Isn't this second-to-last paragraph the nut of the issue though? It describes how things work under the FAA:
Section 702 of the FAA says surveillance may be authorized by the attorney general and director of national intelligence without prior approval by the secret Foreign Intelligence Surveillance Court, as long as minimization requirements and general procedures blessed by the court are followed.
If what they are doing is according to Section 702, then isn't the outrage what the law allows rather than what the NSA is doing according to it?
You have to read the FISA system in context. Surveillance under the Act is only authorized in cases where the 4th amendment doesn't apply and where no warrant would otherwise be required. Under those circumstances, it's not particularly outrageous to allow the AG or DNI to proceed without a FISA warrant under certain circumstances.
In fairness that's not very reassuring for the idea that an NSA analyst may decide to look at a U.S. citizen's traffic and then "whoops, let's minimize that".
I guess what I'm wondering is what are the supervisory controls that are put in place to catch and discipline an analyst who looks into warrant-required intercepts where it isn't a bona-fide innocent error? I.e. if you know the person is a citizen you shouldn't look at all (without getting a warrant), and if you don't know but find out in the middle of reading the data then you should stop and minimize immediately.
I can't so much as release a military member's pay transaction without having it looked at by a supervisor and eventually audited (likely by 2-3 different groups when it's all said and done). Are there similar supervisory controls in place here? Those would be good questions to ask to ensure that any such usage of the FISA is kept in line with the already quite-expansive spirit of the law.
All very fair points. I'm not sure if it's even possible to get the kind of necessary supervision. I'm just pointing out that the law isn't facially ridiculous, even if it might create structures that are practically unworkable.
I think we can get "good enough" supervision using a combination of even just widely-known management controls. Technical controls would add icing to that cake but I don't think it would even be technically necessary.
Much like with vaccination regimes we're trying to ensure that a critical mass of malicious analysts are not able to form, so you don't necessarily have to catch them all but you do have to catch enough to ensure no damaging conspiracies can form.
- Combine an evidence review process where an analyst's products are routed for minimize/warrant compliance to ensure the data is sourced properly.
- Ensure the supervisors are trained and maintain proficiency so as to be able to support those reviews.
- Have trained NSA analysts take a career path (or at the very least a detail) as auditors whose function is to audit usages of these collected records (both in the past and currently in-use). Require a supervisor of some level to override an audit hold on a current investigation, and have that override automatically emailed to designated personnel (the idea being to ensure that multiple unrelated persons get their hands dirty if malicious activity is going on).
These are all just examples, I'm those with more brains on human systems engineering could think of something more appropriate.
But the point is that, even as serious as this issue is, we're not talking about things like life or death, severe damage to property, people not getting paid, people improperly getting paid, or any of the numerous other pressure points a government can use to create a police state. So surely there are administrative controls that can be emplaced, if we must choose to do this, to get the benefit without the risk to the rise of a police state. In fact I think such a thing could even be itself publicly documented without affecting the real need of the NSA (and other IC agencies) to maintain absolute secrecy about their tactical operations and policies.
The NYT reported in 2009 that an analyst was disciplined for snooping through former President Clinton's email (or attempting to).
No, the nut is that Nadler asked Mueller about Patriot Act Sec. 215, but Clapper addressed the issue in terms of FAA 702. Tellingly.
EDIT: clarification, as all should be doing beforehand in light of the amount of misdirection possible on this topic. (I'm generally bouncing off of this, though: http://www.emptywheel.net/2013/06/17/james-clapper-throws-a-concentrated-nugget-of-orwellian-turd-splat/ http://www.emptywheel.net/2013/06/17/james-clapper-throws-a-...)
Nadler switched to talking about "listen[ing] to the phone," which is FAA 702, not 215. 215 is only for stored records and has not been used, as far as I can remember, for content. (BTW the exchange was with Mueller, not Clapper.)
You make a good point. There are a few different aspects worth separating here:
- First, oddly, we don't know what the law allows. The Obama administration's secret interpretation of FAA 702 and secret rulings they obtained from the FISC have not been made public. This is a continuation of the Bush-era penchant for secrecy that included a secret interpretation of the law to allow warrantless eavesdropping and torture. See the last page of: http://epic.org/FISC-NSA-domestic-surveillance.pdf/ http://epic.org/FISC-NSA-domestic-surveillance.pdf/
- Second, Congress would almost certainly not have approved the FAA (2008) if they had known that a single analyst has access to Americans' confidential email, phone records, etc. Same with the Patriot Act (2001) that is used obtain a general warrant to vacuum up Americans' phone records on an ongoing daily basis. And Snowden said today it's not just NSA, but FBI, DNI, CIA, etc. analysts. Read 702 and see if you think you can predict how it would have been secretly interpreted:
http://thomas.loc.gov/cgi-bin/bdquery/z?d110:h.r.06304 http://thomas.loc.gov/cgi-bin/bdquery/z?d110:h.r.06304:
- Third, U.S. intelligence officials have argued in the past that the president has the constitutional authority, no matter what the law says, to authorize domestic spying without warrants. So the wording of the law may no longer matter! See:
http://www.nytimes.com/2007/05/02/washington/02intel.html http://www.nytimes.com/2007/05/02/washington/02intel.html
Section 702 was written, and has been interpreted, to have very few restrictions.
1) It bars the NSA from collecting data on people unless "reasonably believed to be located outside the United States."[1] Data can be intentionally collected on any communication that has at least one foreign recipient or sender.[2] The wording of the warrants specifically contradict the fourth amendment, but as long as the target is "reasonably believed" to be a foreigner, it doesn't matter to the NSA.
2) The test of whether someone is located outside the US has been interpreted as a keyword-based system indicating that it is at least 51% likely. [3]
3) The NSA does not define "collection" as actually obtaining the data or metadata, but as a human analyst viewing the data.[4]
4) According to Snowden: "NSA likes to use "domestic" as a weasel word here for a number of reasons. The reality is that due to the FISA Amendments Act and its section 702 authorities, Americans’ communications are collected and viewed on a daily basis on the certification of an analyst rather than a warrant. They excuse this as "incidental" collection, but at the end of the day, someone at NSA still has the content of your communications." [5]
If they realize that it is actually an American, they have no obligation to delete the communications and will continue to store it indefinitely.
The NSA has been written a blank check to do whatever they want, existing checks and balances are simply insufficient. Whether that is due to their interpretation only breaking the spirit of the law (but not letter), or whether this is unconstitutional, is up for debate.
[1] FAA 702.g.1.B http://www.gpo.gov/fdsys/pkg/PLAW-110publ261/pdf/PLAW-110publ261.pdf http://www.gpo.gov/fdsys/pkg/PLAW-110publ261/pdf/PLAW-110pub...
[2] FAA 702.b.4
[3] http://www.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-internet-companies-in-broad-secret-program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story_2.html http://www.washingtonpost.com/investigations/us-intelligence...
[4] https://www.eff.org/nsa-spying/wordgames#collect https://www.eff.org/nsa-spying/wordgames#collect
[5] http://www.guardian.co.uk/world/2013/jun/17/edward-snowden-nsa-files-whistleblower http://www.guardian.co.uk/world/2013/jun/17/edward-snowden-n...
The administration told the Washington Post that they are in no way relying on interpretations of the word "collection", and that if they have the data, they have it, no matter whether or not analysts have looked at it.