Senators call for end to Justice Department's 'secret law'

Obama administration's secret interpretation of the Patriot Act allows it to vacuum up records on all Americans' phone calls. But an earlier effort to fix the law in December failed.

Sen. Ron Wyden has been saying for years that "the American people would be absolutely stunned" if they knew what kind of surveillance has been authorized by the Obama administration's secret Patriot Act interpretation

Obama administration's secret interpretation of the Patriot Act allows it to vacuum up records on all Americans' phone calls. But an earlier effort to fix the law in December failed.

Eight U.S. senators today seized on leaks from the National Security Agency to call for an end to a "secret law" that governs how intelligence agencies electronically spy on Americans.

Secret laws may seem like Kafkaesque jurisprudence borrowed from Soviet Russia, but last week's leak of a secret court order revealed the Obama administration has a secret interpretation of the Patriot Act that allows it to vacuum up logs of all domestic phone calls on a daily basis.

"It is impossible for the American people to have an informed public debate about laws that are interpreted, enforced, and adjudicated in complete secrecy," Sen. Ron Wyden, an Oregon Democrat and member of the Senate Intelligence committee, said in a statement. "When talking about the laws governing intelligence operations, the process has little to no transparency." Sen. Patrick Leahy, the head of the Judiciary committee, also signed on to today's request.

Wyden, along with senators Mark Udall (D-Colo.) and Rand Paul (R-Ky.), have warned for years of the problems with secret interpretations of the Patriot Act. A CNET article from 2011 quoted him as saying at the time: "I believe that the American people would be absolutely stunned" if they knew what was actually going on.

The secret order from U.S. District Judge Roger Vinson, who serves on the secret Foreign Intelligence Surveillance Court, wasdisclosed last week by the Guardian newspaper.

Vinson's order relies on Section 215 of the Patriot Act, 50 USC 1861, better known as the "business records" portion. It allows FBI agents to obtain any "tangible thing," including "books, records, papers, documents, and other items," a broad term that includes dumps from private-sector computer databases with limited judicial oversight -- and not what politicians ever envisioned when enacting the Patriot Act in October 2001.

The eight senators are trying again to enact legislation that would, in general, require decisions of the Foreign Intelligence Surveillance Court to be revealed to the public. It has loopholes, however, including allowing the attorney general to make a "determination that a decision may not be declassified" because of national security reasons.

It was offered -- unsuccessfully -- as an amendment in December 2012 during a debate over renewing the Foreign Intelligence Surveillance Act. The renewal, without the amendment attached, was approved by a vote of 73 to 23.

Separately, Google today asked Attorney General Eric Holder to lift a legal gag order that has prevented the company from revealing what information it's legally required to disclose to the feds.

Read more ...

Google to feds: Let us talk about government surveillance, please

Attorney General Eric Holder has prohibited tech companies from revealing what information they're legally required to disclose to the feds. Google wants to lift the gag orders.

Attorney General Eric Holder, shown here earlier today, has not permitted Google to disclose what information it is -- and isn't -- forced to turn over to the feds

Google today asked the U.S. government to lift a legal gag order and let it clear up speculation and erroneous reports about what information it's forced to turn over to the feds.

In an open letter to Attorney General Eric Holder and FBI Director Robert Mueller asking for "transparency," the Mountain View, Calif.-based company is effectively applying an unusual amount of public pressure to the Obama administration. President Obama has claimed to have"the most transparent administration in history," though critics have argued otherwise.

Google, Apple, Yahoo, Microsoft, Facebook, and other Internet companies were left reeling after a pair of articles last Thursday alleged that they provided the National Security Agency with "direct access" to their servers. By late Friday, however, CNET reported that was not true, and the Washington Post backtracked from its original story on PRISM. In an editorial today, the paper said the process met legal "standards" and was subject to "judicial review."

But for Silicon Valley companies that rely on user trust -- and are trying to usher in a future where more data is stored in the cloud -- even lingering misgivings over privacy are worth eliminating.

Today's letter, signed by David Drummond, Google's chief legal officer, asks for the right to disclose information about how many orders the company receives under the Foreign Intelligence Surveillance Act, and how broad they are. It says:

 Google has worked tremendously hard over the past 15 years to earn our users' trust. For example, we offer encryption across our services; we have hired some of the best security engineers in the world; and we have consistently pushed back on overly broad government requests for our users' data.

We have always made clear that we comply with valid legal requests. And last week, the director of national intelligence acknowledged that service providers have received Foreign Intelligence Surveillance Act (FISA) requests.

Assertions in the press that our compliance with these requests gives the U.S. government unfettered access to our users' data are simply untrue. However, government nondisclosure obligations regarding the number of FISA national security requests that Google receives, as well as the number of accounts covered by those requests, fuel that speculation.

We therefore ask you to help make it possible for Google to publish in our Transparency Report aggregate numbers of national security requests, including FISA disclosures -- in terms of both the number we receive and their scope. Google's numbers would clearly show that our compliance with these requests falls far short of the claims being made. Google has nothing to hide.

Google appreciates that you authorized the recent disclosure of general numbers for national security letters. There have been no adverse consequences arising from their publication, and in fact more companies are receiving your approval to do so as a result of Google's initiative. Transparency here will likewise serve the public interest without harming national security.

The Justice Department and the FBI did not immediately respond to a request for comment from CNET.

Google already releases many statistics about government surveillance as part of itstransparency report, including, as of March, information on secret National Security Letters sent by the FBI. But a source familiar with the situation said the company has not secured permission to disclose information about secret court orders.

James Clapper, the head of national intelligence, confirmed last week that the Internet companies were receiving legal orders sent to them "pursuant to Section 702 of the Foreign Intelligence Surveillance Act."

After the Foreign Intelligence Surveillance Court limited a Bush-era warrantless surveillance program's scope, Congress enacted the FISA Amendments Act, which established a new procedure for foreign surveillance.

That Section 702 procedure works like this: The Justice Department must demonstrate that its surveillance will not intentionally target anyone present in the United States or any American who's overseas. And the surveillance process must comply with the Fourth Amendment.

Section 702 also requires that the government obtain the secret Foreign Intelligence Surveillance Court's approval of "targeting" and "minimization" procedures, and that the court review the agencies' certification describing how proposed surveillance techniques will comply with the law. Judges must consider whether the targeting procedures are "reasonably designed" to exclude Americans and purely domestic surveillance.

A former government official who is intimately familiar with this process of data acquisition and spoke on condition of anonymity told CNET last week that the government delivers an order to obtain account details about someone who's specifically identified as a non-U.S. individual, with a specific finding that they're involved in an activity related to international terrorism. Both the contents of communications and metadata, such as information about who's talking to whom, can be requested.

Amnesty International and journalists launched a legal challenge to Section 702 (which is sometimes called 1881a, for its location in the law books). They argued their confidential communications with foreign correspondents would be intercepted under Section 702 in violation of the Fourth Amendment. But in February 2013, the U.S. Supreme Court rejected their challenge by a 5-4 vote, with Justice Samuel Alito writing that their allegations were too "speculative" and the Section 702 process is subject to ongoing "oversight" and "review."

Read more ...

NSA paid tech firms over Prism, says latest Snowden leak

Google, Facebook, Yahoo, and Microsoft all received money to cover costs related to surveillance requests, the UK's Guardian reports, citing documents provided by former contractor Edward Snowden.

 And the NSA worked to rejigger its 

Tech firms including Google, Facebook, Yahoo, and Microsoft received money from the National Security Agency to cover legal-compliance costs related to the NSA's Prism surveillance program, according to the latest Edward Snowden documents published by the UK's Guardian newspaper.

A 2011 ruling by the Foreign Intelligence Surveillance -- or FISA -- Court found unconstitutional the NSA's inability to collect foreign Internet data without also collecting domestic data. And the NSA worked to rejigger its systems to bring them in line with the law. (The 2011 ruling was released this week as the result of a Freedom of Information Act lawsuit by the Electronic Frontier Foundation.)

The Guardian says of the new Snowden documents:

An NSA newsletter entry, marked top secret and dated December 2012, discloses the huge costs [the NSA compliance effort] entailed. "Last year's problems resulted in multiple extensions to the certifications' expiration dates which cost millions of dollars for Prism providers to implement each successive extension -- costs covered by Special Source Operations," it says.

Special Source Operations, described by Snowden as the "crown jewel" of the NSA, handles all surveillance programs, such as Prism, that rely on "corporate partnerships" with telecoms and Internet providers to access communications data.

The Guardian says the revelation "raises new questions" about tech companies' relationships with the NSA. Yahoo and Microsoft, however, say, as they've been saying, that they're simply complying with the law.

"Microsoft only complies with court orders because it is legally ordered to, not because it is reimbursed for the work," a company spokesperson said. "We could have a more informed discussion of these issues if providers could share additional information, including aggregate statistics on the number of any national security orders they may receive."

The spokesperson also pointed to an item in an FAQ tied to Microsoft's 2012 Law Enforcement Requests Report:

Does Microsoft charge law enforcement for providing data and content?

Yes. Pursuant to the Electronic Communications Privacy Act, Microsoft is entitled to seek reimbursement for costs associated with compliance with a valid U.S. law enforcement request. We only charge U.S. law enforcement entities pursuant to industry rates and only in an attempt to recover some costs associated with the need to comply with U.S. legal demands. We do not, however, charge in emergency situations or in known child exploitation investigations.

Yahoo, for its part, said in a statement that "Federal law requires the US government to reimburse providers for costs incurred to respond to compulsory legal process imposed by the government. We have requested reimbursement consistent with this law."

Facebook told the Guardian it had "never received any compensation in connection with responding to a government data request."

And Google sent the following statement to the Guardian: "We await the US government's response to our petition to publish more national security request data, which will show that our compliance with American national security laws falls far short of the wild claims still being made in the press today."

All 4 firms are among the 63 companies, trade groups, and civil liberties groups that are signatories of a letter that calls on President Barack Obama and Congress to allow Internet and telecommunications companies to offermore details about US government requests for user information. And Google, Microsoft, and Yahoo are involved in individual efforts to win this right.

Suspicion over the involvement of tech firms in the Prism program were fired up by the initial reports about Prism in The Guardian andThe Washington Post, which said the NSA had "direct access" to company servers. CNET's Declan McCullagh subsequently reported that there was no evidence of wholesale access to company servers.

Update, August 24 at 8:41 a.m. PT: A Google spokesperson provided the following statement late Friday evening: "We have not joined Prism or any government surveillance programs. We do not provide any government with access to our systems and we provide user data to governments only in accordance with the law." The spokesperson also pointed to Google CEO Larry Page's June 7 blog post about Prism and Google's involvement with government requests for data, and to the company's open letter asking the government to let Google publish information on how many requests it receives.

Read more ...

NSA swept up thousands of U.S. e-mails as part of illegal program, ruling reveals

Newly released 2011 ruling by Foreign Intelligence Surveillance Court found NSA e-mail and data-collection program illegal and decried government's "substantial misrepresentation" of scope of NSA activities

Declan McCullagh

The U.S. government has released a secret court ruling from 2011 that found some surveillance conducted by the National Security Agency illegal and that estimated the NSA collected many thousands of "wholly domestic communications" between Americans.

The Electronic Frontier Foundation heralded as a "victory" Wednesday's release of the 86-page opinion by the Foreign Intelligence Surveillance Court (FISC), set up under the 1978 Foreign Intelligence Surveillance Act.

In a statement following the release of the court opinion, Director for National Intelligence James Clapper announced the establishment of a group that will review the United States' surveillance capabilities and issue a report by mid-December.

The group will assess "whether the U.S. employs its technical collection capabilities in a manner that optimally protects our national security...while appropriately accounting for other policy considerations, such as the risk of unauthorized disclosure and our need to maintain the public trust."

The court document, dated October 3, 2011, found some of the NSA's collections to be in breach of the Fourth Amendment, which protects against unreasonable searches and seizures.

It's not the first time the opinion has been released -- it was published in January, but the document was so heavily redacted it was impossible to read, bar a single sentence that offered nothing of value.

In the readable (albeit still heavily redacted) opinion, the court said it was "troubled" that government revelations had, for the third time in less than three years, uncovered a "substantial misrepresentation" of the scope of NSA data-collection programs involving Internet traffic.

The now-discontinued "upstream" program diverted large quantities of international data from fiber cables running in and out of the U.S. into a data center, where it could be stored and analyzed. 

Investigative reporting by ZDNet in June first detailed how fiber and telecommunications companies were ordered under law to allow vast amounts of data belonging to U.S. citizens and foreign nationals to be wiretapped. 

Realistically, the NSA was unable to filter out the communications of Americans speaking to other Americans.

According to NSA estimates, as many as 56,000 "wholly domestic communications" may have been acquired, and are being acquired, by the government agency per year.

The NSA acquires more than 250 million Internet communications each year under Section 702 of FISA, the document states. Most are obtained from Internet providers. The court opinion also says the NSA's upstream program constitutes only approximately 9 percent of the total Internet communications being acquired under Section 702.

On Tuesday, a report by The Wall Street Journal claimed the NSA could access as much as 75 percent of all U.S. Internet traffic.

"The exceptions to minimization requirements mean information gathered on Americans could be used in ordinary criminal investigations, according to rules approved" by the FISC, the Journal wrote.

One month after the FISC ruled the upstream program unconstitutional, the NSA adjusted its collection process to filter out wholly American traffic from international traffic. It also purged any domestic traffic that it received. 

"Contrary to the government's repeated assurances, [the] NSA had been routinely running [search] queries of the metadata using querying terms that did not meet the required standard for querying," the FISC opinion said.

The court concluded that this requirement had been "so frequently and systematically violated that it can fairly be said that this critical element of the overall [...] regime has never functioned effectively."

In a joint statement (PDF) issued late Wednesday, the NSA and the Office of the Director of National Intelligence said media reports based on the Journal's article "provide an inaccurate and misleading picture of NSA's collection programs."

"Press reports based on an article published in today's Wall Street Journal mischaracterize aspects of NSA's data collection activities conducted under Section 702 of the Foreign Intelligence Surveillance Act," the statement read. "The NSA does not sift through and have unfettered access to 75 percent of the United States' online communications."

Update, 10 p.m. PT: Adds statement from NSA about Wall Street Journal article.

Read more ...