The FBI's impersonation of an AP journalist during an investigation raised some serious questions about what the agency considered to be acceptable behavior when pursuing suspects. The outing of this tactic led to a lawsuit by the Associated Press, which was naturally unhappy its name was being used to deliver malware to a teenaged bomb threat suspect.
The FBI performed its own investigation of the matter (but only after it had become public knowledge -- seven years after the incident actually occurred) and found that rules may have been broken by this impersonation of a news agency. Certain approval steps were skipped, making the investigatory tactic not exactly by the book. But in the end, the report congratulated the FBI on using the ends to justify the means.
The DOJ's Inspector General [PDF] has now reviewed the incident as well and, uncharacteristically, is even more supportive and less critical of the FBI's actions.
We found that Department and FBI policies in effect in 2007 did not prohibit agents from impersonating journalists or from posing as a member of a news organization, nor was there any requirement that agents seek special approval to engage in such undercover activities. The only policies in effect at the time that might have required elevated consideration regarding the FBI’s plans turned on whether the undercover activity involved a “sensitive circumstance.” We concluded, given the lack of clarity in the policy language, that making a determination whether a situation was a “sensitive circumstance” was a challenging one and that the judgments made by the agents were not unreasonable given the lack of clarity.
Basically, the OIG has granted the FBI a "good faith" exception. The report also notes that an interim policy eliminated much of the vagueness previously present in the FBI's policies. That being said, the OIG's recommendation doesn't want for vagueness.
Recommendation 2: The FBI should consider the appropriate level of review required before FBI employees in a criminal investigation use the name of third party organizations or businesses without their knowledge or consent.
"Consider the appropriate level of review" sounds a lot like something that could be interpreted as "roll the dice and see what happens" or "it's always easier to ask for forgiveness than permission." Fortunately, the OIG has additional guidance on this recommendation, which makes it less vague than it first appears.
After reviewing a draft of this report, the FBI provided comments explaining that the heightened level of review and approval required for FBI employees to pose as members of the news media was introduced because such activity potentially could “impair news-gathering activities” under the First Amendment, but that such constitutional considerations do not apply to businesses and other third parties. Our recommendation, however, does not rely on equating the reputational interests of some third party organizations and businesses with the constitutional interests of others. We believe that reputational interests, and the potential impact FBI investigations can have on those interests, are themselves sufficiently important to merit some level of review before FBI employees use the names of third party organizations or businesses without their knowledge or consent.
As is pointed out by Marcy Wheeler, the FBI is arguing that it shouldn't have to seek special approval to imitate non-journalistic entities. It could impersonate any number of companies without additional oversight because there are fewer Constitutional concerns. It could -- in the hypothetical Wheeler proposes -- pretend to be Apple and issue a software update. That's one way to ensure a phone's crackable once the FBI gets its hands on it.
So, the change in policy will only affect the FBI's ability to impersonate journalists or their employers. It won't prevent the FBI from doing this. It will only require additional signatures on the paperwork.
Another OIG finding of note is that the FBI is the worst at impersonating journalists. Fortunately for it and its terrible imitation skills, it was only up against a 15-year-old bomb threat suspect.
Grant identified himself in the e-mail as “Norm Weatherill,” an “AP Staff Publisher.”
At 2:55 p.m. Jenkins responded, “leave me alone.”
Grant replied at 3:21 p.m.:
I respect that you do not want to be bothered by the Press. Please let me explain my actions. I am not trying to find out your true identity. As a member of the Press, I would rather not know who you are as writers are not allowed to reveal their sources. The school has continually requested that the Press NOT cover this story. After the School Meeting last night, it is obvious to me that this needs coverage. Readers find this type of story fascinating. People don’t understand your actions and we are left to guess what message you are trying to send. . . .
Nothing says "competent journalist" like random capitalization and referring to the Associated Press as "the Press..." if that's even what's happening here. It could very well be that "the Man" assumes everything is "us vs. them" and that "the Press" is just another key player in a larger conspiracy to subvert "School Meetings" and the administrators that oversee them. Whatever this mess of words is, "competent" it certainly isn't.
On top of that, the FBI couldn't even nail down a writing style that has its own, frequently-updated guidebook, as Ryan J. Reilly points out at the Huffington Post.
Despite the fact that the “entire investigative team was present” and “consulted together about what to say before the message was sent,” none of them apparently thought to follow AP Style.
Neither did the fake news story the FBI posted to its fake website -- the link used to serve the suspect with malware.
All joking aside, the policies the FBI had in place before this blew up were plainly inadequate. The policies replacing them aren't much better. The agency is already given plenty of leeway in terms of investigative tactics. Limiting its impersonation to those that don't implicate First Amendment rights won't stop it from impersonating any other private entity that might serve its purposes.