FISA Reauthorization Act, 4th Amendment, Privacy, Personal Rights, Secrecy, National Security, mass surveillance

::::::::

Minimizing the 4th Amendment and Privacy through the Primacy of National Security

Commentary on Section 702 and the FISA Reauthorization Act

by Thomas Drake, @thomas_drake1

This week the US Senate voted to suppress and severely curtail debate or the inclusion of any amendments to Section 702 and the FISA Reauthorization Act bill (S. 139) through a cloture vote of 60-38, paving the way for a vote in favor of passing the full bill that was already passed by the House of Representatives.

My fellow NSA whistleblower, Diane Roark (the former House Intelligence Committee professional staffer who had oversight of NSA for 5 years), wrote an article on 17 Jan 2018 about this cloture vote and what it means, weighing in on the kabuki props and information operation cover lies blanketing Section 702 and the FISA Reauthorization Act bill now cleared for a final vote by the Senate.

click here

In addition, independent investigative journalist Marcy Wheeler (@emptywheel) has diligently followed the FISA trail in great detail for many years. She has scooped many main stream media reporters (often never giving her credit for her work) and is arguably the best single press source for how FISA has radically changed (and is secretly reinterpreted by the government), since the stunning revelations about the mass surveillance programs began to emerge in public starting in late 2005 and 2006. You can read her investigative articles and analysis at her website.

.emptywheel.net

In the following article, she strips the veneer off the bait and switch of the FISA Reauthorization Act bill passed by the House of Representatives just before the Senate cloture vote was made.

click here

In terms of history, Section 702 of the Foreign Intelligence Surveillance Act of 1978 Amendments Act (FISA-AA) further enabled the legalization of pernicious and pervasive mass surveillance practices that licensed the secret backdoor warrantless searches and data mining of US person calls, emails, texts and other Internet and digital communications under the cover and color of spying on foreign targets.

As background, I blew the whistle right after 9/11 while a senior executive at the NSA on the original mass domestic warrantless electronic surveillance program known as STELLARWIND (authorized by President Bush), and its secret subversion of FISA and privacy rights protected by the Constitution and paid a very high price for doing so. This FISA Reauthorization Act bill just further codifies and expands the mass surveillance regime under the guise of protecting people by stripping their privacy protections.

National security does not trump our inalienable rights as a people, especially when the government want to 'collect it all to know it all' and bypass the rule of law for secret executive rules to keep us safe from ourselves using legislative acts to make it all legal.

In this article, I thought I would provide some additional context for the FISA Amendments Act that was first signed into law in 2008, renewed without any changes in 2012, and now up for reauthorization and expansion in 2018 through 2023.

The majority of Americans accept the fact that intelligence agencies like the NSA have a duty to safeguard national security, provide foreign intelligence that informs the government and bring to light threats against American citizens and US Persons protected by the Constitution.

However, there is a big difference between taking the steps necessary to achieve these objectives (while providing legitimate protection), and taking a different set of steps that broadly collect data against Americans (and others, including non-Americans and US Persons), with no affiliation to terrorists or other criminal elements, without probable cause and without consent.

In addition, it's probably fair to assume that the majority of American people (even if silent) expect the NSA to practice and uphold US laws and the Constitution at all times (including the 4th Amendment), even when dealing with information from inside the US. In the past, National Security Directives like USSID 18 provided NSA with understandable, detailed and explicit recipe-like guidelines and procedures on the probable cause surveillance of US citizens and US Persons in relation to foreign intelligence and conducted in compliance with FISA, US law and the Constitution (as a result of willful violations and abuses of national security powers in the past against citizens like Operation Shamrock and Minaret at NSA, FBI's notorious COINTELPRO and several others).

Over the years since 9/11, a number of disclosures made by whistleblowers and in press reporting (and more recently with the revelations of Edward Snowden), strongly suggest that NSA has repeatedly violated the 4th Amendment, governing statutes and broken the law on a broad scale through programs and operations involving secret mass and bulk surveillance programs (both metadata and content) that includes domestic data on Americans. Consequently, NSA has eroded the trust and the larger government social contract between itself and the very citizens and people it is chartered to protect and serve in the national interest.

However, the secretive nature of NSA (and a largely ineffectual oversight system), have precluded an effective accounting of NSA's 'deep state' mass surveillance activities. We simply do not know to this very day the full scale, scope and extent of NSA's violations with regard to surveillance laws and the Constitution or even the range and reach of these programs (many still remain hidden and buried under various 'secret' authorities) -- although the Snowden disclosures (and earlier disclosures by former NSA whistleblowers, including myself) have provided clear and compelling evidence that NSA has gone far beyond its core mission.

Even the US courts are divided, given the extreme secrecy in how these programs actually work. One federal judge (Leon) earlier said that the bulk collection of telephone records was probably unconstitutional. Another judge (Pauley) said that the collection of these records was legal. And yet there is a huge difference between what is 'legal' and what is lawful and constitutional.

While the debates on NSA surveillance and privacy rights continue, the government has done a very poor job of assuring the American people that their privacy expectations and rights, as guaranteed by the Constitution, are met. Several members of Congress, journalists and privacy rights and liberty advocates question the effectiveness of the surveillance oversight 'legal' regime and framework (much of it ex post facto) and call for a strengthening of oversight mechanisms and reforms of the FISA-AA (most recently the USA Rights Act bill that failed in the House of Representatives) -- with a focus on the fact that current oversight mechanisms are increasingly ineffective and nullified and cannot prevent an abuse of surveillance powers.

Former President Obama's gathering of high tech leaders, the earlier NSA review group, and even the Privacy and Civil Liberties Oversight Board's earlier reviews of surveillance activities and programs were clearly a response to this outcry -- all triggered primarily by the Snowden disclosures on top of earlier surveillance revelations in the press, but much still remains hidden behind the veil of secrecy, executive-enabled state secrets privilege plus the use of yet 'other' authorities that remain in the 'deeper state' shadows, out of sight and largely opaque to any light.

Additionally, both the Obama and the Trump Administrations have fundamentally failed to justify NSA's vast electronic and often pervasively indiscriminate dragnet of people's data (and in partnership/complicity with large telcos/telecoms) and this mass dragnet's impact and influence on people's privacy rights. Its hollow assertions and appearances of legal compliance are characterized and colored by ambitious and authoritarian control language (and gratuitous fear mongering) as opposed to real legal opinion, except when the 'legal' opinion serves as a cloak and cover for those following orders when exposed.

However, America's credibility and standing as a nation respecting privacy rights at home and abroad has also been severely undermined not only in the United States, but overseas as well and will continue to erode until a full, complete and independent accounting of mass surveillance is made. Surveillance abuses must be brought to light, corrected and held accountable.

In addition, the debate we are still having today was so avoidable and unnecessary if NSA had not rejected approaches that provided safeguards over citizen and people's privacy rights with the very best of American ingenuity and innovation, while lawfully and legitimately providing superior intelligence and warning against actual threats to the US and the world.

In truth, the NSA has a history of violating the law too many times over approximately 60% of its existence -- an Agency literally created by the stroke of a presidential pen in secret under the Truman Administration in 1952 -- forming a very secret military organization not legislated into law with the mandate to collect foreign signals intelligence as a technical collection agency.

In writing this article, I was reminded of a memo circulated by NSA during the Presidential Transition Team in late 2000 seeking relief on the 4th Amendment probable cause standard with the excuse it was just too hard to follow in the digital age. And then 9/11 happened.

And right after 9/11, the Constitution and the 4th Amendment -- the very bedrock of the US as a Republic, was simply and quickly abandoned. NSA (with the approval of the White House) in the deepest of state secrecy, tossed aside the Constitution, the 4th Amendment and the FISA -- rendering all essentially null and void.

9/11 was an utter failure to keep people out of harm's way and the subsequent fear mongering and the sky is falling calls became the tragic excuse to use national security as the siren license and imprimatur to erode our liberties and personal rights in order to make people feel safe again. And yet the US government had the technology created by the very best of American ingenuity and innovation to counterpunch real threats (and analyze their networks through all source intelligence), far more effectively and for far less cost, (and all constitutional and in compliance with the 9/10 version of FISA). Instead they deliberately rejected them in favor of big multi-billion dollar programs, big data scooping and extraction techniques and authorized secret mass surveillance programs on a truly vast and extraordinary scale -- turning the US into the equivalent of a foreign nation for the pervasive warrantless seizing and searching of data using the mantra that the bigger the haystack the more needles it could find.

NSA believed that the ends justified the means - losing its moral moorings in the process (and not just its legal and constitutional foundations), in its obsessive quest to collect everything in order "to know everything" by building a surveillance system the likes the world had never seen -- in concert with partners (both nation state and corporate including telcos and telecoms) generating this hoarding complex of a huge "haystack of needles" -- highly misleading since the needles are supposed to identify the bad guys and the rest of the hay are the good guys -- but instead all individual straws in the hay are viewed as potential needles under this way of illogical thinking.

In the end, they did not want to bother with particularized court warrants and dropped automated tracking that would reveal improper or even unlawful government use of any data unlawfully collected -- they just wanted the data because exigent emergency conditions applied in the post 9/11 world.

Now 16+ years have passed since that fateful day of 11 Sep 2001 and the government intends to continue these unconstitutional and citizen eroding (albeit legalized) programs indefinitely, even if by other 'extra-legal' means to satisfy the ends of collection and surveillance in service to national security and other purposes.

The FISA-AA does not require the government to identify targets of their surveillance -- thus creating pre-emptive conditions (a predicate) for mass surveillance. Surveillance and data selection are not targeted, but are done dragnet style -- and not on individual or particularized "probable cause" suspicion but on "reasonable articulable suspicion" -- just mere suspicion or simply relevance for supporting national security intelligence purposes.

Furthermore, under the FISA-AA, the Foreign Intelligence Surveillance Court (FISC) can effectively interpret the Constitution in secret, instead of relying on US District, Appeals and Supreme Court review.

In addition, under Section 702 of the FISA-AA, the warrantless acquisition of communications is authorized (including US communications), when at least one party to the message is overseas and the target (the person or entity about which the government wants information), is a non-US person/entity labeled and declared foreign. But when intelligence officials describe the law, they don't say this and instead they say that the law allows them to target non-US persons reasonably believed to be abroad in order to collect foreign intelligence information. This encourages the false belief that only non-citizens fall under the Section 702 intelligence collection. People who know better are using very carefully chosen language to imply that Section 702 is legal with respect to Americans because it ostensibly has nothing to do with Americans (non-foreign) and that if Americans are affected, it is only rarely and accidental (or incidental) when it happens.

However, thanks to Snowden, we can no longer pretend that the Emperor of electronic surveillance is actually wearing clothes. A culture of kabuki dance enabling act 'legal' compliance still breaks the law as defined by the Constitution and the 4th Amendment. While section 702 does require a non-US entity as the designated target of surveillance, anyone who communicates with agents of the target, or has foreign intelligence information about the target is also subject to monitoring. Think of the myriad of examples of an American in the US communicating with somebody or some entity that is foreign (separate from the various ways electronic networks carry information irrespective of borders).

So, under Section 702 of the FISA-AA law, the government may warrantlessly acquire Americans' foreign to foreign or one-end of US communications to, from or about the target and warrantlessly acquire Americans' domestic communications, so long as the acquisition was unintentional.

However, it is important to point out that according to an earlier declassified 2011 FISA court opinion by Judge John Bates, the NSA obtained approximately 250 million communications under Section 702 that year alone. And a very large percentage of those messages, some 90+%, came from service providers like Google, Yahoo and Microsoft, via PRISM, with the remainder of the communications vacuumed off the fiber optic backbone of the Internet (otherwise known as upstream collection).

It is also important to point out at this point that when conducting upstream collection, NSA's collection/access systems are not restricted to just pulling single messages. These systems regularly and routinely capture what the NSA calls Internet transactions. However, an Internet transaction can comprise a single message called an SCT (Single Communication Transaction) in NSA-speak. However, Internet transactions also often contain multiple messages and the NSA refers to this bundle of messages as an "MCT" or Multiple Communications Transaction. So even if only one message in an MCT falls within this the NSA targeting term parameter, the NSA collection and access mechanisms pulls the entire package of messages.

Furthermore, MCTs can contain messages that have nothing to do with foreigners or foreign intelligence. In fact, let me point out that NSA's own internal auditing at the direction of Judge Bates that was earlier made public, places the number of improperly collected and wholly domestic US messages at approximately 56,000 for that year alone.

Therefore, US Person communications with targets overseas are subject to warrantless interception. Once those communications are collected, current rules allow the US government (including the FBI) to search this veritable treasure trove of US Person identifiers -- a decidedly 'seize all first, then search broadly later approach' that violates the individual/particularized standard under the 4th Amendment of person, place and thing.

Senator Ron Wyden (the warrant canary of the Senate on their Intelligence Committee) has called this 'approach' the backdoor search loophole. In addition, the non-US targets include the population of all US citizens, not just those who are agents of foreign powers. While analysts operate under the proviso of searching under a foreign intelligence purpose when selecting the target, the rationale is just one short sentence. This means that the collection and access in satisfying the 'end' of intelligence purposes sweeps up far more than just the targeted intelligence (the main reason given for 702 in the first place against foreign targets) and is therefore very much a wildcard that gives new meaning to incidental and accidental collection with respect to the definition of a target (a target that now encompasses and circumscribes populations of people and entities, not just a single foreign person or entity (the thing).

This convenient rationale serves as an exercise in cover and concealment for the real targeting focus when used as an explanatory justification to the oversight mechanisms as given by the Justice Department and the office of the Director of National Intelligence when NSA implements these Section 702 authorities under the FISA-AA. Under this rationale, intelligence analysts get to 'explain' their targeting decisions without providing any additional information regarding why.

These analysts are also not required to provide the evidence on which they base their "reasonable articulable suspicion" that a target will produce valid foreign intelligence. They also do not have to reveal or disclose the "selectors" (another word for search terms and parameters in term of the thing to seize) that they plan to use, and they can even strip out the details and substitute them with generic descriptions.

By effectively untethering the surveillance activities involving collection and access from the very facilities and communication means that a foreign target uses, the FISA-AA significantly incentivizes the NSA in obtaining data information about a target facility rather than just to or from info and data on the target as a person.

What am I saying? Section 702 of the FISA-AA directly endangers US Person privacy even more. Any number of individuals can intentionally get targeted as a result of a single FISA-AA authorization and need not have specific identifiers. Therefore, more Americans are likely to be monitored since an undefined and evolving list of individuals can show up as agents of approved targets, and those individuals may talk with yet other Americans.

In addition, no wrongdoing is required on the part of the target for surveillance to begin, and the target does not even have to qualify as an agent of a foreign power as it does under the traditional pre-9/11 FISA! With this approach, NSA can monitor any communications mechanism or facility, even if there is no connection to the target. This vastly expands the opportunities for so-called 'about' collection of communications between wholly innocent and suspicion-free people.

Furthermore, the government is not required to notify individuals incidentally or mistakenly monitored. And to date, it is also quite difficult to learn about any violations of the FISA-AA or even impose penalties for violating the FISA-AA. Minimization obligations under the FISA-AA are far weaker than even those under traditional FISA because the FISA court has less authority to authorize, implement and oversee compliance with the rules.

And under Section 702, there is no judicial review of the government's justification for the surveillance or even the identification of targets. In other words, Section 702 is a clear and compelling backdoor 'seize and search' loophole for electronic communications.

And at its core, Section 702 also permits licensing the NSA to collect the content of electronic communications without any individualized court order if the "target" of the communications is "reasonably believed" to be a foreigner overseas, and if a significant purpose of the surveillance is to acquire foreign intelligence information, although "reverse targeting" (the targeting of a U.S. person under the guise or pretext of targeting a foreigner) is expressly prohibited. However, Administration officials (and those in Congress) can get away with the facile assertion that they are technically correct in their repeated pronouncements that section 702 targets only foreigners and not Americans.

This characterization of foreign is one of the major reasons Americans have paid less attention to this surveillance program. It also explains the absence of any sustained pushback or outcry when officials describe Section 702 authorities as "clearly legal" because it is well settled in the US that non-citizens overseas are not entitled to the same level of protections afforded by the Fourth Amendment (leaving aside the privacy rights of citizens under other law and convention) afforded US citizens and US Persons (that include resident legal foreigners).

But there is much more to Section 702 than meets the eye. Notwithstanding the requirement of "targeting" foreigners, the program certainly enables a massive amount of collection of Americans' telephone calls, e-mails, Internet usage and other electronic communications. And even though the target must be a non-citizen (foreigner) under Section 702, programmatic surveillance under Section 702 sweeps up all international communications to, from, or about the foreign target. This includes communications coming into or out of the United States. Granted, the NSA may capture these calls and e-mails only if it intends to acquire foreign intelligence information, but the FISA-AA defines this term so broadly as any information relevant to the foreign interests of the United States. In other words, this wide-open barn door loophole permits the capture of almost all communications between Americans and their friends, colleagues, relatives, or even business associates overseas.

Interestingly enough, the NSA refers to this as 'incidental' collection, but there is nothing 'incidental' about it! As officials made clear during the debates leading up to the enactment of Section 702 of the FISA-AA, communications involving Americans were the most important!

But that is not all. Americans' communications are also collected by accident (called 'inadvertent' collection by NSA), to distinguish it from the 'incidental' collection that happens by design. In this guise, under Section 702, there is no need for the government to specify (let alone actually know) the identity of the person whose communications are intercepted. The government is supposed to employ FISA court-approved targeting procedures, which are then supposed to ensure that the target is "reasonably believed" to be a foreigner overseas.

But is that actually the case?

As a result of Edward Snowden's disclosures in the press, these procedures actually allow the NSA to "presume" that the target is a foreigner overseas as long as it has no specific information to the contrary! Other press reporting in the past also indicates that the NSA, in sifting through Internet traffic, employs search terms that are designed to achieve a "51% confidence" level in the target's 'foreignness'--just slightly better odds than a coin toss!

Between 'inadvertent' and 'incidental' collection, it is likely that Americans' communications make up a rather significant portion of the hundreds of billions of Internet transactions (and an undisclosed number of telephone and other electronic conversations) intercepted each year without a warrant or a formal showing of probable cause.

At first blush, this may seem to fly in the face of the Fourth Amendment. The current law, however, provides an apparent and convenient safeguard for compliancy to the procedures. Under Section 702, the NSA must adopt "minimization procedures" that are "reasonably designed . . . to minimize the acquisition and retention, and prohibit the dissemination, of nonpublicly available information concerning unconsenting United States persons."

But what does this actually mean?

Information about Americans may be kept and shared only under very narrow circumstances that includes information as evidence of a crime or that is necessary to understand foreign intelligence information. The full statutory logic is therefore defined as a programmatic effort to collect intelligence about foreign nationals, while the warrantless acquisition of information about US persons is then inevitable, but kept to a minimum. Moreover, when such warrantless acquisition does occur, the information that relates to US persons is ostensibly kept separate, destroyed or masked unless it falls under certain delineated exceptions.

But again, here is where the backdoor search loophole shows up! In 2011, the NSA persuaded the FISA court to approve a new set of minimization procedures under which the government may use US Person identifiers (to include telephone numbers, e-mail accounts et al associated with Americans) as justification to search the Section 702 database for the communications of or about those individuals. But remember again that the previous minimization requirements had expressly prohibited this practice!

What this licenses are the issuance of 'upstream collection' orders, permitting NSA to work with telcos/telecoms/ and Internet service providers to copy, scan and filter Internet and phone traffic coming from their physical infrastructure (an expanded definition of target). It also permits PRISM collection orders under Section 702 - directed at specific companies that compel the disclosure of the content of communications held by that company, with that magical 51% targeting threshold that it is foreign. In both instances, even if the communications are from or to an innocent American (a US Person) the communications are copied and stored in a searchable database (hence, once again, the seize first, search later collection mindset) and by those in the government the NSA authorizes the sharing of this data.

This is a general warrant equivalent and violates the dreaded 'writs of assistance' that were used against the colonists before the American Revolution and a huge reason why the colonists broke with King George III and led to the American Revolution.

So now the government can intentionally search for this information even though it's illegal under Section 702's "reverse targeting" prohibition against searching at the time of actual collection. But if not intentional, the magical search can begin. In addition, the government can use US Person identifiers to search the raw, un-minimized data. This means that minimization never actually takes place for those same US Persons!

We do not know the specific criteria by which the government decides which Americans are subject to these warrantless searches. However, the former NSA General Counsel Raj De did let slip (inadvertently?!) a previously undisclosed fact that when the government searches its pool of metadata for particular US Person information, there is no requirement that the government needs "reasonable articulable suspicion" of terrorist or criminal activity before searching the actual content of communications acquired under Section 702. In fact, it seems the only justification for the purpose of this kind of after the seizure search is merely the acquisition of foreign intelligence information.

Let's go back to the 51% 'foreignness' standard -- or as John Oliver once said it's "a coin flip plus 1 percent." It appears that NSA intentionally designed Section 702 so that it will regularly acquire information it is not expressly allowed to obtain! It means that NSA is accessing or seizing an enormous amount of electronic communications information it is simply not allowed to even possess under the very broadly defined plain text authorities of Section 702.

Another fundamental problem with Section 702 is that it authorizes targeting and monitoring of average citizens of other countries for reasons that are not necessarily related to the security of the United States. Targets are defined as non-US persons, and that means the entire set of their communications (wherever they originate and transit) are fair game.

This blatant disregard for other people's privacy is by design. Not only does it violate international human rights principles but it also impacts American business interests and foreign policy. And remember that safeguards under the traditional pre-9/11 FISA, limited US Person targets in relation to foreign powers or agents of foreign powers. And yet the government continues to hide the fact that Americans' communications are swept up in Section 702 under this 'about' the foreign target collection.

Back door searches should require at least a warrant. Outside of Section 702, the government would not have access to this information concerning Americans without complying with the express requirements of a 4^th Amendment standard warrant, and it avoids those protections to simply engage in wholesale dragnet surveillance under the blanket of national security intelligence purposes opening up a huge door for parallel construction (and reconstruction) - the use of the collected data for other purposes to include law enforcement -- another back door.

Minimization should at least meet the standard of the 4^th Amendment compliant traditional FISA. So now the invocation of collecting for national security and intelligence purposes takes primacy over rights, minimization or protection of privacy? This is no limitation whatsoever. The plain text laws compliant with the 4^th Amendment already require that NSA must have a foreign intelligence purpose at the time it collects the communications. Yet under Section 702, that hurdle is now pre-emptively cleared before the search ever takes place! More fundamentally, if a foreign intelligence purpose could justify monitoring Americans' communications without any individualized or particularized court order, there would be no need for targeting or minimization requirements under Section 702!

Let's be clear here. If the government wants to obtain foreign intelligence information about an American target, it cannot do so through programmatic mass surveillance, back dooring Section 702 and the FISA-AA, and in the process creating a staged kabuki dance that simply shrouds the surveillance in secrecy, and makes the exercise of adhering to the protection of the rights of citizens a decidedly hollow and one-sided privacide shell game that provides no protection or privacy under any of the shells.

We have now arrived at a very consequential fork in the road of the US Constitutional Republic where the government can sift through vast quantities of citizen and US Person electronic communications at will with little or no restraint - not withstanding yet other surveillance 'authorities' to 'collect' like National Security Letters, Administrative subpoenas, Executive Order 12333 and the then secret post 9/11 unitary interpretation that the executive has commander-in-chief powers in times of war -- even when war is undeclared and of indeterminate duration.

Maybe we are all just foreigners now and just the unwitting and un-consenting objects of this obsessive quest to collect it all in order to know it all, subject to the golden age of surveillance against us all?

The Senate vote to pass Section 702 and the FISA Reauthorization is upon us. If you cherish privacy and don't want Congress to hand the executive the power to continue wielding the sword of national security protected warrant-free surveillance, the pervasive monitoring of one-end domestic communications (including wholly domestic comms), what about searches, still secret unreviewable 'law', unreviewable justifications and back door loopholes (including Tor and VPN -- thank Marcy Wheeler of @emptywheel for this analysis), with secret technical assistance orders to bypass encryption, giving criminals more rights than suspicion-less people plus enabling the equivalent of pre-crime data fishing and trawling expeditions, I strongly urge you to stand up now and call 202-224-3121 and urge Senators to vote NO on this reauthorization bill, even at this late hour.

Authors Bio: