Tag: USA PATRIOT Act

Reviewing the Review Group: Practice What You Preach

The “President’s Review Group on Intelligence and Communications Technologies” has issued their report. Convened in late summer to advise the president on what to do in the wake of the Snowden revelations (without mentioning Snowden), the group was rightly criticized for its ‘insider’ composition. The report has beaten the privacy community’s low expectations, which is good news. It advances a discussion that began in June and that will continue for years.

Some observations:

- Contrary to expectations, the report is outside the White House’s “comfort zone.” That’s good, because, as noted, this group could easily have decided to ratify the status quo, handing the administration and the National Security Agency a minor victory. The report positioned Senate Judiciary Committee chairman Patrick Leahy (D-VT) to say: “The message to the NSA is now coming from every branch of government and from every corner of our nation: You have gone too far.”

- There is no reason to treat the report as a reform “bible.” This was a problem with the 9/11 Commission report, for example, which was held up as sacrosanct even when it was wrong. The Review Group report is right about some things, such as eliminating administratively issued National Security Letters, it is wrong about some things, and it omits some key issues, such as the government-wide penchant for secrecy that created the current problems.

- Weaknesses are more interesting than strengths, and a particular weakness of the report is its call for retaining the phone calling surveillance program. Recommendation Five calls for legislation that “terminates the storage of bulk telephony meta-data by the government under [USA-PATRIOT Act] section 215, and transitions as soon as reasonably possible to a system in which such meta-data is held instead either by private providers or by a private third party.” The debate over data retention mandates ended some years ago, and the government was denied this power. The NSA’s illegal excesses should not be rewarded by giving it authorities that public policy previously denied it. Outsourcing dragnet surveillance does not cure its constitutional and other ills.

- The data retention recommendation is in conflict with another part of the report, which calls for risk management and cost-benefit analysis. “The central task,” the report says, “is one of risk management.” So let’s discuss that: Gathering data about every phone call made in the United States and retaining it for years produces only tiny slivers of security benefit, the NSA’s unsupported claims to the contrary notwithstanding. Considering dollar costs alone, it almost certainly fails a cost-benefit test. If you include the privacy costs, the failure of this program to manage security risks effectively is more clear. The Review Group’s conclusion about communications surveillance is inconsistent with its welcome promotion of risk management.

Most legal scholars and most civil liberties and privacy advocates punt on security questions, conceding the existence of a significant threats, however undefined and amorphous. They disable themselves from arguing persuasively about what is “reasonable” for Fourth Amendment purposes. Concessions like these also prevent one from conducting valid risk management and cost-benefit analysis. Some of us here at Cato don’t shy from examining the security issues, and we do pretty darn good risk management. The Review Group should practice what it preaches if it’s going to preach what we practice!

The Defense of NSA Spying that Wasn’t

In an interview with CNN yesterday, outgoing FBI director Robert Mueller offered up words one could characterize as defending mass surveillance of all Americans’ phone calling. Indeed his interview has been portrayed as a defense of such spying, with outlets like NRO’s “The Corner” reporting “Outgoing FBI Chief: ‘Good Chance’ NSA Would Have Prevented ‘Part’ of 9/11.” But Director Mueller spoke much more equivocally than that.

Here’s what he actually said.

CNN: If we had the kind of intelligence that we were collecting through the NSA before September 11th, the kind of intelligence collection that we have now, do you think 9/11 would have been prevented?

MUELLER: I think there’s a good chance we would have prevented at least a part of 9/11. In other words, there were four planes. There were almost 20 — 19 persons involved. I think we would have had a much better chance of identifying those individuals who were contemplating that attack.

CNN: By this mass collection of information?

MUELLER: By the various programs that have been put in place since then. … It’s both the programs (under the Patriot Act) but also the ability to share the information that has made such dramatic change in our ability to identify and stop plots.

Mueller vaguely cited “various programs,” giving them a retroactive chance of preventing “a part of 9/11.” But even this defense of post-9/11 powers is insufficient.

In our 2006 paper, “Effective Counterterrorism and the Limited Role of Predictive Data Mining,” IBM scientist Jeff Jonas and I recounted the ease with which 9/11 attackers Khalid al-Mihdhar and Nawaf al-Hazmi could have been found had government investigators pursued them with alacrity. The 9/11 Commission said with respect to al-Mihdhar, “No one was looking for him.” Had they been caught and their associations examined, the 9/11 plot probably could have been rolled up. Sluggish investigation was a permissive factor in the 9/11 attacks, producing tragic results that nobody foresaw.

That absence of foresight is a twin with retrospective assessments like Mueller’s, which fail to account for the fact that nobody knew ahead of 9/11 what devastation might occur. Immediately after the 9/11 attacks, everybody knew what such an attack could cause, and everybody began responding to the problem of terrorism.

Would Patriot Act programs have prevented at least a part of 9/11? Almost certainly not, given pre-9/11 perceptions that terrorism was at the low end of threats to safety and security. A dozen years since 9/11, terrorism is again at the low end of threats to safety and security because of multiplicitous efforts worldwide and among all segments of society. It is not Patriot Act programs and certainly not mass domestic surveillance that make us safe. Even Mueller didn’t defend NSA spying.

In Its Bubble of Secrecy, the National Security Bureaucracy Redefined Privacy for Its Own Purposes

Rep. Jim Sensenbrenner (R-WI) is nothing if not a security hawk, and this weekend he decried the NSA’s collection of all Americans’ phone calling records in a Guardian post entitled, “This Abuse of the Patriot Act Must End.” On Thursday last week, he sent a letter to Attorney General Eric Holder demanding answers by Wednesday.

It also became apparent over the weekend that the National Security Agency’s program to collect records of every phone call made in the United States is not for the purpose of data mining. (A Wall Street Journal editorial entitled “Thank You for Data Mining” was not only wrong on the merits, but also misplaced.) Rather, the program seizes data about all of our telephone communications and stores that data so it can aid investigations of any American who comes under suspicion in the future.

Details of this program will continue to emerge–and perhaps new shocks. The self-disclosed leaker–currently holed up in a Hong Kong hotel room waiting to learn his fate–is fascinating to watch as he explains his thinking.

The court order requiring Verizon to turn over records of every call “on an ongoing daily basis” is a general warrant.

The Framers adopted the Fourth Amendment to the Constitution in order to bar general warrants. The Fourth Amendment requires warrants 1) to be based upon probable cause and 2) to particularly describe the place to be searched and the persons or things to be seized. The leaked warrant has neither of these qualities.

A warrant like this would never be adopted in an open court system. With arguments and decisions available to the public and appeals going to public courts, common sense and simple shame would foreclose suspicionless data-gathering about every American for the benefit of future potential investigations. 

Alas, many people don’t believe all that deeply in the Constitution and the rule of law when facile promises of national security are on offer. It is thus worthwhile to discuss whether this is unconstitutional law enforcement and security practice would work. President Obama said last week, “I welcome this debate and I think it’s healthy for our democracy.”

FBI’s New Guidelines Further Loosen Constraints on Monitoring

The New York Times’s Charlie Savage reports that the FBI is preparing to release a new Domestic Investigations and Operations Guide (DIOG), further relaxing the rules governing the Bureau’s investigation of Americans who are not suspected of any wrongdoing.

This comes just three years after the last major revision of FBI manual, which empowered agents to employ a broad range of investigative techniques in exploratory “assessments” of citizens or domestic groups, even in the absence of allegations or evidence of wrongdoing, which are needed to open an “investigation.” The FBI assured Congress that it would conduct intensive training, and test agents to ensure that they understood the limits of the new authority—but the Inspector General found irregularities suggestive of widespread cheating on those tests.

Agents can already do quite a bit even without opening an “assessment”: They can consult the government’s own massive (and ever-growing) databases, or search the public Internet for “open source” intelligence. If, however, they want to start digging through state and local law enforcement records, or plumb the vast quantities of information held by commercial data aggregators like LexisNexis or Acxiom, they currently do have to open an assessment. Again, that doesn’t mean they’ve got to have evidence—or even an allegation—that their target is doing anything illegal, but it does mean they’ve got to create a paper trail and identify a legitimate purpose for their inquiries. That’s not much of a limitation, to be sure, but it does provide a strong deterrent to casual misuse of those databases for personal reasons. That paper trail means an agent who might be tempted to use government resources for personal ends—to check up on an ex or a new neighbor—has good reason to think twice.

Removing that check means there will be a lot more digging around in databases without any formal record of why. Even though most of those searches will be legitimate, that makes the abuses more likely to get lost in the crowd. Indeed, a series of reports by the Inspector General’s Office finding “widespread and serious misuse” of National Security Letters, noted that lax recordkeeping made it extremely difficult to accurately gauge the seriousness of the abuses or their true extent—and, of course, to hold the responsible parties accountable. Moreover, the most recent of those reports strongly suggests that agents engaged in illegal use of so-called “exigent letters” resisted the introduction of new records systems precisely because they knew (or at least suspected) their methods weren’t quite kosher.

The new rules will also permit agents to rifle through a person’s garbage when conducting an “assessment” of someone they’d like to recruit as an informant or mole. The reason, according to the Times, is that “they want the ability to use information found in a subject’s trash to put pressure on that person to assist the government in the investigation of others.” Not keen into being dragooned into FBI service? Hope you don’t have anything embarrassing in your dumpster! Physical surveillance squads can only be assigned to a target once, for a limited time, in the course of an assessment under the current rules—that limit, too, falls by the wayside in the revised DIOG.

The Bureau characterizes the latest round of changes as “tweaks” to the most recent revisions. That probably understates the significance of some of the changes, but one reason it’s worrying to see another bundle of revisions so soon after the last overhaul is precisely that it’s awfully easy to slip a big aggregate change under the radar by breaking it up into a series of “tweaks.”

We’ve seen such a move already with respect to National Security Letters, which enable access to a wide array of sensitive financial, phone, and Internet records without a court order—as long as the information is deemed relevant to an “authorized investigation.” When Congress massively expanded the scope of these tools under the USA Patriot Act, legislators understood that to mean full investigations, which must be based on “specific facts” suggesting that a crime is being committed or that a threat to national security exists. Just two years later, the Attorney General’s guidelines were quietly changed to permit the use of NSLs during “preliminary” investigations, which need not meet that standard. Soon, more than half of the NSLs issued each year were used for such preliminary inquiries (though they aren’t available for mere “assessments”… yet).

The FBI, of course, prefers to emphasize all the restrictions that remain in place. We’ll probably have to wait a year or two to see which of those get “tweaked” away next.

Patriot Act Extension Runs Into Conservative Opposition

Reports the Los Angeles Times:

A House GOP push to permanently extend expiring provisions of the Patriot Act is running into opposition from conservative and “tea party”-inspired lawmakers wary of the law’s reach into private affairs.

Congress has made a practice of kicking the Patriot Act can down the road, but it could be that the new crop of legislators isn’t inclined to go along.

Julian Sanchez has blogged here about the complexities of this government surveillance law. His podcast on the topic, released yesterday, is titled “The Patriot Act Sneaks to Renewal.” Maybe it can’t sneak through after all…

Good News and Bad on PATRIOT Reform

Late last week, Attorney General Eric Holder sent a letter to Senate Judiciary Committee Chair Patrick Leahy (D-VT) in which he agreed to implement an array of policies designed to check abuse of USA PATRIOT Act powers. These include more thorough record keeping and more disclosures to Congress, prompt notification of telecommunications companies when gag orders have expired, and updated retention and dissemination procedures to govern the vast quantities of information obtained using National Security Letters.

In itself, this is all to the good. But civil libertarians should pause before popping the champagne corks. Last year, the fight over the reauthorization of several expiring PATRIOT provisions opened the door to the comprehensive reform that sweeping legislation sorely needs to better balance the legitimate needs of intelligence and law enforcement against the privacy and freedom of Americans. Despite serious abuses of PATRIOT powers uncovered by the Justice Department’s Office of the Inspector General, no such major changes were made. Instead, Congress opted for a shorter-term renewal that will require another reauthorization this February—in theory allowing for the question of broader reform to be revisited in the coming months.

Many of the milder reforms proposed during the last reauthorization debate now appear to have been voluntarily adopted by Holder. Unfortunately, this may make it politically easier for legislators to push ahead with a straight reauthorization that avoids locking in those reforms via binding statutory language—and entirely bypasses the vital discussion we should be having about a more comprehensive overhaul. If that happens, it will serve to confirm the thesis of Chris Mooney’s 2004 piece in Legal Affairs, which persuasively argued that “sunset” provisions, far from serving as an effective check on expansion of government power, often make radical “temporary” measures more politically palatable, only to create a kind of policy inertia that makes it highly unlikely those measures will ever be allowed to expire.

With the loss of Sen. Russ Feingold (D-WI), who whatever his other faults has been the Senate’s most vocal opponent of our metastasizing surveillance state, the prospects for placing more than cosmetic limits on the sweeping powers granted since 2001 appear to have dimmed. If there’s any cause for optimism, it’s that the recent fuss over intrusive TSA screening procedures appear to have reminded some conservatives that they used to believe in limits on government power even when that power was deployed in the name of fighting terrorism.

The Census Meets the Patriot Act

The Washington Post reports that the Justice Department recently sent out a letter to the chairs of the Asian Pacific, black, and Hispanic caucuses in Congress, reassuring them that the Patriot Act’s expansion of information-gathering powers, including the controversial Section 215, does not override federal statutes guaranteeing the confidentiality of census data.  DOJ’s view, according to Assistant Attorney General Ronald Weich, is that “if Congress intended to override these protections, it would say so clearly and explicitly.”

Section 215, recall, is colloquially referred to as the “business records” provision of Patriot, though in fact it permits investigators to obtain “any tangible thing” from a designated person or entity by obtaining an order from the secret FISA court, subject only to a showing that the records sought are “relevant” to a national security investigation. As Weich observes, §215 does not contain the “notwithstanding any other law” language present in other parts of the Foreign Intelligence Surveillance Act, which means that it cannot be presumed on face to override other federal privacy statues establishing a higher degree of protection for specific categories of sensitive records. 

What’s interesting to me, however, is that a similar issue arose several years ago, not with respect to the census confidentiality statute, but rather the Family Educational Rights and Privacy Act (aka FERPA, aka the Buckley Amendment). Initially, DOJ attorneys similarly opted not to seek education records under §215 on the grounds that the FISA court might conclude FERPA trumped Patriot in the absence of language giving §215 explicit priority, as the Office of the Inspector General’s initial report on the use of §215 explains. Nevertheless, the Counsel for Intelligence Policy told OIG that his office “would have been willing to present an application to the FISA court for educational records if the FBI considered the information important enough and wanted to press the issue with the FISA Court.” 

Subsequent amendments to the statute alleviated those concerns:

According to [National Secrity Law Branch] and [Office of Intelligence Policy and Review] attorneys, this legal impediment to obtaining educational records has been addressed.  Section 106(a)(2) of the Reauthorization Act amended FISA by ading 50 U.S.C. §1861(a)(3), which specifically addresses educational, medical, tax and other sensitive categories of business records.  The amendment provided that when the FBI is requesting such items, the request must be personally approved by the FBI Director, the FBI Deputy Director, or the Executive Assistant Director for National Security. According to several NSLB and OPPR attorneys we interviewed, because this provision clarifies that educational records are obtainable through the use of a Section 215 order, the non-disclosure provisions of Section 215 apply rather than the notification provisions of the Buckley Amendment.

Census records, of course, are not mentioned, and the statutory language protecting those records from legal process is unusually strong and unqualified. On the other hand, neither does the amended language explicitly override the federal statutes protecting the specified categories of records. Rather, it adds a layer of oversight for several types of requests that are implied to fall within the scope of §215. Indeed, at the time, this portion of the Reauthorization Act was publicly portrayed as increasing protections for sensitive records.

That, at any rate, was the spin the Congressional Research Service gave it. Based on OIG’s account, it sounds as though a reform that had been painted as a concession to civil libertarians actually allowed the acquisition of those sensitive records for the first time, since they’d previously been regarded as off-limits by statute. So I suppose we should be glad they didn’t decide to simultaneously “enhance” the safeguards on census records.

Of course, that doesn’t mean it’s necessarily impossible for those records to ever be obtained via a §215 order. As Weich’s letter clearly says, the Census Act prohibits “the Commerce Secretary and other covered individuals from disclosing protected census information.” But as the Supreme Court clarified in St. Regis Paper v. United States, that confidentiality requirement is only binding on specific covered individuals.  If the government is able to get its hands on a copy of a census record by serving some non-covered individual, the record itself is not off limits.

Since I know approximately nothing about the fine points of record handling protocol within the Census Bureau, I can’t really say how much of a practical difference that makes. Still, given that we’ve seen statutory records protections effectively stripped away under the guise of enhancing those protections, I think it’s reasonable to infer that census records will be considered fair game under §215 if they can be obtained from a source other than the designated officials.