The DNI's Non-Denial of Mass Surveillance of Americans

On Wednesday, news broke that the U.S. National Security Agency (NSA) had been routinely collecting all call metadata on every Verizon (and presumably other telco) customer for the past seven years. On Thursday, journalists reported that the NSA also has been operating a top secret program called Prism which allows it to directly access and copy the substance of our communications as they travel through most of the major internet company portals, including Google, Microsoft, Facebook, and Apple.  As of this writing, the companies have publicly denied participation in any program that gives the government direct access to their servers.  Their denial is strange, since some news outlets report that Administration officials have confirmed that Prism is real.

At this point, we don't exactly know what is going on. That is why we need public hearings on this scandal so that the American people can find out exactly what our government is doing. Congress should convene something like the Church Commission, which investigated illegal surveillance of civil rights and anti-war groups, to learn how the government conducts secret surveillance and what it does, if anything, to protect the privacy of American citizens.  

As this story continues to break, the public needs to understand more about the statutes that authorize secret government surveillance so that we aren't falsely reassured or hoodwinked. First, the government justifies its collection of call metadata using a 215 order, part of the Patriot Act, enacted at 50 USC 1861. Section 215 allows the FBI to obtain a FISA court order requiring businesses to product documents upon a statement of facts that there are "reasonable grounds to believe" that the things sought are "relevant to an authorized investigation" either to obtain foreign intelligence information not concerning a United States person or to "protect against international terrorism or clandestine intelligence activities". Its a court order, but its issued based on a very low standard, and allows little independent review by the FISA court.

Second, the Director of National Intelligence (DNI) referred to the Foreign Intelligence Surveillance Act (FISA) and the FISA Amendments Act (FAA) to justify Prism or Prism-like surveillance.  The complexity of FISA and the FAA allows to offer non-denial denials which are parrotted in news articles, but actually mask the truth. For example, on Thursday, DNI James Clapper issued a statement saying that Section 702 of FISA (part of the FAA) "cannot be used to intentionally target any U.S. citizen, any other U.S. person, or anyone located within the United States."  The target is the individual or entity about which the United States seeks information. No one is saying that the NSA is targetting U.S. persons.  Rather, the claim is that the NSA is intentionally monitoring Americans' communications. 

We have long been concerned that the FAA allows exactly the kind of mass surveillance detailed in the Prism slides.  That is because Section 1881a of the FAA created a new source of authority for surveillance targeting any “non-US person” reasonably believed to be located overseas. The Attorney General (AG) and the Director of National Intelligence (DNI) may jointly authorize surveillance under the FAA for up to one year via a certification to the Foreign Intelligence Surveillance Court (FISC), or in exigent circumstances. The FAA allows NSA surveillance of a foreign entity without requiring the agency to specify the people to be monitored or the facilities, places, premises, or property at which surveillance will be directed. The target can be any foreign entity, regardless of whether it is involved in terrorism or not.  And, the government can direct surveillance at any facility, even those on American soil, and monitor unspecified Americans’ international communications to or from suspected agents of the foreign entity, or even about that entity.

It is also misleading to call the collected communications "international".  That term leads a lot of people to believe that the NSA only uses the FAA to collect foreign to foreign messages that happen to transit through the United States.  Actually, the FAA only prohibits intentional acquisition of "any communication as to which the sender and all intended recipients are known at the time of the acquisition to be located in the United States".  50 USC 1881a.  So long as the NSA has reason to believe that one recipient of the message is in another country, FAA authorizes the monitoring. 

Now that we understand the statute, let's look at the DNI's statement issued yesterday.  My comments are interspersed. 

June 6, 2013: DNI Statement on Activities Authorized Under Section 702 of FISA
The Guardian and The Washington Post articles refer to collection of communications pursuant to Section 702 of the Foreign Intelligence Surveillance Act. They contain numerous inaccuracies.

• He isn't about to tell us what they are, though.

Section 702 is a provision of FISA that is designed to facilitate the acquisition of foreign intelligence information concerning non-U.S. persons located outside the United States.

• Section 702 of FISA is part of the FAA.  Foreign intelligence information need not include information about terrorism or threats to U.S. security.  Rather, if the information is about a foreign power and relates to the conduct of the foreign affairs of the United States, it is foreign intelligence information.  50 USC 1801. 

It cannot be used to intentionally target any U.S. citizen, any other U.S. person, or anyone located within the United States.

• When the DNI says that the NSA doesn't intentionally target Americans, that doesn't mean anything. We want to know if they are monitoring Americans.  On that front, Clapper may have already lied to Congress. He doesn't lie again here.  He just uses jargon to obfuscate. 

Activities authorized by Section 702 are subject to oversight by the Foreign Intelligence Surveillance Court, the Executive Branch, and Congress. They involve extensive procedures, specifically approved by the court, to ensure that only non-U.S. persons outside the U.S. are targeted, and that minimize the acquisition, retention and dissemination of incidentally acquired information about U.S. persons.

• Actually, minimization under the FAA is even weaker from the already troublesome minimization practices under traditional FISA.  Under the FAA, the applicable targeting and minimization procedures are subject to judicial review by the secret Foreign Intelligence Surveillance Court (FISC), but the court is not required to look behind the assertions made in the certification. Rather, if the certification and targeting and minimization procedures meet the statutory requirements and are consistent with the Fourth Amendment, the FISC will issue an order approving the surveillance.  Under traditional FISA, the FISC has a greater role in sculpting the minimization procedures for the specific case. 
• Even under FISA, however, minimization practices generally permit acquisition of nearly all information from a monitored facility.  Kris & Wilson, National Security Investigations and Prosecutions 2d §9:4 (2012) [Author David Kris was formerly the Department of Justice’s head of national security.]  In other words, "in practice FISA surveillance devices are normally left on continuously, and the minimization occurs in the process of indexing and logging the pertinent communications." 

Section 702 was recently reauthorized by Congress after extensive hearings and debate. Information collected under this program is among the most important and valuable foreign intelligence information we collect, and is used to protect our nation from a wide variety of threats.

• The information being collected is not limited to information about threats.

The unauthorized disclosure of information about this important and entirely legal program is reprehensible and risks important protections for the security of Americans.

• No comment

In the next days and weeks, hopefully more information will be available and Congress will call for an investigation.  I'm grateful to the journalists who have broken this story and to the source or sources who took steps at great personal risk to themselves to reveal to the public this complete failure of the government we entrusted with the power of secret surveillance to protect our rights.