December 15, 2013 | Posted in 4th Amendment, Director of National Intelligence, E.O. 12333, FBI, FISA, FISC, Intelligence, Law Enforcement, NSA, Privacy, U.S. Code Title 10, U.S. Code Title 50 | By Tom Wither
Absolutely not. A nation where every move of every American citizen is recorded, cataloged and data based by the government runs counter to the privacy rights each citizen of the United States expects, and would be an abhorrent infringement upon one of the principle freedoms of our democracy. Protecting those rights is something I swore to do as a member of the intelligence community, and was required to do as a civil servant and uniformed member of the armed forces.
In light of the ‘Snowden revelations’ and the plethora of news stories (few of those stories entirely accurate and not jaundiced by sensationalism), many Americans are concerned about invasions of their privacy by the government. I share those concerns, but mine are tempered by the testimony offered before the House and Senate Intelligence and Judiciary committees, the declassified documents posted on the IConTheRecord tumbler site, and my own professional experiences within the intelligence community.
Much like the majority of the 100,000+ members of the intelligence community, I have a lifetime obligation to protect the classified material I’ve been exposed to. I understand the valid reasons for that secrecy, and I respect them. I was also made fully aware early in my career of the myriad of mechanisms in place to report perceived illegal or improper acts, from IG reporting through classified channels to include arranging closed door testimony before the relevant Congressional committees if needed. For the record, in my more than twenty-five years in the intelligence community, I never encountered any instance of willful or intentional misuse of the tools, capabilities, or authorities any of my colleagues or I operated under, had access to, or could utilize. Certainly honest errors were made, as they would be in any human endeavor, and those errors were reported through the proper mechanisms, and corrected.
At this point, let me point out some of the facts now available for every citizen to evaluate when deciding for themselves if the government is violating your privacy rights, and temper that with a few other thoughts. Using just the FISA 215 program as an example, all of what follows is either from declassified documentation/information released by the ODNI, or provided as testimony on public session in front of the intelligence or judiciary committees by the senior leaders of the intelligence community. See the ODNI’s IC on the Record website for the details on the FISA 702 program.
The FISA 215 Program
- Gathers and centralizes at NSA, telephone call records from various U.S. telecommunications companies
- The telephone companies are compelled to provide the information to the government by a FISA Court order
- The FISA Court approves the orders based on the law and precedent (e.g. Smith v. Maryland, the FISA Law Congress passed twice, etc.) subsequent to receiving an application for the order by the government (usually the FBI, after coordination with the NSA, ODNI, and the National Security branch of the DoJ)
- The FISA Court requires the government to store, access, and utilize the call records obtained under the order in a specific manner outlined by the Court, and report all deviations from those orders
- The only records provided to the government by the telephone companies are:
Date & Time of the Call
Duration of the Call
- For example: Phone number 203-555-1212 called phone number 203-555-1414 at 0900 on the 10 Oct 2012 and the call lasted 10 minutes
- No names, no addresses, or other identifying information is provided by the telephone companies under the FISA Court’s order
- The content of conversations are not collected under this program – other warrants are required to collect content, and NSA says it currently has only 60 active warrants for content collection against U.S. persons
- Searches of the call records under this authority can only be conducted with a ‘seed phone number’ that can be reasonably and articulately described, in writing, as being terrorism related
- The written articulation must be signed off on by an NSA manager (an intelligence professional, not a political appointee) before a query is run against the records in the database
- ALL queries of the database are recorded, tracked, and audited to ensure the FISA Court’s instructions are not violated
- The returned call records meeting the intelligence need (i.e. not all of the returned records) are turned over to the FBI for any follow-up action
- If the government wishes to wiretap any number based on the call records NSA provides, it must apply to the appropriate court for a warrant
Laws, Executive Orders, and Congressional Oversight
The United States intelligence community operates under several enabling laws, Executive Orders from the President, and Congressional Oversight. These laws, orders, and oversight apply to every intelligence program conducted by the United States government. Some of the most notable of these are, USC Title 10, USC Title 50, Executive Order 12333, the Foreign Intelligence Surveillance Act of 1978 (as amended), and the oversight of the Senate Permanent Select Committee on Intelligence, the House Permanent Select Committee on Intelligence, and the Senate and House Committees on the Judiciary. Within the SIGINT system specifically, the primary instruction for the protection of U.S. citizen’s 4th Amendment rights is outlined in USSID 18.
The recently declassified United States SIGINT Intelligence Directive (USSID) 18, Legal Compliance and U.S. Persons Minimization Procedures, dated 25 January 2011, describes the U.S. person privacy protections all elements of the NSA are obligated and required to follow. Paragraphs 1.1 – 1.4 show that U.S. person privacy protections required by the 4th Amendment were in place long before Mr. Snowden’s massive leaks of classified material made the subject of U.S. person privacy a daily staple of newspaper front pages and legitimate public concern. USSID 18 has been in existence since at least 1993. In addition, the ODNI has made the training materials used by NSA to teach their analysts what is allowed and what is not allowed when dealing with FISA 215 data available for you to see.
Corporate America is ‘Spying’ on You All the Time – And you let them
Every time you make a purchase at a store, they know what you buy, and how often. That frequent shoppers card you use at the checkout ties you to every item on your shopping list – vegetables, meats, shampoos, bakery products, gluten free items, condoms, feminine hygiene items, etc. How many, which brands, how often, and which charge card you used. Think about the ‘pattern of life’ information that offers the company that owns that store about you and your family. You even surrendered it willingly. Companies use the information to target advertising, sending you e-mails and paper circulars featuring the products you buy most often using a process called data mining. You may not mind that, but what else are they using it for? Reporting to the FDA about how much red meat a family consumes in a year? How far you travel to get to the store? How many times a week you go? At what times of day? If you have children and how old they are? Are you under a doctor’s care or do you have an annoying hemorrhoid problem? The list is practically endless.
Your credit card company shares your purchasing habits with marketing companies. They may offer you the option to opt out, but I recently received a notice from one of my credit card companies telling me that they shared my personal information and purchase history with eight other companies, only offering me the opportunity to ‘opt out’ of the sharing with two of those companies.
How many video or still cameras did you appear on today as you went about your ‘private’ business? Did you even notice them? Did you notice the ones in every store you walk into, each ATM you passed, and the cell phone everyone you passed on the street was carrying? How many of those cell phone captured videos or still images were forwarded to a friend, lover, relative, or business colleague by the shutterbug/videographer? Do you know that there is a copy of that video or image on the telecommunication’s company’s servers or systems? Do you know how long it stays there or what is done with it? Are they kept for hours or years? By whom? How and where are they stored? Are they ever deleted? How can you be sure?
Oh, and those private phone calls you make, or e-mails you send? The telecommunications companies can mine those records as needed to improve their infrastructure, determine what services to market, or even re-direct your communications through the network. In doing so, do to the technical sophistication of today’s communications networks, the e-mail from your wife or husband in Cleveland, OH, just may have been routed through Vladivostok, Russia, where a copy was left on a server in Russia. Are the Russian security services scanning that e-mail for information it might find of interest? Do you honestly think they care about your privacy as a U.S. citizen? Maybe they think that picture of your significant other in her new Victoria’s Secret undies is pretty hot and keep a few copies.
Internal to these companies, what are the company’s restrictions or policies on which employees can access, review or share that information? Do those employees go through any kind of background check before they are hired? What kind of oversight is there on the use or access to the data?
Just Who Might be Invading Your Privacy – The U.S. Government, a Corporation, or a Foreign Government?
Should we be reasonably concerned about U.S. Government overreach and invasion of privacy? Yes. It’s our government and we should keep an eye on it. But I’m less concerned about the U.S. intelligence community’s activities than I am about a telecommunications provider (especially a foreign one) or foreign government’s respect for ‘privacy’ as we perceive it.
In the U.S., the intelligence community’s motivations, codified in both law and executive order, and overseen by Congress and the Courts, is at least grounded in a desire to preserve, protect, and defend the Constitution and the nation. The professionals in that community undergo deep background checks, polygraph examinations, and in many cases, submit to financial disclosure requirements and psychiatric examinations before being exposed to intelligence operations or activities that may impact a U.S. person’s privacy in the modern digital age. Moreover, they seem, based on the information released by the ODNI, to be rigorously trained to protect the 4th Amendment rights of U.S. persons, and there is at least one directive in place at NSA that requires that U.S. person privacy is protected.
Corporations (U.S. or foreign) are motivated by a desire to make a profit for their shareholders, and they never have to go to a judge for a warrant to see data that might invade someone’s privacy. They also don’t have Congress and the Courts looking over their shoulder to be sure they aren’t using ‘private’ data to profile a person’s life, purchasing habits, or travel.
Foreign governments may not care at all about your privacy. France just passed a surveillance law that, according to the story in the NYT, “…defines the conditions under which intelligence agencies may gain access to or record telephone conversations, emails, Internet activity, personal location data and other electronic communications. The law provides for no judicial oversight and allows electronic surveillance for a broad range of purposes, including “national security,” the protection of France’s “scientific and economic potential” and prevention of “terrorism” or “criminality.””
Mr. Inglis, Deputy Director of NSA, made a statement during a Q&A session at Penn Law’s Center for Ethics and the Rule of Law Conference that I think is very relevant. He based it on the number of NSA employees and affiliates who have died since 9/11 and the twelve internally reported ‘willful abuses’ during the conduct of its SIGINT operations – “… it’s three times more likely that you’ll die for your country if you work for NSA than you are to abuse the [U.S. SIGINT] system.”
For myself, while I accept that there is always room to improve a process, law, and oversight; I put more trust in the professionals in the U.S. intelligence community, the laws and policies that govern their activities, the internal controls, and the oversight mechanisms in place in the courts and congress when it comes to protecting my 4th Amendment rights.
The Department of Justice announced today the charging of two men in an alleged Iranian backed plot to assassinate the Saudi Ambassador to the UnitedStates, and in the process potentially kill a hundred or more civilians and potentially congressional members with an explosive device.
First off, let me be very clear in saying that the men and women of the FBI, the attorneys in the justice department, and apparently the DEA as well, have done an outstanding job in foiling this plot. Their professionalism and competence in working to investigate, and begin the process of prosecuting the precursor crimes to this attempted assassination has been in the best traditions of law enforcement.
Based on the complaint and the Department of Justice’s press release, we’ve been incredibly lucky to find out about this plot and disrupt it. Why were we lucky? Because the first break in this case apparently came when Manssor Arbabsiar chose to meet with someone he thought was a member of a ‘…violent international drug trafficking cartel’ to get this cartel to carry out the bombing. Fortunately for us, the person Arbabsiar met was what the compliant describes as a DEA Confidential Source (CS).
Without attempting to denigrate the hard work of the FBI and the risks taken by the DEA’s CS, it does help when the assassins or terrorists literally come right to law enforcement undercover operatives for help in carrying out the assassination or terrorist act.
Fortunately, the DEA and the FBI moved swiftly to insinuate themselves into this plot, and learn enough about the conspirators to make an arrest and break up the plot, while also using Arbabsiar to verify the Iranian military connection.
While this case is certainly of great concern to the United States, strongly verifies the Iranian military and government’s desire, intent, and capacity to conduct these kind of attacks within the U.S., it also proves that terrorists and assassins need to be lucky just once, and we need to be right all the time.
Imagine what would have happened if Arbabsiar had approached a real member of a violent Mexican drug cartel. We could very well be viewing scenes of carnage at a D.C. restaurant and reports of the deaths of the Saudi Ambassador and many innocent civilians, rather than today’s press conference at the Justice Department.