Posts

Behold, BR 15-24, the Longest-Serving Phone Dragnet Order Ever

By my calculation today marks the 91st day of the life of phone dragnet order BR 15-24, making it the longest running dragnet order ever. Though the order offered no explanation, FISC judge James Boasberg approved a 95-day expiration for this order back on February 26 so the dragnet order expiration would coincide with PATRIOT Act’s sunset.

It probably seemed wise at the time, but it definitely exacerbates the impact of Mitch McConnell’s miscalculation last week, as it means there’s is no grace period after the current order expires.

The 90-day renewals appear to arise out of both the Stellar Wind practice and the FISA Pen Register practice. Under the former, the Bush Administration reviewed the dragnet every 45 days to make sure it was still necessary and give it the appearance of oversight. (The renewal dates appear on this timeline.) When FISC approved the use of the Pen Register statute to collect the Internet dragnet, it adhered to that statute’s renewal process, which requires 90-day renewals. I assume the phone dragnet adopted the same, even though Section 215 has no renewal requirement, because the phone dragnet collected even more data than the Internet dragnet did.

So already, we’re a day longer than the spirit of the law should permit, four days before Sunday’s scheduled resolution (or lack thereof) of the current impasse.

Given Charlie Savage’s account, it appears the Administration did not — as ordered by Boasberg — brief the FISC on the impact of the 2nd Circuit decision if it would change the program. Rather, they’re just hiding out, hoping they don’t need to raise this or any other issue with regards to the dragnet with the FISC.

The Foreign Intelligence Surveillance Court had given the government a deadline of last Friday to file a new application to extend the bulk phone records program for 90 days. Given the disarray in the Senate and the looming deadline, the Justice Department did not file, the official said, speaking on condition of anonymity to discuss intelligence-related matters.

[snip]

The administration is holding to its decision not to invoke the grandfather clause to keep collecting bulk phone records past next Monday, the official said. But the government has not ruled out invoking such a clause for using the business records provision — as well as the other two powers that are expiring — to gather specific records for more routine investigations.

“We will not use the grandfather clause in the Patriot Act to continue the bulk metadata collection program; it would not be tenable for us to do so,” the senior official said.

“Thus, because of the pending sunset of the current authority, we have not filed an application with the FISA court to continue collection,” the official said, referring to the Foreign Intelligence Surveillance Act court, also known as FISC.

The official added, “We will consider, in light of our national security needs and the status of our authorities, whether to make an appropriate filing with the FISC about accessing previously collected metadata.”

[snip]

The administration is hoping to avoid any need to go to the court for permission to query already-acquired bulk phone data, which would raise additional legal complications.

But one plan being floated — Dianne Feinstein’s non-compromise compromise — would simply permit the FISC to extend the current order until a year after whenever her bill might be passed into law (which couldn’t be Sunday night), as if nothing had ever happened.

CONTINUED APPLICABILITY.—Notwithstanding any other provision of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.) or this Act or any amendment made by this Act, the order entered by the court established under section 103(a) of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1803(a)) on February 26, 2015, in Docket No. BR 15–24, may be extended by order of that court until the effective date established in subsection (a) [that is, one year after the passage of this bill]

In other words, Feinstein proposes to take a dragnet collecting the phone records of all Americans, and extend it for an entire year, when even a Pen Register targeting an individual would need to be formally renewed.

How the Second Circuit, FISC, and the Telecoms Might Respond to McConnell’s USA F-ReDux Gambit

Update: Jennifer Granick (who unlike me, is a lawyer) says telecoms will be subject to suit if they continue to comply with dragnet orders. 

Any company that breaches confidentiality except as required by law is liable for damages and attorneys’ fees under 47 U.S.C. 206. And there is a private right of action under 47 U.S.C. 207.

Note that there’s no good faith exception in the statute, no immunity for acting pursuant to court order. Rather, the company is liable unless it was required by law to disclose. So Verizon could face a FISC 215 dragnet order on one side and an order from the Southern District of New York enjoining the dragnet on the other. Is Verizon required by law to disclose in those circumstances? If not, the company could be liable. And did I mention the statute provides for attorneys’ fees?

Everything is different now than it was last week. Reauthorization won’t protect the telecoms from civil liability. It won’t enable the dragnet. As of last Thursday, the dragnet is dead, unless a phone company decides to put its shareholders’ money on the line to maintain its relationships with the intelligence community.

Last night, Mitch McConnell introduced a bill for a 2-month straight reauthorization of the expiring PATRIOT provisions as well as USA F-ReDux under a rule that bypasses Committee structure, meaning he will be able to bring that long-term straight reauthorization, that short term one, or USA F-ReDux to the floor next week.

Given that a short term reauthorization would present a scenario not envisioned in Gerard Lynch’s opinion ruling the Section 215 dragnet unlawful, it has elicited a lot of discussion about how the Second Circuit, FISC, and the telecoms might respond in case of a short term reauthorization. But these discussions are almost entirely divorced from some evidence at hand. So I’m going to lay out what we know about both past telecom and FISA Court behavior.

Because of the details I lay out below, I predict that so long as Congress looks like it is moving towards an alternative, both the telecoms and the FISC will continue the phone dragnet in the short term, and the Second Circuit won’t weigh in either.

The phone dragnet will continue for another six months even under USA F-ReDux

As I pointed out here, even if USA F-ReDux passed tomorrow, the phone dragnet would continue for another 6 months. That’s because the bill gives the government 180 days — two dragnet periods — to set up the new system.

(a) IN GENERAL.—The amendments made by sections 101 through 103 shall take effect on the date that is 180 days after the date of the enactment of this Act.

(b) RULE OF CONSTRUCTION.—Nothing in this Act shall be construed to alter or eliminate the authority of the Government to obtain an order under title V of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 24 1861 et seq.) as in effect prior to the effective date described in subsection (a) during the period ending on such effective date.

The Second Circuit took note of USA F-ReDux specifically in its order, so it would be hard to argue that it doesn’t agree Congress has the authority to provide time to put an alternative in place. Which probably means (even though I oppose Mitch’s short-term reauth in most scenarios) that the Second Circuit isn’t going to balk — short of the ACLU making a big stink — at a short term reauth for the purported purpose of better crafting a bill that reflects the intent of Congress. (Though the Second Circuit likely won’t look all that kindly on Mitch’s secret hearing the other day, which violates the standards of debate the Second Circuit laid out.)

Heck, the Second Circuit waited 8 months — and one failed reform effort — to lay out its concerns about the phone dragnet’s legality that were, in large part, fully formed opinions at least September’s hearing. The Second Circuit wants Congress to deal with this and they’re probably okay with Congress taking a few more months to do so.

FISC has already asked for briefing on any reauthorization

A number of commentators have also suggested that the Administration could just use the grandfather clause in the existing sunset to continue collection or might blow off the Appeals Court decision entirely.

But the FISC is not sitting dumbly by, oblivious to the debate before Congress and the Courts. As I laid out here, in his February dragnet order, James Boasberg required timely briefing from the government in each of 3 scenarios:

  • A ruling from an Appellate Court
  • Passage of USA F-ReDux introduces new issues of law that must be considered
  • A plan to continue production under the grandfather clause

And to be clear, the FISC has not issued such an order in any of the publicly released dragnet orders leading up to past reauthorizations, not even in advance of the 2009-2010 reauthorizations, which happened at a much more fraught time from the FISC’s perspective (because FISC had had to closely monitor the phone dragnet production for 6 months and actually shut down the Internet dragnet in fall 2009). The FISC clearly regards this PATRIOT sunset different than past ones and plans to at least make a show of considering the legal implications of it deliberately.

FISC does take notice of other courts

Of course, all that raises questions about whether FISC feels bound by the Second Circuit decision — because, of course, it has its very own appellate court (FISCR) which would be where any binding precedent would come from.

There was an interesting conversation on that topic last week between (in part) Office of Director of National Intelligence General Counsel Bob Litt and ACLU’s Patrick Toomey (who was part of the team that won the Second Circuit decision). That conversation largely concluded that FISC would probably not be bound by the Second Circuit, but Litt’s boss, James Clapper (one of the defendants in the suit) would be if the Second Circuit ever issued an injunction.

Sunlight Foundation’s Sean Vitka: Bob, I have like a jurisdictional question that I honestly don’t know the answer to. The Court of Appeals for the Second Circuit. They say that this is unlawful. Obviously there’s the opportunity to appeal to the Supreme Court. But, the FISA Court of Review is also an Appeals Court. Does the FISC have to listen to that opinion if it stands?

Bob Litt: Um, I’m probably not the right person to ask that. I think the answer is no. I don’t think the Second Circuit Court of Appeals has direct authority over the FISA Court. I don’t think it’s any different than a District Court in Idaho wouldn’t have to listen to the Second Circuit’s opinion. It would be something they would take into account. But I don’t think it’s binding upon them.

Vitka: Is there — Does that change at all given that the harms that the Second Circuit acknowledged are felt in that jurisdiction?

Litt: Again, I’m not an expert in appellate jurisdiction. I don’t think that’s relevant to the question of whether the Second Circuit has binding authority over a court that is not within the Second Circuit. I don’t know Patrick if you have a different view on that?

Third Way’s Mieke Eoyang: But the injunction would be, right? If they got to a point where they issued an injunction that would be binding…

Litt: It wouldn’t be binding on the FISA Court. It would be binding on the persons who received the —

Eoyong: On the program itself.

Patrick Toomey: The defendants in the case are the agency officials. And so an injunction issued by the Second Circuit would be directed at those officials.

But there is reason to believe — even beyond FISC’s request for briefing on this topic — that FISC will take notice of the Second Circuit’s decision, if not abide by any injunction it eventually issues.

That’s because, twice before, it has even taken notice of magistrate judge decisions.

The first known example came in the weeks before the March 2006 reauthorization of the PATRIOT Act would go into effect. During 2005, several magistrate judges had ruled that the government could not add a 2703(d) order to a pen register to obtain prospective cell site data along with other phone data. By all appearances, the government was doing the same with the equivalent FISA orders (this application of a “combined” Business Record and Pen Register order is redacted in the 2008 DOJ IG Report on Section 215, but contextually it’s fairly clear this is close to what happened). Those magistrate decisions became a problem when, in 2005, Congress limited Section 215 order production to that which could be obtained with a grand jury subpoena. Effectively, the magistrates had said you couldn’t get prospective cell site location with just a subpoena, which therefore would limit whether FBI could get cell site location with a Section 215 order.

While it is clear that FISC required briefing on this point, it’s not entirely clear what FISC’s response was. For a variety of reasons, it appears FISC stopped these combined application sometime in 2006 — the reauthorization went into effect in March 2006 — though not immediately (which suggests, in the interim, DOJ just found a new shell to put its location data collection under).

The other time FISC took notice of magistrate opinions pertained to Post Cut Through Dialed Digits (those are the things like pin and extension numbers you dial after your call or Internet connection has been established). From 2006 through 2009, some of the same magistrates ruled the government must set its pen register collection to avoid collecting PCTDD. By that point, FISC appears to have already ruled the government could collect that data, but would have to deal with it through minimization. But the FISC appears to have twice required the government to explain whether and how its minimization of PCTDD did not constitute the collection of content, though it appears that in each case, FISC permitted the government to go on collecting PCTDD under FISA pen registers. (Note, this is another ruling that may be affected by the Second Circuit’s focus on the seizure, not access, of data.)

In other words, even on issues not treating FISC decisions specifically, the FISC has historically taken notice of decisions made in courts that have no jurisdiction over its decisions (and in one case, FISC appears to have limited government production as a result). So it would be a pretty remarkable deviation from that past practice for FISC to completely blow off the Second Circuit decision, even if it may not feel bound by it.

Verizon responds to court orders, but in half-assed fashion

Finally, there’s the question of how the telecoms will react to the Second Circuit decision. And even there, we have some basis for prediction.

In January 2014, after receiving the Secondary Order issued in the wake of Judge Richard Leon’s decision in Klayman v. Obama that the dragnet was unconstitutional, Verizon made a somewhat half-assed challenge to the order.

Leon issued his decision December 16. Verizon did not ask the FISC for guidance (which makes sense because they are only permitted to challenge orders).

Verizon got a new Secondary Order after the January 3 reauthorization. It did not immediately challenge the order.

It only got around to doing so on January 22 (interestingly, a few days after ODNI exposed Verizon’s role in the phone dragnet a second time), and didn’t do several things — like asking for a hearing or challenging the legality of the dragnet under 50 USC 1861 as applied — that might reflect real concern about anything but the public appearance of legality. (Note, that timing is of particular interest, given that the very next day, on January 23, PCLOB would issue its report finding the dragnet did not adhere to Section 215 generally.)

Indeed, this challenge might not have generated a separate opinion if the government weren’t so boneheaded about secrecy.

Verizon’s petition is less a challenge of the program than an inquiry whether the FISC has considered Leon’s opinion.

It may well be the case that this Court, in issuing the January 3,2014 production order, has already considered and rejected the analysis contained in the Memorandum Order. [redacted] has not been provided with the Court’s underlying legal analysis, however, nor [redacted] been allowed access to such analysis previously, and the order [redacted] does not refer to any consideration given to Judge Leon’s Memorandum Opinion. In light of Judge Leon’s Opinion, it is appropriate [redacted] inquire directly of the Court into the legal basis for the January 3, 2014 production order,

As it turns out, Judge Thomas Hogan (who will take over the thankless presiding judge position from Reggie Walton next month) did consider Leon’s opinion in his January 3 order, as he noted in a footnote.

Screen Shot 2014-04-28 at 10.49.42 AM

And that’s about all the government said in its response to the petition (see paragraph 3): that Hogan considered it so the FISC should just affirm it.

Verizon didn’t know that Hogan had considered the opinion, of course, because it never gets Primary Orders (as it makes clear in its petition) and so is not permitted to know the legal logic behind the dragnet unless it asks nicely, which is all this amounted to at first.

Ultimately, Verizon asked to see proof that FISC had considered Leon’s decision. But it did not do any of the things people think might happen here — it did not immediately cease production, it did not itself challenge the legality of the dragnet, and it did not even ask for a hearing.

Verizon just wanted to make sure it was covered; it did not, apparently, show much concern about continued participation in it.

And this is somewhat consistent with the request for more information Sprint made in 2009.

So that’s what Verizon would do if it received another Secondary Order in the next few weeks. Until such time as the Second Circuit issues an injunction, I suspect Verizon would likely continue producing records, even though it might ask to see evidence that FISC had considered the Second Circuit ruling before issuing any new orders.

Did the Government Comply with FISC Requirement of Notice on Appellate Decision

I’m prepping a post on how all the various deadlines over the next several weeks will work together. So I’ve been reviewing the instructions James Boasberg laid out in the most recent dragnet order, which he signed on February 26.

First, Boasberg reminded the government — which had turned in its homework late in February — that FISC gets a week to consider any application. That means they need the next application by May 22.

Remember, the House breaks for Memorial Day on May 21 (that is, they’re not scheduled to be in session on May 22) and the Senate breaks on May 22.

The government will almost certainly have to submit a new dragnet order by May 22. That’s because USA F-ReDux allows bulk collection to continue for 6 months as it sets up PRISM-lite for provider compliance. But as I understand it, the new dragnet order has to happen under USA F-ReDux, not PATRIOT.

That may shave one day off the legislative schedule.

More interesting is Boasberg’s order that if any of the three appellate court reviewing the dragnet issues an opinion “prior to the expiration of this Order, the government is directed to inform the Court promptly if the government’s implementation of this Order has changed as a result of such opinion(s).”

Now, in actually, the government might only have to send a short note saying, “the Second Circuit ruled, told us this is unlawful, but also did not issue an injunction because Congress is about to act on it.” But they have to send some kind of notice, per this order.

Did they?

The Government’s Two Freebie Phone Dragnet Orders

The mood among dragnet reformers has been outright panic about how we need to do something now omigosh we only have 6 weeks.

That’s true, to a point.

But as people scream about the urgency of this, they should consider that the government plans to be operating with the old-style dragnet for up to another 6 months.

For what are surely good logistical reasons (the government has to tell the phone companies how they’ll have to chain on their smart phone users’ data, and Booz will have to set up a giant insecure cloud to conduct the cross-provider chaining), the newfangled chain-on-your-smart-phone dragnet won’t start for 6 months after this bill passes.

(a) IN GENERAL.—The amendments made by sections 101 through 103 shall take effect on the date that is 180 days after the date of the enactment of this Act.

(b) RULE OF CONSTRUCTION.—Nothing in this Act shall be construed to alter or eliminate the authority of the Government to obtain an order under title V of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 24 1861 et seq.) as in effect prior to the effective date described in subsection (a) during the period ending on such effective date.

That means the government plans on relying on the old-fashioned suck-it-all-up dragnet for another 6 months.

It also provides a narrow window for the government to rush through new definitions (for example, of session-identifying information that is not a CDR) that won’t be subject to USA F-ReDux’s notice requirements.

Hopefully, the FISC would look askance at that ploy. In the last dragnet order, James Boasberg asked most of the right questions about what the government plans to do to convince me he, at least, doesn’t intend to be snookered in this lame duck period.

But those running around screaming “PANIC!” should recognize that even under the passage of USA F-ReDux, the dragnet will continue another 6 months.

In February, the Government Turned in Its Dragnet Homework Late

Last Wednesday, I Con the Record released the latest dragnet order, signed on February 26.

This order actually has several changes of note.

As I predicted, yet another new FISC judge signed the order, James Boasberg, who only joined the court last May. I suspect they’ve been ensuring that every new approval is approved by a different FISC judge, so they can boast to other courts about how many judges have approved the dragnet.

In what may be related detail, the application for this was late, having been submitted just 3 days before the renewal request was due (and therefore 4 days late). FISC judges have one week terms, so they may have stalled until Boasberg, as a new judge, was presiding.

Whatever the reason, Boasberg scolded DOJ for turning in their homework late, and warned them not to do it again for the next renewal, if there is one.

With two exceptions, neither of which applies here, Rule 9 of this Court’s Rules of Procedure requires the government to submit a proposed application no later than seven days before it seeks to have a matter entertained by the Court. The Court notes that the government filed its proposed application in this matter four days late. If the government seeks to renew the authorities approved herein prior to their expiration on June 1, 2015, the government is directed to file the proposed renewal application no later than Friday, May 22, 2015.

Curiously, Boasberg doesn’t discuss the five-day longer period of collection under this order, he just sets it.

Boasberg also laid out how the government must proceed under each of three scenarios.

First, if any of the 3 Appellate Courts reviewing the dragnet issue an opinion, “the government is directed to inform the Court promptly if the government’s implementation of this Order has changed as a result.”

Equally important, if Congress does pass some kind of new law, it must tell the court about anything the Court hasn’t already considered.

If Congress has enacted legislation amending 50 U.S.C. § 1861 prior to a request for renewed authorities, the government is directed to provide, along with its request, a legal memorandum pursuant to Rule 11(d) of this Court’s Rules of Procedure addressing any issues of law raised by the legislation and not previously considered by the Court.

This last bit is important. Some things — connection rather than contact chaining — would be codified if USA Freedom Act were to pass. But the Court has already considered it; it has been part of dragnet orders for over a year. Some USAF supporters had assumed new definitions in the bill would elicit new opinions that would be treated under the bill’s transparency provisions, but that’s only if the government believes the FISC has never reviewed it. So (for example) we might never know how the FISC has permitted the government to interpret selection term if it deems that the same as selection term it is using.

Finally, in language that might address the possibility Charlie Savage raised in November — that the government would continue doing what it is doing, because the underlying “investigation” remains the same, and therefore no extension is required — if nothing happens, the Court requires a memo of law explaining that.

If Congress, conversely, has not enacted legislation amending § 1861 or extending its sunset date, established by Section 102(b) of Public Law 109-177, 120 Stat. 195, as most recently amended by Section 2(a) of Public Law 112-14, 125 Stat. 216, the government is directed to provide a legal memorandum pursuant to Rule 11(d) addressing the power of the Court to grant such authority beyond June 1, 2015.

Section 102(b) of Public Law 109-177 is the section Savage pointed to that might permit the dragnet to continue.

(2) Exception.–With respect to any particular foreign intelligence investigation that began before the date on which the provisions referred to in paragraph (1) cease to have effect, or with respect to any particular offense or potential offense that began or occurred before the date on which such provisions cease to have effect, such provisions shall continue in effect.

That basically says the Court is aware of this discussion, either because it reads the NYT or because the government has mentioned it. This order doesn’t tip a hand on how FISC would regard this claim, but it does make clear it considers it a distinct possibility.

Note, unless I’m missing something, no language like this appears in any of the unredacted sections of previous dragnet orders, not even when Congress was giving the government straight renewals. We can’t be sure, but that certainly seems to suggest the Court has been having conversations — either by itself or with the government — about alternatives in a way Bob Litt and others are not having publicly.

Which brings me back to the government’s late homework again. There are other possibilities to explain the delayed submission. For example, it’s possible they delayed to make the extension of the 90-day period less odd (though I’m not sure why). It’s possible they honestly considered not renewing the order, already putting into place whatever they’re going to unilaterally do once Congress does nothing. Or perhaps they were still debating how to proceed with the Court.

When I used to turn in homework late (okay — it probably only happened once), I had to have a good excuse. What was the government’s?

There’s one more tiny change of note. This order moves its definition for connection chaining to footnote 7 (and the order consolidated some other footnotes). That’s likely just cosmetic, unless the FISC had some concern that the government was using a flexible definition of “connection chaining” for its emergency approvals.

Peter Bergen’s Bumper Sticker

Yesterday, just two days after the unofficial start of the General Election, Joe Biden officially rolled out the slogan he had already warned would be his refrain for the entire campaign season:

If you’re looking for a bumper sticker to sum up how President Obama has handled what we inherited, it’s pretty simple: Osama bin Laden is dead and General Motors is alive.

Also yesterday, Time Magazine rolled out a Peter Bergen article, The Last Days of Osama Bin Laden (which is still behind the paywall), accompanied not just by a bunch of other piggy-backed articles, but the letter above, Leon Panetta’s record of National Security Advisor Tom Donilon’s call telling him the operation against OBL was a go.

I guess we’re supposed to assume the timing of the two events is entirely coincidental.

The other event that transpired yesterday–Judge James Boasberg’s order ruling the CIA had properly withheld 52 photos taken during the raid on OBL’s compound under FOIA exemption 1 (properly classified information)–probably was just a coincidence.

But it does remind us that the photos–that is, records of the same covert operation as Leon Panetta’s note recorded–were immediately stamped “Top Secret,” considered derivatively classified, and subsequently formally classified and withheld from FOIA.

And yet, here Panetta’s note is, somehow having evaded the classification stamps. That, in spite of the fact that it records the normally religiously guarded Presidential communications, not to mention details of how CIA and JSOC work together on covert ops, the time it was officially okayed, that McRaven was informed first even though CIA was ostensibly in charge of the op. All of it stuff that, had the op blown up in Obama’s face, would be as carefully guarded as those pictures of OBL’s funeral.

In my mind, this whole festival of information asymmetry targeted at voters is capped off by the byline involved: Peter Bergen.

When I read about the imprisonment of journalists like Abdulelah Haider Shaye, or the wiretapping of Lawrence Wright and Christiane Amanpour, I think back to Bergen, who in the days after 9/11 was an important, reliable source who knew more about al Qaeda than many of the people taxpayers were paying to keep us safe. I’ve always thought, as our government targets journalists covering Islamic extremists, we’re handcuffing the next Peter Bergen, that journalist who is right now collecting the information our intelligence community is neglecting.That Peter Bergen is likely to be imprisoned, like Shaye, for talking directly to a terrorist.

And what has Bergen become, along the way? The outlet for officially leaked information–one more tool in the President’s toolbox of information asymmetry.

I don’t blame the Obama Administration for running on Joe Biden’s pithy slogan. But I do blame it for corrupting information in this way, both the system of classification that should be free from politics, and the space it accorded journalists to do their job when the government wasn’t.

Update: See this for details of how Brian Williams will film Obama and friends re-enacting last year’s Sit Room drama as they killed OBL.

Update: One of the things Judicial Watch complained about in their OBL suit is that the photos were probably classified only after the government received their FOIA on May 2 (to DOD) and May 4 (to CIA). CIA Information Review Officer Elizabeth Anne Culver explained that the CIA always considered the photos classified.

Contrary to Plaintiff’s suggestion, after their creation these extraordinarily sensitive images were always considered to be classified by the CIA and were consistently maintained in a manner appropriate for their classification level.

So wouldn’t Panetta’s note be considered derivatively classified, just like the photos? If so, why doesn’t have declassification markings now?