinarily publicly accessible judicial or administrative opinions that the presumption contemplates, no FISC opinions authorizing the program were made public prior to 2013 — well after the two occasions of reauthorization upon which the government relies, and despite the fact that the FISC first authorized the program in 2006.

Sack concurrence  (11)

It may be worth considering that the participation of an adversary to the government at some point in the FISCʹs proceedings could similarly provide a significant benefit to that court.  The FISC otherwise may be subject to the understandable suspicion that, hearing only from the government, it is likely to be strongly inclined to rule for the government.  And at least in some cases it may be that its decision‐making would be improved by the presence of counsel opposing the governmentʹs assertions before the court.  Members of each branch of government have encouraged some such development.

Did Authorizing Torture Make the National Security Council an Agency Subject to FOIA?


Almost 3 years ago, I discovered that the judge in the ACLU torture FOIA, Alvin Hellerstein (who recently ordered the Administration to release images from torture), was trying to force the Administration to declassify a phrase making it clear torture had been authorized by the September 17, 2001 “Gloves Come Off” Memorandum of Notification. The phrase appeared on a January 28, 2003 Guidelines on Interrogation document signed by George Tenet (this post describes what great CYA including the phrase was).

In my reporting on it, I noted that National Security Advisor James Jones had secretly written a declaration in the suit arguing the phrase couldn’t be released. And I also noted that CIA’s own declarations conflicted about who had made torture a Special Access Program, CIA or the National Security Council.

Ultimately, however, the 2nd Circuit — in an opinion written by Judge Richard Wesley — reversed Hellerstein and permitted the Administration to keep that short phrase secret (though the Administration permitted that detail to be declassified for the Torture Report).

These issues have resurfaced in a related FOIA suit being reviewed by the 2nd Circuit (including Wesley and Judges Reena Raggi and Gerard Lynch).

Back in late 2012, Main Street Legal Services FOIAed the NSC for records on drone killing (including minutes of NSC meetings in 2011). The government refused to respond, arguing NSC is not an Agency subject to FOIA. So Main Street asked for discovery that might help it show that NSC is an Agency. It lost that argument with District Judge Eric Vitaliano, and this Appeal focuses on the issue of whether NSC is an Agency for purposes of FOIA or not.

In addition to pointing to statutory and historical reasons why NSC is an Agency, the appeal also points to things — including torture, but also including things like cybersecurity, crafting Benghazi talking points, and drone-killing — that were run out of NSC. The government, in response, argued that the President was very closely involved in NSC and presided over the Principals Committee, meaning NSC was too proximate to the President to be subject to FOIA. The response also keeps insisting that NSC is an advisory body, not anything that can make decisions without the President.

That back and forth took place in the first half of 2014.

Then, the Torture Report Summary got released, showing that CIA records indicate President Bush was not briefed on torture until 2006 but that NSC figures — Alberto Gonzales and Condi Rice, among others — told CIA torture was authorized. Main Street wrote a letter in February pointing to the evidence that the President was not in the loop and that NSC authorized torture.

The SSCI Report found that NSC committees, on which the President does not sit, debated, authorized, and directed CIA to apply specific interrogation techniques to specific detainees. In 2004, for example, CIA “sought special approval from the National Security Council Principals Committee” to use “enhanced interrogation techniques” on detainee Janat Gul. Thereafter, NSC principals met and “agreed that ‘[g]iven the current threat and risk of delay, CIA was authorized and directed to utilize” the techniques on Mr. Gul.

The question of who authorized torture thus became a central issue at the oral argument in this suit on March 2 (this discussion starts after 34:00). After Raggi raised this issue, Wesley went on with some urgency about the possibility that someone started torturing without the input of the President.

Judge Wesley: Are you saying then that anything the CIA did in terms of enhanced interrogation techniques clearly, was clearly a Presidential directive?

NSC Counsel Jaynie Lilley:  No, your honor —

Wesley: Well then, well if that’s not the case, its a very curious position for you to take because some of these bear heavy burdens. Some of these assertions that you’re making that the President is at the end of all these decision chains bear heavy burdens and I don’t quite understand it. Congress said sole duty is to advise and assist the President. If someone else decides to use enhanced interrogation techniques and we decide that this is done by the group, solely by the advisor, assistant to the President, then it’s the President’s decision is it not? Did the decision flow through the NSC?

Lilley: Your Honor, many decisions–

Wesley: Would it, structurally, I’ll it easier, would it structurally have flowed through the NSC as it’s currently structure pursuant to presidential order and an act of Congress, would a decision to conduct enhanced interrogation techniques have flowed through the NSC up to the President. Pursuant to the way it’s structured now.

Lilley: Your Honor, let me be sure I’m answering the question that your asking. There are decisions that are made on matters of national security policy that come through the various–

Wesley: Pursuant to law and the structure of the NSC who had the authority?  Did only one person have the authority to order enhanced interrogations techniques?

Lilley: Your Honor, –

Wesley [voice is rising]: Yes or no?!

Lilley: I cannot speak to individual decisions –

Wesley: Well, if you can’t tell me, then you’re telling me that then the President perhaps didn’t make that decision. And then you’re telling me that someone else did. And if someone else did, then I begin to have a problem. Because I have a hard time understanding how their sole function is to advise or assist the President if suddenly they decide, independent of any Presidential approval, that they can torture someone!

Lilley: Your Honor–

Wesley: It’s very simple Counselor, and I’ve been troubled by the government’s position on this throughout. I’ve been troubled — for twenty years the Office of Legal Counsel said that this was an Agency. And then suddenly in a letter, in 1994, for some reason the Agency flips. We have in the legislative record, we have the committee notes from the two committees, and what is one of the entities that’s listed when they decided to include the Executive office, what is one of the Agencies that Congress lists, one of the groups that Congress lists as an Agency? The NSC. Who created the NSC? The President didn’t. An act of Congress did. An Act of Congress creates two of the Subcommittees. A very curious advisor forced on the President — it sounds like a Separation of Powers issue to me. But, tell me. And then I won’t ask again. And if you don’t want to answer my question don’t answer.

Pursuant to the way the it is currently structured if in your view the NSC is solely an advisory authority, who had the authority to order enhanced interrogation techniques? Who?

Lilley: In any matter of national security policy, there are two places where decisions can be made. One by the President and one by that Agency with the statutory authority to take the act.

Wesley: So you’re telling me that the CIA had the authority to do that?

[snip]

Wesley: The Director of the CIA could have done this independent of the President’s directive?

Lilley: Your Honor, I cannot speak to that.

Wesley: But for purposes of this discussion you’re saying ‘not someone in the NSC’?

Lilley: The NSC could not — does not direct any individual Agency to take individual actions.

Wesley went onto to describe the plight of the CIA that might not want to do something (torture) it has been ordered to do by the NSC, “it’s on him, legally, not on the NSC.” “Yes, your Honor,” Lilley agreed.

While Wesley didn’t say so, that is, precisely, what Tenet argued when he noted Torture was done pursuant to Presidential order on his 2003 Interrogation document, dodging responsibility for torture. But if Lilley’s claim is correct, then CIA bears all the legal responsibility for torture.

At the end of the hearing, Wesley asked Lilley whether they intend to respond to Main Street’s letter. When Lilley said no, Wesley and Raggi specifically instructed Lilley to respond, noting actual page numbers.

In its response on March 16, the government — some members of which have been arguing for months that the NSC approved torture at every step of the process — newly asserted (ignoring the references that show Bush was never briefed until 2006) that George Tenet was only getting NSC’s advice; he was not being ordered or authorized by them.

Another cites a CIA official’s notes indicating that the Principals Committee “agreed” that CIA was “authorized and directed” to engage in certain activity, confirming the CIA had such authority, and that the then-Attorney General approved the resulting action. See id. at 345. These references confirm that the NSC functions in accordance with the advice and assistance role assigned to it by statute and by the President (currently in Presidential Policy Directive-1) as an interagency forum for coordination and exercises no independent decisional authority. The authority for the underlying decisions rested with the relevant heads of departments and agencies or the President himself.

Remember, DOJ has been claiming it never opened this document. Has it now done so?

But the SSCI evidence that Bush was never briefed is a point Main Street made in a letter last night.

Defendant still fails to explain who authorized the torture if not NSC, as CIA’s own records describe, especially given that CIA did not brief the President until years later.

A great deal of documentation shows that “NSC” (or rather, Dick Cheney and David Addington) authorized torture. But the NSC is trying to sustain the unsustainable position that a Memorandum of Notification not listing torture authorized torture, that Bush never got briefed on torture, and that all those meetings at which NSC members (and Dick Cheney) authorized torture didn’t amount to authorizing torture.

Because if it admitted the truth — that NSC or the Vice President authorized torture without any review by the President — then it would make all these documents, the 9000 documents President Obama got CIA to successfully hide, subject to FOIA.

And then we’d really start having some fun.

Update: I’ve added some to my transcription from the hearing and some additional analysis.

Hospital Hero Jack Goldsmith, the Destroyer of the Internet Dragnet, Authorized the Internet Dragnet

As I noted earlier, I think the re-release of Jack Goldsmith’s May 6, 2004 OLC memo authorizing Stellar Wind is meant to warn Congress that the Executive does not believe it needs any Congressional authorization to spy on every American — just in time for the USA Freedom Act debate in the Senate. This is exactly parallel to similar provocations during the Protect America Act debate. In the past, such provocations led Congress to capitulate to Executive branch demands to tailor the program to their wishes.

That earlier post, however, implied that this warning pertains primarily to the phone dragnet.

It doesn’t. The warning also applies to the Internet dragnet (and I suspect that stories about the heroic hospital heroes shutting down the Internet dragnet have been dramatically overblown).

One of the very few things — aside from the name STELLAR WIND, over and over, as well as references to content collection that could have been released after President Bush admitted to that part of the program in 2005, and the title Secretary of Defense — that has been newly revealed is this bit of the Table of Contents (here’s the previous release for comparison).

Screen Shot 2014-09-06 at 1.05.11 PM

 

It shows that the memo discusses content, discusses telephony metadata, discusses something else, then concludes that content and metadata are both kosher under the Fourth Amendment. That already makes it clear that part IV is about metadata. The last sentence of the first full paragraph on page 19 does, too. Page 7 makes it clear that Fourth Amendment analysis applies to “both telephony and e-mail.” Much later in the memo, it becomes clear this section — pages 96 to 100 — deals with Internet metadata.

In fact, the only substantive newly unredacted parts of the memo appear on 101 (PDF 69) and then from 106 to 108.

All of this new information makes it clear that Goldsmith asserted that Smith v. Maryland applied for metadata — and applied to both phone and Internet metadata. Remarkably, in that analysis, the government keeps at least one paragraph addressing phone metadata hidden, but reveals the analysis at 106-7 (PDF 74-75) that applies to Internet. (Goldsmith’s claim that Internet users can get providers to turn off spam, at the bottom of 107, is particularly nice.)

In perhaps the most interesting newly released passage (out of the roughly 5 pages that got newly released!), Goldsmith absolves himself of examining what procedures the government was using in its “metadata” collection.

As for meta data collection, as explained below, we conclude that under the Supreme Court’s decision in Smith v. Maryland, 442 U.S. 735 (1979), the interception of the routing information for both telephone calls and e-mails does not implicate any Fourth Amendment interests.85

85 Although this memorandum evaluates the STELLAR WIND program under the Fourth Amendment, we do not here analyze the specific procedures followed by the NSA in implementing the program.  (101/PDF 69)

I find this utterly damning, given that we know that, for the following 5 years, the government would lie to FISC about whether their “metadata” contained content. Even the OLC opinion built in the Executive’s ability to collect content in the guise of metadata!

In any case, what is clear — again, just in time to impact the debate over USA Freedom, for which prospective call record collection might or might not be limited to telephone content — is that rather than legally shutting down the Internet dragnet in 2004, Jack Goldsmith authorized it.

And that authorization remains in place, telling the Executive it can collect Internet (and phone) “metadata” whether or not FISC or Congress rubberstamps it doing so. Not only that, but telling the Executive this analysis holds regardless of how inadequate their procedures are in implementing this program to ensure that no content gets swept up in the guise of metadata (which of course is precisely what occurred).

So the Administration, in releasing this “newly unredacted” memo did one thing. Tell Congress it will continue to collect phone and Internet “metadata” on its own terms, regardless of what Congress does.

Only one thing could alter this analysis of course: if the Courts decide that Smith v. Maryland doesn’t actually permit the government to collect all metadata, plus some content-as-metadata, in the country, if they say the Executive can’t actually collect “everything there is to know about everybody and have it all in one big government cloud,” as 2nd Circuit Judge Gerard Lynch described the implications of what we now know to be Goldsmith’s logic on Tuesday. But the courts are going to stop analyzing this question as soon as Congress passes USA Freedom Act. Moreover, the last check on the program — the unwillingness of providers to break the law — will be removed by the broad immunity provision included in the bill.

Not only didn’t Jack Goldsmith heroically legally shut down the Internet dragnet in 2004 (clearly President Bush did make several modifications; we just still don’t know what those are). But he provided a tool that is likely proving remarkably valuable as the Executive gets Congress and privacy NGOs to finish signing off on their broad authority.

The hospital heroes may have temporarily halted the conduct of the Internet dragnet — even while telling Colleen Kollar-Kotelly she had to rubber stamp ignoring the letter of the law because Congress couldn’t know about the dragnet — but they didn’t shut it down. Here it is, legally still operating, just in time to use as a cudgel with Congress.

Update: One other thing other reporting on this is missing — and not for the first time — is that whatever change they made to the Internet dragnet, it was by no means the only change after the hospital confrontation. They also took Iraqi targeting out (in some way). And there was a later April 2 modification that appears to have nothing to do with NSA at all (I have my theories about this, but they’re still theories). So it is too simple to say the hospital confrontation was exclusively about the Internet dragnet — the public record already makes clear that’s not the case.

“What Else Haven’t You Let Us Know?” 2nd Circuit Asks DOJ

Well into today’s argument over ACLU v. Clapper, the ACLU’s challenge to the government’s phone dragnet, one of the judges — Robert Sack — pointed out the discussion we’re having all stems from documents the government was forced to release after the Edward Snowden leaks.

It was itself telling — not least because DOJ Civil Division AAG Stuart Delery at times proclaimed not to know the answers to the questions the judges posed, questions I know the answer to. For example, Delery claimed, at first, not to know of instances when the FISA Court ruled more harshly than the government; and when he ultimately did admit to those instances, he didn’t admit that some of them involved systematic abuses. He also dodged questions about whether the government could get financial records, which we know they do (and James Cole has testified they could).

It was all the more telling, however, given that two of the judges on the panel — Gerard Lynch and Sack — had ruled against the government in Amnesty v. Clapper, ACLU’s challenge to the Section 702 program. As you’ll recall, to get SCOTUS to overturn that ruling, DOJ lied to the Supreme Court about what kind of notice it gave to defendants under Section 702. Snowden’s leaks led to a change in DOJ’s notice policy to actually come closer — but not actually match –what DOJ had claimed before SCOTUS (they’re still not giving notice to all defendants). At one point, Lynch said something like, “We weren’t as familiar [with 702] as the Supreme Court thought we should have been.”

These judges have reason to be skeptical about DOJ’s claims about their own surveillance programs. Which is probably why Sack asked (after 1:36), “That’s what you’ve let us know. What else haven’t you let us know?”

Much of the hearing went like I expected. ACLU’s Alex Abdo argued both that the court has the authority to overturn the dragnet based on statutory grounds, but also that it’s not reasonable and therefore constitutional. He used Obama’s decision to change the program to argue that the Administration recognizes that the program, as currently constituted, is not reasonable. To support an argument the program is reasonable, DOJ’s Delery claimed Congress had ratified it by reauthorizing it twice. On rebuttal, Abdo noted that Congress had never seen the legal basis (because there was none, until 2013) before they allegedly “ratified” the program.

Delery’s arguments were even weaker than I had expected. He argued that the courts can’t intrude here because the political branches had worked out reasonable limits for this program, pointing to the minimization procedures required by the statute. Except that — as he admitted later — the FISA Court had largely influenced the minimization procedures for the program. If a Court set the minimization procedures that make it reasonable, then can’t a court rule on whether that’s a proper balance?

Not to mention, the statute only requires FBI have minimization procedures, not NSA, so the minimization procedures in the statute are proof the government is actually using the statute with an agency Congress did not envision using it.

Abdo returned to the centrality of minimization procedures in his closing words. He noted that if, as the government claims, Section 215 is authorized by Smith v. Maryland, then, minimization procedures are constitutionally superfluous.

The minimization procedures that the government relies on would be constitutionally superfluous if Smith governed this case. They could collect the records without any of those protections in place. They could store all of them indefinitely. They could query them for any reason or no reason at all. And they could build the dossiers that they disclaim building in this case with no constitutional restrictions. A final point is that the government tries to explain why it’s only asking for a narrow ruling from this court. But the legal theories that it advances are a roadmap to a world in which the government routinely collects vast quantities of information about Americans who have done absolutely nothing wrong. I don’t think that’s the world that Congress envisioned when it enacted Section 215. And it’s certainly not the world that the framers envisioned when they crafted the Fourth Amendment.

But that would bring us to the scenario laid out by Judge Lynch (see from 59:00 to 1:06:50), in which the government could get anything held by a third party about everyone just because it could. The same argument applies to bank records and credit card records, Lynch walked Delery through the implications patiently.

… You can collect everything there is to know about everybody and have it all in one big government cloud.

[snip]

I just don’t understand an argument as to what’s so special about telephone records that makes them so valuable, so uniquely interactive or whatever, that the same arguments you’re making don’t apply to every record in the hands of a third party business entity of every American’s everything.

As far as we know, the government has already done this with financial records, in part under Section 215, which is one of the reasons Obama won’t back off this challenge; even under USA Freedom, the government can continue to obtain Western Union’s records. Add in the EO 12333 collections, and the government is well on its way to the nightmarish scenario both Lynch and Abdo laid out.

In any case, Judge Lynch (more likely his clerks) seems to have done his homework. He seems to have a sense not only where this could go, but where it already has. And while he repeatedly talked about narrow rulings — if I had to guess, I think he might prefer to rule the “relevant” interpretation Bates-stamped by the FISA Court unconstitutional than ruling the entire program so — he gets that this program is a constitutional atrocity.

The question is whether he can write a ruling that will withstand SCOTUS review, this time.