Skating on Stilts

Understanding the Enemy

The latest Snowden leak story is in the Huffington Post.  It says that NSA thought about exposing the hypocrisy of Islamic extremist recruiters by revealing their financial greed or predatory sexual habits.  I'm quoted in support of considering such tactics, but the backstory of the interview may be more interesting.  

When one of the authors, Ryan Grim, called me for comment, he said that while Glenn Greenwald was transitioning to his new Omidyar-funded venture he was temporarily publishing his Snowden leaks with HuffPo. So when he asked for my take on the NSA story, pretty much the first words out of my mouth were, "Why wouldn't we consider doing to Islamic extremists what Glenn Greenwald does routinely to Republicans?"  The story quotes practically everything I said to Grim except that, although I returned to the point a couple of times and emphasized that it summed up my view.

I don't think HuffPo cut the quote because they ran out of electrons.  The article itself is so tediously long that I defy anyone to read every word in a single go.

Nor because my remark was inaccurate.  It turns out that Glenn Greenwald has written an entire book devoted to exposing the contradiction between Republicans' ideology and their private lives.  In Greenwald's words,  "While the right wing endlessly exploits claims of moral superiority ... virtually its entire top leadership have lives characterized by the most decadent, hedonistic, and morally unrestrained behavior imaginable ...[including] a string of shattered marriages, active out-of-wedlock sex lives, and highly 'untraditional' and 'un-Christian' personal lives [endless detail omitted]." His book certainly makes the NSA memo sound restrained and cautious, but both are motivated by the same idea.

Grim and Greenwald very likely cut the quote because it would have undermined the narrative of the piece, which combines solicitude for the poor Islamists whose sexual and financial hypocrisy might be exposed with outrage at the NSA for even considering such a tactic.  The quote would have made them look like, well, hypocrites.

The incident makes me wonder what else Greenwald leaves out of his stories. And why we should continue to trust snippets of documents selected by someone who thinks that the difference between Islamist extremists and Republicans is that one is an enemy that deserves no quarter and the other is sort of like Martin Luther King, except for the part about trying to kill us. 

Hackback Backers' Comeback?

The US-China Economic and Security Review Commission has issued its annual report. It reminds us that, while press and privacy campaigners have been hyperventilating over US intelligence programs, there are, you know, actual authoritarian governments at work in the United States -- breaking into the networks of activists whom they dislike, newspapers whose sources they want to discover, and companies whose secrets they want to steal, all without (gasp!) court orders or Jim Sensenbrenner's consent.

Perhaps even more interesting, the Commission offers moral support and an open Overton window to those who support much more active defenses than the Justice Department has been willing to countenance under the Computer Fraud and Abuse Act.  Among the policy options it treats seriously are watermarking and beaconing of documents for evidentiary purposes as well as authorizing private victims to conduct a host of active responses to intrusions:

Encourage the U.S. government, military, and cleared defense contractors to implement measures to reduce the effectiveness of Chinese cyber operations and increase the risk of conducting such operations for Chinese organizations. For example, the IP Commission recommends measures such as ‘‘meta-tagging, watermarking, and beaconing,’’ because they can help identify sensitive information and code a digital signature within a file to better detect intrusion and removal. These tags also might be used as evidence in criminal, civil, or trade proceedings to prove data was stolen.

Clarify the legal rights of companies, and the types of action that are prohibited, regarding finding and recovering intellectual property that is stolen through cyber intrusions. Mr. Kamphausen said U.S. companies ‘‘need the right tools that afford them the protections, legal and otherwise, so that they can do what’s in their own interest.’’

Pass legislation permitting U.S. companies to conduct offensive cyber operations in retaliation against intrusions into their networks. Such operations could range from ‘‘actively retrieving stolen information’’ to ‘‘physically disabling or destroying the hacker’s own computer or network.’’

Can We Crowd-Audit Healthcare.gov?

The Administration has set a goal for fixing the troubled Obamacare website, healthcare.gov. By November 30, according to the Washington Post, the government's goal is that 80% of users will be able to buy healthcare policies online. The 80% target moves the goalposts back from the President's more confident statement earlier this month: “By the end of this month, we anticipate that it is going to be working the way it is supposed to.”

But it is a concrete, measurable goal.

Unfortunately, everyone involved in that measurement, from the contractors to HHS to the White House, has a strong interest in reporting success. And a track record of handling data in a way that masks failure. For example, the administration refused to provide any numbers about enrollments for more than a month and then released numbers that mix actual enrollments with plans that are simply sitting in the consumer's online “shopping cart.”

You don't have to be very cynical to think that we'll only hear about enrollment statistics on November 30 if the 80% goal is met, or can be spun. Which leads me to the point of this post.

We don't actually have to wait for the administration to release the numbers. Because the administration has chosen a target that can be measured by all of us. All we need is for a large enough group of consumers to go through the enrollment process on November 30  and report whether they succeeded or failed. Call it crowd auditing, or crowditing for short. In fact, done right, it's a better measure of success or failure than anything that can be measured by site administrators.  And it will be available in something close to real time. 

There are obviously problems with crowditing in such a politically charged atmosphere. Participants will be tempted to game the system, claiming failure or success without actually using the site. But it seems to me that many of those problems can be overcome by requiring participants to use real identities and to take screenshots when they start and periodically as they move through the process, sending these shots and one of their final successful or unsuccessful registration to a central location for verification and tabulation. I'm sure there are reputable news outlets that would provide some neutral oversight to the tabulation process, and I'm guessing that they'd spotcheck the participants, if only to get local color and quotes.

This is a little outside my usual beat, so I'm opening comments for evaluations of whether this is feasible, how to prevent abuse, and most importantly for volunteers. If we're going to organize this, we'll have to work fast, since November 30 is only six days away.

If you want to volunteer services, funding, or web design/software/technology help, or you want to make a comment that remains confidential, please send your message to [email protected].   If this works out, we'll likely want to work closely with, and perhaps give an exclusive to, the news outlets that are most helpful in pulling the effort together (h/t Glenn Greenwald), so news outlets interested in helping should also send a message to the same account.

When Separation of Powers is a Matter of Life and Death

The Leahy-Sensenbrenner USA FREEDOM Act puts the Foreign Intelligence Surveillance (FIS) court in charge of shaping, overseeing, and enforcing minimization guidelines in connection with section 215, pen/trap orders, and section 702, largely taking the Attorney General out of the process of writing minimization guidelines.

I'm appalled, because the FIS court has taken control of minimization before, with disastrous consequences; it built a "wall" between intelligence and law enforcement without any legal basis for doing so, and enforced the wall so aggressively that the FBI couldn't use its best counterterrorism assets to track down the hijackers in late August and early September 2001.  

In a very real sense, it was the FIS court's legal error combined with a self-righteous use of its contempt power that thwarted the country's last, best chance to stop the attacks.

That the court made terrible errors in 2001 is perhaps understandable. Repeating those errors is not.

But the more closely I observe the FIS court the more concerned I become that the peculiar role that we have created for the FIS court makes a repetition all too likely.  I'm testifying to the Judiciary Committee tomorrow on the USA FREEDOM Act, and I took the opportunity to do a bit more thinking in this post about why the FIS court seems to have learned so little from its discreditable performance in 2001.

It may be that the problem is best seen as a constitutional failure.  That is, practical politics  are pushing the FIS court out of an article III  role and into article I. And the FIS court's failings may be best seen as a problem in separation of powers.

At the outset, the separation of powers issue isn't obvious. The FIS court’s principal statutory role is to approve or deny intercept and discovery orders involving foreign intelligence. This sounds like a role any court might play; judges approve warrants and wiretaps every day in a criminal context.

In practice, though, the FIS court’s role is quite different. Sitting on the court pulls judges into some of the most sensitive intelligence programs the United States has. It suddenly sees the many terrible things that other nations and movements hope to visit on Americans; it sees how much the government must do just to keep our enemies at bay. It cannot help wanting the government to succeed.

But service on the FIS also exposes judges to some of the most sustained and unidirectional political criticism they are likely to experience in their careers on the bench. The court is routinely mocked as nothing but a rubber stamp, and it's clear that the mockery stings. In fact, the court recently announced that it was keeping statistics to show how often it forces modifications of FISA orders. See Letter from the Honorable Reggie B. Walton, Presiding Judge, the United States Foreign Intelligence Surveillance Court, to the Honorable Charles E. Grassley, Ranking Member, Committee on the Judiciary, United States Senate (Oct. 11, 2013), available at http://www.uscourts.gov/uscourts/courts/fisc/ranking-member-grassley-letter-131011.pdf. 

This suggests that the political criticism is hitting home, and perhaps affecting the court’s ability to apply the law with an even hand. After all, no one would want to be judged by a court that goes out of its way to publicize a scorecard of how often it rules against him.

These conflicting pressures, I suspect, push the court into a nit-picking overseer’s mentality toward the intelligence agencies.  Feeling quite legitimate pressure to grant surveillance requests, the court also feels pressure to show its independence.  

As the court’s “scorecard” and its occasional public statements suggest, the result is a court that flyspecks FISA orders to a fare-thee-well, demanding many modifications that may or may not be required by a strict reading of the FISA statute.

Ordinarily, of course, if a judge asks the government for things that go beyond his authority, the government appeals. But in the close confines of the FIS court, this is not an easy option. Neither the Justice Department nor the intelligence community wants to alienate the FIS court by suggesting that its demands have no basis in law. Instead, it is more comfortable for all if the intelligence community adopts as many of the court’s suggestions as it can and explains why it can't adopt the others.

And so the FIS stops being a judicial process of argument and ruling; it becomes more of a negotiation, in which the government is tempted to accept any doable measure that the court asks for, whether justified by law or not, and the court does not press for changes that the government persuasively argues it cannot make. Once the court has negotiated minimization guidelines, it owns them, pet rocks and all. The FIS court necessarily feels responsible for ensuring that they are carried out as intended. To make sure that happens, the court plays an increasingly managerial role in the operation of intelligence agencies.

But the FIS court is not a manager. Real managers have many administrative tools to make sure their policies are carried out. The FIS court has only two: legal rulings and contempt findings. As the court becomes more familiar with the agency, it grows more invested in the implementation of particular measures and policies. The temptation to declare that its favored measures are required by law is very great.

Similarly, when the court is disappointed or surprised by how the agency has implemented its measures, the temptation to brandish the contempt power is strong.

In short, I suspect that the disaster of 2001 was not the result of one judge’s bad temperament or faulty legal judgment. It is an institutional temptation, inherent in the managerial role that the FIS court has gradually assumed. Whether that role is consistent with the constitution looks more and more like a difficult question.

NOTE: My full testimony is here: Baker Testimony to Senate Judicary - 11-21-13.