FISA Court Rubberstamped NSA's Questionable Legal Theories To Grant It Expanded Surveillance Powers

from the well,-Congress-MIGHT-have-said,-'Collect-it-all'-if-it-only-knew-about-a dept

More documents have been yanked out of the NSA's hands, thanks to a New York Times FOIA lawsuit. The documents are from 2007, and they further detail the agency's warrantless surveillance program which swept up not only phone numbers but also email addresses and content. The program wasn't actually legal at the time it rolled out. It took the FISA Amendments Act of 2008 to codify this. In the meantime, the agency used interim legislation (2007's Protect America Act) and some hubris to enhance its haystacking business.

The previously-released FISA order from April of 2007 contains a rare moment of hesitation by a FISA judge (Roger Vinson), who didn't buy the NSA's arguments that a phone number or email address could be a "facility" in and of itself. Rather than use the standard definition of a "facility" -- that being a base of operations -- the NSA chose to read it as an impossible combination of noun and verb. An email address is a "facility" because it "facilitates communications." Vinson wasn't too impressed with this, or the fact that the application didn't contain much in the way of probable cause. As he noted, the NSA's intention was to collect both sets of data in bulk, far from the targeted surveillance it attempted to portray in its application.

The May 2007 order (also by Roger Vinson) shows that the NSA found a way to get its aims accomplished, despite Vinson's reluctance. A "new legal theory" was offered by the agency in an amended application and buttressed by Keith Alexander's declaration that it was all totally legal.

Unfortunately, the order doesn't detail the NSA's legal theory, or at least not in any visible way. Vinson's musings on the NSA's Plan B turns out to be a bunch of wasted typing. His declaration that on the "basis of facts submitted by the applicant, there is probable cause to believe that...:" is followed by four completely redacted pages.

Following that, Vinson authorizes the NSA's "roving, multipoint" surveillance, based on the opinion that Congress would have authorized that (and apparently pretty much anything else it may or may not have conceived of) considering the "Government's national security interests are so great." This rationale again. And again, presented by an agency whose livelihood depends on the depiction of security threats as perennially "great" and everlasting. Vinson also agreed to contact-chaining using these numbers and email addresses as selectors. As a remedy for possibly illegal surveillance, the FISA court offers nothing more than fixes after the fact.
This holding, albeit novel, is consistent with the overall statutory requirements; it requires the Government to report and provide appropriate justification to the Court; and it supplies the Government with a necessary degree of agility and flexibility in tracking the targeted foreign powers. This Court will be able to ultimately determine whether the electronic surveillance was proper.
The FISA court authorizes a rolling 21-day grace period to report on any new numbers/email addresses added to the NSA's collections, from which the FISA judges would determine whether sufficient probable cause exists to continue surveillance. Better than nothing, but still a three-week "free swim" for analysts.

One stipulation stands out, though.
Unconsented physical entry is not authorized to implement the electronic surveillance approved herein.
The NSA isn't known for physically tapping phones or planting bugs (at least not here in the US… and at least not to our knowledge at this point). It's a requirement that does the agency no harm. But the hypothetical question raised by this is: does "unconsented physical entry" cover things like the interception of US tech companies' products in order to insert backdoors and malware? It won't be discussed here because this only deals with the NSA's roving, targeted/bulk surveillance hybrid. But it's something to keep in mind for future document releases.

This order is also added the FBI to the NSA's surveillance CC: list.
Information that is not foreign intelligence information, but reasonably appears to be evidence of a crime that has been, is being, or is about to be committed, may be disseminated (including United States person identities) to the FBI and other appropriate federal law enforcement authorities, in accordance with 50 U.S.C. 1806(b), Executive Order No. 12333…
And so, the domestic surveillance that wasn't (this order -- and past ones -- draws a very clear line between foreign targets and known US persons) becomes a handy tool for domestic surveillance. As the court notes earlier in the order, because of where the communications and data are collected, there's no real way to separate US/non-US data without digging through the collection. When it's discovered, minimization procedures are to apply -- except, apparently, if it can hand the data/communications off to the FBI. (The CIA, on the other hand, gets everything, domestic or foreign, apparently only subject to the NSA's discretion.)

Again, this entire line of surveillance still hadn't been determined to be completely legal. It took the FISA Amendments Act to codify this particular program. Despite that, it was approved anyway, thanks to the NSA's willingness to explore as many legal theories as necessary in order to secure the FISA judge's approval.

That's the problem with these two orders. We don't get to see the NSA's legal wranglings. Those are redacted. And what is actually revealed doesn't explain much. The May 2007 order notes that the NSA's arguments are still on shaky ground and the earlier (and much longer) April order handles the entirety of the agency's legal discussions on its contact-chaining of unrelated "facilities" in a single paragraph.
In this case, the Government has also asked for specific authority to acquire certain electronic communications that relate to or refer to an e-mail [redacted] that is targeted for surveillance under this Order. For example, the Government argues that it should be allowed to acquire any e-mail communication that mentions a targeted e-mail [redacted] even though the communication is to and from other e-mail [redacted] not currently under electronic surveillance. After careful consideration of the Government's arguments, the Court holds that, in the limited and carefully considered circumstances described below, there is probable cause to believe that internet communications relating to a previously targeted e-mail [redacted] are themselves being sent and/or received by one of the targeted foreign powers, and thus those communications may be acquired by the NSA.
And there goes any hope that the collection would be targeted. Simply mentioning a targeted email in the body of an email message is enough "probable cause" for the FISA court, which goes on to note that it's perfectly OK (in the search for supporting probable cause) for the agency to read nearly any communication that crosses its desk, provided it's within a step or two of its selectors.

The NSA didn't get to where it is today overnight. It took a decade of legal wrangling and the steadfast assertion that the terrorist threat to the US is just as strong as it was September 10, 2001. With the assistance of obliging courts and sympathetic legislators, the NSA has become a data and communications behemoth, sucking in vast quantities of both from all over the world.

Filed Under: fisa, fisa court, fisc, nsa, surveillance


Reader Comments

Subscribe: RSS

View by: Time | Thread


  • icon
    That One Guy (profile), 3 Feb 2015 @ 12:08am

    And again, the FISA 'court' shows that when it comes to the NSA, it never says no, only 'Ask again later'.

    reply to this | link to this | view in chronology ]

  • icon
    Ninja (profile), 3 Feb 2015 @ 1:03am

    the steadfast assertion that the terrorist threat to the US is just as strong as it was September 10

    I'd say it's as strong as ever but much less probable in that scale despite the huge security holes the TSA provides.

    I explain: "as strong as ever" because such threat is the result of many years of poor Foreign Affairs/Diplomacy while trying to impose America in the rest of the world. This alone generates a lot of hatred and fuels extremism. The war on terror did nothing to mitigate this. Using soft power with very narrow military incursions would be a much proper response.

    Finally "much less probable" because 9/11 was preceded by many years of planning, organization, financial resources and access to explode-y material. Today the wannabe-terrorists will run into trouble on any of those parts or even multiple. The Boston thing was some half-assed pressure cooker bomb that hit a number of people not even close to 9/11.

    On the other side, each plane landed over threats, each public space closed over bomb suspicion, each little event costs hundreds of thousands to millions of dollars. All that is needed is a message on the Internet.

    So with one bigger attack they screwed the US in more than a trillion dollars (military expenses included), they stripped the Americans of their Constitutional rights and caused more innocent deaths than many 9/11 combined. They don't need any other large scale terror plot, they just need to keep fear alive and kicking with small plots and empty threats.

    reply to this | link to this | view in chronology ]

    • identicon
      Michael J. Evans, 3 Feb 2015 @ 1:58am

      Re:

      As I said shortly after the attacks; when I saw how America as a nation reacted.

      We blinked, they won. (They successfully instilled irrational /terror/.)

      Should some security improvements have been made (like cockpit doors, and passengers willing to rebel instead of flying off like cows to some random tropical non-extradition country)? Of course they should have; but we went further. We stripped our selves of freedom and dignity for no just end.

      The major almost-attacks since then have all been thwarted by an awakened public reacting to danger themselves.

      reply to this | link to this | view in chronology ]

  • identicon
    David, 3 Feb 2015 @ 2:15am

    When did Congress die and make FISA their heir?

    Following that, Vinson authorizes the NSA's "roving, multipoint" surveillance, based on the opinion that Congress would have authorized that (and apparently pretty much anything else it may or may not have conceived of) considering the "Government's national security interests are so great."

    Uh, there is no need to second-guess Congress. One can just ask. The FISA court is not authorized to replace Congress and rule in its stead.

    Since the FISA court clearly has lost sight about who is supposed to make the laws as opposed to ruling on the laws, it needs to get dissolved.

    They may be referring to Congress' authority as some sort of justification, but they don't accept it. Instead they consider themselved both maker and executor of the law.

    That they state "if we were Congress, we'd likely want $x" is hubris and irrelevant.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 3 Feb 2015 @ 2:36am

    "With the assistance of obliging courts..."

    I guess you could call FISC a "court".

    reply to this | link to this | view in chronology ]

    • icon
      That One Guy (profile), 3 Feb 2015 @ 3:54am

      Re:

      In the same way you could call a person on Halloween a monster because they happened to wear the costume of one.

      Calling it the FISA 'court' does a great disservice to actual courts, they're little more than rubber stamps in robes, just another branch of the NSA and other Intelligence agencies.

      reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 3 Feb 2015 @ 3:15am

    Maybe there's an outside chance this "roving, multipoint" wiretap ensared surveillance defender Karl Rove at multiple points (ha!) - if he has nothing to hide then it shouldn't be a problem right

    reply to this | link to this | view in chronology ]

  • icon
    Harim G.A. (profile), 3 Feb 2015 @ 4:07am

    Democracy?

    "Information that is not foreign intelligence information, but reasonably appears to be evidence of a crime that has been (past), is being (present), or is about to be (future) committed, may be disseminated (including United States person identities) to the FBI.."

    Don't forget how the government apparatus cleverly defines "reasonable" to be anything without reason.. It is clear that these agencies don't really care about stopping "terrorists".. It is all a matter of control to them.

    If they know every detail about an individuals life they falsely believe that they can control said individual.. Sadly, that "individual" just happens to be society at large.

    America is not safe while these agencies operate in this manner. A totalitarian regime doesn't necessarily need a figurehead to exist.. Our dictator today, is this federal apparatus who views basic rights as an inconvenience to be *rubber* stamped out..

    If there is one sliver of hope.. Historically speaking, populations inevitably resist those who would seek to control every aspect of their lives. Albeit, it will not be overnight but I'm surprised for all their "intelligence" they haven't calculated the simple math that shows this course they are on is unsustainable..

    Call it backlash or blowback but the inevitable reaction to these actions will be a storm of epic proportions.. The saddest part in all of this is that such a future can be completely avoided and does not need to come to pass..

    It's just a truth our Federal Throne is not interested in digesting..

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 3 Feb 2015 @ 5:47am

    If the terrorist threat to the US is stronger today than on September 10, 2001, a large part of the reason is all the haystacks we've given them to hide in and behind.

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 3 Feb 2015 @ 5:57am

    mentions a targeted e-mail [redacted]

    what if the redacted word is "provider" not "address"

    reply to this | link to this | view in chronology ]

  • identicon
    UAE Champions league, 3 Feb 2015 @ 7:00am

    UAE Champions league

    If they know every detail about an individuals life they falsely believe that they can control said individual.. Sadly, that "individual" just happens to be society at large.

    America is not safe while these agencies operate in this manner. A totalitarian regime doesn't necessarily need a figurehead to exist.. Our dictator today, is this federal apparatus who views basic rights as an inconvenience to be *rubber* stamped out..

    reply to this | link to this | view in chronology ]

  • icon
    Blaine (profile), 3 Feb 2015 @ 8:21am

    ...Cold Dead...

    "More documents have been yanked out of the NSA's hands"

    You ever read something and think to yourself, 'this would be so much better with just a couple more words?'

    reply to this | link to this | view in chronology ]

  • identicon
    Anonymous Coward, 3 Feb 2015 @ 9:25am

    "Legal"

    The program wasn't actually legal at the time it rolled out.
    And, barring a constitutional amendment, still isn't.

    reply to this | link to this | view in chronology ]

  • icon
    Groaker (profile), 3 Feb 2015 @ 3:43pm

    FISA court

    Has no purpose but rubber stamping the demands of law enforcement. It has been that way since the beginning, and will undoubtedly get to the point where claiming that the probable use of toilet paper is legal justification for the issuance of warrants.

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here



Subscribe to the Techdirt Daily newsletter




Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)

Close

Add A Reply

Have a Techdirt Account? Sign in now. Want one? Register here



Subscribe to the Techdirt Daily newsletter




Comment Options:

  • Use markdown. Use plain text.
  • Remember name/email/url (set a cookie)

Follow Techdirt
Techdirt Gear
Show Now: Takedown
Advertisement
Report this ad  |  Hide Techdirt ads
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Chat
Advertisement
Report this ad  |  Hide Techdirt ads
Recent Stories
Advertisement
Report this ad  |  Hide Techdirt ads

Close

Email This

This feature is only available to registered users. Register or sign in to use it.