Skating on Stilts

More on NSA and Snowden's "Wiretap Anyone" Claim

Two updates for those following the XKeyScore debate:

Joshua Foust has written an excellent post that clarifies a few things I didn't cover in my earlier post. He notes that XKeyScore allows analysts to recover only material that NSA has collected and stored; that's important because just being able to enter the President's email address is not the same as ordering up a full wiretap.  NSA has limitations on what it collects, particularly in the United States, and no one thinks that the front end XKeyScore system overrides those limits.  Thus, as Foust suggests, it may well be that XKeyScore can only search metadata, and I think it's highly likely that XKeyScore can only search databases that have already been filtered to exclude the great bulk of US communications. All that makes Snowden's claim about being able to wiretap anyone extremely unlikely -- and certainly not demonstrated by the latest disclosures, despite Glenn Greenwald's claims to the contrary.

Foust also makes a point that always needs to be part of the discussion:  NSA is an intelligence agency, and it gathers intelligence by intercepting communications in highly effective and intrusive ways. Throughout the postwar era, NSA has had capabilities that, if turned full-force on the American people, would be dangerous and antidemocratic. But getting rid of those capabilities isn't a real-world option; it would amount to unilateral disarmament in an intelligence arms race and would leave us open to much more sophisticated terror attacks.  

The American solution to that problem has not been to limit NSA's capabilities; instead, we've relied on rules-based limits to restrict how NSA uses those capabilities. If law is the principal limit on the agency, Foust points out, then it's misleading for Greenwald to use slides that date to 2007, a lifetime ago where US intercept law is concerned. He reprints an exchange with Greenwald and the Guardian that suggests a remarkable lack of interest on their part in telling this part of the story, in case there are more than two people left in the world who think Greenwald and company are just journalists telling the truth and letting the chips fall where they may.

Coming from an entirely different direction, Marcy Wheeler has a response to my post that offers two thoughts, one willfully obtuse, the other more interesting. She first points out that NSA analysts can overcome the justification requirement by lying.  Well, sure, but that just explains why the justifications are audited.

More interestingly, she parses the recently declassified section 215 order to argue persuasively that the justification screen doesn't apply to everyone.  She says there must be NSA techies (though not systems administrators like Snowden) who have broader access to the data than the analysts, because someone has to delete useless data that clutters up analysts' searches (much like search engine clutter before Google gave us Page Rank). If for example telemarketer numbers weren't deleted, she points out, we'd all end up two hops from al Qaeda's leadership. (I sort of like the image of al Qaeda's number three shouting "Put me on your do-not-call list!" as he searches the skies for a drone.)

Wheeler thinks this is important because it means that the "justification" menus don't guarantee auditability of every use of intercept data by every employee at NSA. Again, that may be true, but the important point about the "justification" menu isn't that it offers universal protection against abuse; nothing does. The significant point is that NSA built that menu not for public consumption but because the agency's commitment to following the law demanded auditability of searches.  This likely isn't the only control in place; employees who have other means of access are undoubtedly subject to other controls.  

We can't expect to expose every aspect of NSA's intelligence system in order to verify each and every control mechanism, not if we actually want an intelligence capability.  What we do know is that the material Snowden stole shows an agency working hard to enforce privacy rules -- harder than it works to enforce other security rules, unfortunately.  And that Snowden's claim that he could wiretap an accountant or the President from his desk looks even more dubious than when it was made.

 

Does NSA Work Harder to Protect Privacy than to Protect National Security?

Jack Goldsmith at Lawfare asks a good question: 

How is the NSA Director Alexander’s claim that “we can audit the actions of our people 100%” (thus providing an important check against abuse) consistent with (a) stories long after Snowden’s initial revelations that the White House does not “know with certainty” what information Snowden pilfered, (b) reported NSA uncertainty weeks after the initial disclosure about what Snowden stole, (c) Alexander’s own assertion (in June) that NSA was “now putting in place actions that would give us the ability to track our system administrators”?

One part of the question is easy to answer:  things that NSA does in June to track systems administrators don't tell us much about what Snowden stole in January. The harder question is how to square NSA's claims of strict privacy protection with its lack of insight into what Snowden stole.  I don't know the answer for sure, but I've got a good guess:  Because NSA does a better job of protecting Americans' private data than it does protecting its sources and methods. 

Take a close look at slide 7 of the latest leaked powerpoints. 

It shows a sample search for a particular email address, including a box for "justification." The sample justification ("ct target in n africa") provides both the foreign intelligence reason for surveillance and the location of the target. What's more, the system routinely calls for "additional justification." All this tends to confirm NSA's testimony that database searches must be justified and are subject to audits to prevent privacy abuses.

How does this square with Snowden's famous claim to Glenn Greenwald that he could "wiretap anyone, from you or your accountant, to a federal judge or even the president, if I had a personal email"? Snowden and Greenwald have an agenda, of course, and the claim has been widely questioned. Greenwald's latest article is an attempt to bolster the claim by offering evidence of NSA's capabilities where individuals are concerned. Greenwald grudgingly acknowledges, as he must, that "searches conducted by NSA analysts are periodically reviewed by their supervisors within the NSA." But, citing Snowden, he claims that the safeguards aren't that good:  

 "It's very rare to be questioned on our searches," Snowden told the Guardian in June, "and even when we are, it's usually along the lines of: 'let's bulk up the justification'."

But why are we being asked to accept Snowden's word on that? For that matter why are Snowden and Greenwald relying on indirect evidence to support their "wiretap anyone" claim?  After all, Snowden joined NSA to steal its data and reveal what he considered abuses.  If he wanted the world to know how easy it is for an NSA employee to wiretap anyone from accountants to the President, why didn't he just do it?  He could have put the results on one of his thumb drives along with the other Top Secret data and walked out of the building. 

I suspect he didn't do it because he knew that the systems that protect against such activity are a lot more carefully monitored than the systems from which he was stealing other classified data.  So maybe he could have done it, but only once and only at great risk of being caught.  If that's what he means by being able to wiretap anyone, well, hell, he could have murdered anyone, too.

So, Jack Goldsmith, I think that's your answer.  It can easily be true both that NSA heavily safeguards its wiretapping databases and that NSA does not know exactly what data Snowden stole. That would be the logical outcome if NSA placed a higher value on preventing abuses of its wiretapping tools than on preventing theft of classified data.

And why would NSA do that? Simple.  Bureaucracies do more of what they're rewarded for and less of what they're punished for.  So if NSA has been punished more severely for privacy violations than for security violations, it will put a priority on avoiding privacy violations. And that's exactly what's happened.  The deluge of overlapping and politically charged oversight triggered by a misuse of NSA's wiretapping tools is far more painful to NSA than a counterintelligence investigation of leaked secrets. 

Which brings me around to a point I've made in testimony (here and here).  Contrary to the critics, existing oversight mechanisms -- from the FISA court to the Justice Department and the inspectors general -- are having a big impact on NSA's behavior.  Arguably, existing oversight mechanisms have already led NSA to protect privacy better than it protects national security. Adding more oversight, as Congress seems inclined to do, will shift NSA's priorities further in the same direction. At some point, I fear, that will lead to a serious national security failure.

Did the Computer Fraud and Abuse Act Help Re-Elect Barack Obama?

The prosecutorial discretion built into the Computer Fraud and Abuse Act is already controversial in the blogosphere, where leftie admirers of Aaron Swartz and libbie opponents of prosecutorial discretion have made common cause against the law.  And indeed it's true; forfeiture laws aside, the CFAA is among the most flexible tools in a federal prosecutor's kit.  You can be prosecuted for doing almost anything on a computer if you lack "authorization" to do it. "Authorization" is at the heart of the criminal offense, but it is not defined, and its vagueness means that a routine violation of Facebook's terms of service or a mean-spirited use of ordinary network protocols can be hyped into federal crimes.  (I'm not wild about the law's breadth and vagueness myself, since prosecutors have used their discretion to keep victims of hacking from protecting themselves.)

All that has made the CFAA controversial, at least in some circles.  But if my partner Michael Vatis is right, you ain't seen nothing yet.  His recent post in the Steptoe Cyberblog raises the very real possibility that Mitt Romney lost the 2012 election because of the enormous prosecutorial discretion built into the CFAA. It's widely agreed that Mitt Romney lost the race because the President's base turned out in surprisingly large numbers, thanks in large part to the Obama campaign's effective use of technology. That much we already knew.  But now, thanks to Dan Balz's "Collision 2012," we're beginning to learn exactly how the campaign used technology.  And, as Michael Vatis, an alumnus of the Clinton Justice Department, persuasively argues, its key tactic was violating the Computer Fraud and Abuse Act. Here's how the tactic apparently worked. Obama supporters logged on to both a campaign network and their Facebook account, allowing the campaign to search their Facebook network for likely Obama voters whom the campaign believed to be unmotivated or unregistered. Those voters would then get tailored messages from their Facebook friends urging them to register and turn out.The Obama campaign doesn't seem to have been deterred by the possibility that it was violating federal law.  I can think of at least four reasons why that might be.  Three of them are scandals. It's clever. It's the future. And it's a violation of the CFAA. Facebook doesn't let users share access to their accounts, and anything Facebook doesn't authorize is very likely a federal crime. (Because Facebook is limiting access to information, not just use of information, the conduct was very likely criminal even under the more limited construction of the CFAA adopted in the Ninth Circuit.) Maybe the campaign never thought about the possibility that it was violating federal law.  That's not a scandal, though it strikes me as unlikely that not one of these tech-savvy geeks failed to notice that they were breaching Facebook's terms of service.   The other possibilities are all much more troubling.  Perhaps the campaign, or some official in the administration, checked quietly with Justice and got an assurance that its prosecutors would not inconvenience the campaign. Or perhaps the campaign thought about the risk and said, "Pff!  Those guys work for us. They'll never prosecute, especially if we win." Or perhaps the Obama campaign went to Facebook and got a quiet waiver of the terms of service. (I'm assuming that anything the campaign did was done quietly so as not to alert the Romney campaign, which might have emulated it.) Given the importance of turnout to the result in 2012, and the computer crime prosecutors' already controversial exercises of discretion, I think this issue will go mainstream.  If the President even arguably won re-election by violating federal law or by getting special treatment from Facebook or federal prosecutors, half the country will want to know exactly how that happened. And I don't see how the extraordinary discretion conferred by the CFAA can survive the storm that follows.

  CORRECTION/UPDATE: Having talked in some detail with folks at Facebook, I've concluded that this post was just wrong, and I owe an apology to both Facebook and the Obama campaign, not to mention the co-bloggers and readers who joined the fray. Facebook’s terms of service do say all the things that I and Michael Vatis’s post quoted – they prohibit password sharing and the soliciting of password sharing and so on. But it turns out that Facebook also maintains Facebook Platform, whose rules permit users to grant app developers access to their user data, including a user's list of friends. The Obama campaign created an app that adapted this platform to its turnout goals, and it did so within the rules set by Facebook.  Because the program was authorized by Facebook, it was also authorized under the Computer Fraud and Abuse Act.  I've deleted the bulk of the post but left it up so that any links to the original post will come to this correction.    

Critiquing FISA Reforms

I ended up testifying again on FISA reform yesterday, this time to Senate Judiciary.  While mostly repeating my past testimony, I added a critique of two proposals for reforming FISA:

One idea is to declassify FISA court opinions. Another is to appoint outside lawyers with security clearances who can argue against the government.  The problem with these proposals is that they’re not likely to persuade the FISA doubters that the law protects their rights. But they are likely to put sources and methods at greater risk.

Declassification of the FISA court opinions already happens, but only when the opinion can be edited so that the public version does not compromise sources and methods. The problem is that most opinions make law only by applying legal principles to particular facts.  In the FISA context, those facts are almost always highly classified, so it’s hard to explain the decision without getting very close to disclosing sources and methods. To see what I mean, I suggest this simple experiment. Let’s ask the proponents of declassification to write an unclassified opinion approving the current section 215 program – without giving away details about how the program works. I suspect that the result will be at best cryptic; it will do little to inspire public trust but much to spur speculation and risk to sources and methods.

What about appointing counsel in FISA matters?  Well, we don’t appoint counsel to protect the rights of Mafia chieftains or drug dealers.  Wiretap orders and search warrants aimed at them are reviewed by judges without any advocacy on behalf of the suspect.  Why in the world would we offer more protection to al Qaeda? 

I understand the argument that appointing counsel will provide a check on the government, whose orders may never see the light of day or be challenged in a criminal prosecution.  But the process is already full of such checks.  The judges of the FISA court have cleared law clerks who surely see themselves as counterweights to the government’s lawyers.  The government’s lawyers themselves come not from the intelligence community but from a Justice Department office that sees itself as a check on the intelligence community and feels obligated to give the FISA court facts and arguments that it would not offer in an adversary hearing.  There may be a dozen offices that think their job is to act as a check on the intelligence community’s use of FISA:  inspectors general, technical compliance officers, general counsel, intelligence community staffers, and more.  To that army of second-guessers, are we really going to add yet another lawyer, this time appointed from outside the government? 

For starters, we won’t be appointing a lawyer.  There certainly are outside lawyers with clearances. I’m one. But senior partners don’t work alone, and there are very few nongovernment citecheckers and associates and typists with clearances. Either we’ll have to let intercept orders sit for months while we try to clear a law firm’s worth of staff – along with their computer systems, Blackberries, and filing systems – or we’ll end up creating an office to support the advocates.  

And who will fill that office? I’ve been appointed to argue cases, even one in the Supreme Court, and I can attest that deciding what arguments to make has real policy implications. Do you swing for the fences and risk a strikeout, or do you go for a bunt single that counts as a win but might change the law only a little? These are decisions on which most lawyers must consult their clients or, if they work for governments, their political superiors.  But the lawyers we appoint in the FISA court will have no superiors and effectively no clients. 

To update the old saw, a lawyer who represents himself has an ideologue for a client.  In questioning the wisdom of special prosecutors, Justice Scalia noted the risk of turning over prosecutorial authority to high-powered private lawyers willing to take a large pay cut and set aside their other work for an indeterminate time just to be able to investigate a particular President or other official.  Well, who would want to turn over the secrets of our most sensitive surveillance programs, and the ability to suggest policy for those programs, to high-powered lawyers willing to take a large pay cut and set aside their other work for an indeterminate period just to be able to argue that the programs are unreasonable, overreaching, and unconstitutional?

Neither of these ideas will, in my view, add a jot to public trust in the intelligence gathering process. But they will certainly add much to the risk that intelligence sources and methods will be compromised. For that reason, we should approach them with the greatest caution.