Feed aggregator

Word Games: What the NSA Means by “Targeted” Surveillance Under Section 702

EFF's Deeplinks -

We all know that the NSA uses word games to hide and downplay its activities. Words like "collect," "conversations," "communications," and even "surveillance" have suffered tortured definitions that create confusion rather than clarity.

There’s another one to watch: "targeted" v. "mass" surveillance.

Since 2008, the NSA has seized tens of billions of Internet communications. It uses the Upstream and PRISM programs—which the government claims are authorized under Section 702 of the FISA Amendments Act—to collect hundreds of millions of those communications each year. The scope is breathtaking, including the ongoing seizure and searching of communications flowing through key Internet backbone junctures,[1]the searching of communications held by service providers like Google and Facebook, and, according to the government's own investigators, the retention of significantly more than 250 million Internet communications per year.[2] 

Yet somehow, the NSA and its defenders still try to pass 702 surveillance off as "targeted surveillance," asserting that it is incorrect when EFF and many others call it "mass surveillance."

Our answer: if "mass surveillance" includes the collection of the content of hundreds of millions of communications annually and the real-time search of billions more, then the PRISM and Upstream programs under Section 702 fully satisfy that definition.

This word game is important because Section 702 is set to expire in December 2017. EFF and our colleagues who banded together to stop the Section 215 telephone records surveillance are gathering our strength for this next step in reining in the NSA. At the same time, the government spin doctors are trying to avoid careful examination by convincing Congress and the American people that this is just "targeted" surveillance and doesn’t impact innocent people.

Section 702 Surveillance: PRISM and Upstream

PRISM and Upstream surveillance are two types of surveillance that the government admits that it conducts under Section 702 of the FISA Amendments Act, passed in 2008. Each kind of surveillance gives the U.S. government access to vast quantities of Internet communications.[3]

Upstream gives the NSA access to communications flowing through the fiber-optic Internet backbone cables within the United States.[4] This happens because the NSA, with the help of telecommunications companies like AT&T, makes wholesale copies of the communications streams passing through certain fiber-optic backbone cables. Upstream is at issue in EFF’s Jewel v. NSA case.

PRISM gives the government access to communications in the possession of third-party Internet service providers, such as Google, Yahoo, or Facebook. Less is known about how PRISM actually works, something Congress should shine some light on between now and December 2017.[5]

Note that those two programs existed prior to 2008—they were just done under a shifting set of legal theories and authorities.[6] EFF has had evidence of the Upstream program from whistleblower Mark Klein since 2006, and we have been suing to stop it ever since.

Why PRISM and Upstream are "Mass," Not "Targeted," Surveillance

Despite government claims to the contrary, here’s why PRISM and Upstream are "mass surveillance":

          (1) Breadth of acquisition:  First, the scope of collection under both PRISM and Upstream surveillance is exceedingly broad. The NSA acquires hundreds of millions, if not billions, of communications under these programs annually.[7] Although, in the U.S. government’s view, the programs are nominally "targeted," that targeting sweeps so broadly that the communications of innocent third parties are inevitably and intentionally vacuumed up in the process. For example, a review of a "large cache of intercepted conversations" provided by Edward Snowden and analyzed by the Washington Post revealed that 9 out of 10 account holders "were not the intended surveillance targets but were caught in a net the agency had cast for somebody else."[8] The material reviewed by the Post consisted of 160,000 intercepted e-mail and instant message conversations, 7,900 documents (including "medical records sent from one family member to another, resumes from job hunters and academic transcripts of schoolchildren"), and more than 5,000 private photos.[9] In all, the cache revealed the "daily lives of more than 10,000 account holders who were not targeted [but were] catalogued and recorded nevertheless."[10] The Post estimated that, at the U.S. government’s annual rate of "targeting," collection under Section 702 would encompass more than 900,000 user accounts annually. By any definition, this is "mass surveillance."

          (2) Indiscriminate full-content searching.  Second, in the course of accomplishing its so-called "targeted" Upstream surveillance, the U.S. government, in part through its agent AT&T, indiscriminately searches the contents of billions of Internet communications as they flow through the nation’s domestic, fiber-optic Internet backbone. This type of surveillance, known as "about surveillance," involves the NSA's retention of communications that are neither to nor from a target of surveillance; rather, it authorizes the NSA to obtain any communications "about" the target.[11] Even if the acquisition of communications containing information "about" a surveillance target could, somehow, still be considered "targeted," the method for accomplishing that surveillance cannot be: "about" surveillance entails a content search of all, or substantially all, international Internet communications transiting the United States.[12]  Again, by any definition, Upstream surveillance is "mass surveillance."  For PRISM, while less is known, it seems the government is able to search through—or require the companies like Google and Facebook to search through—all the customer data stored by the corporations for communications to or from its targets.

Seizure: Fourth Amendment and the Wiretap Act

To accomplish Upstream surveillance, the NSA copies (or has its agents like AT&T copy) Internet traffic as it flows through the fiber-optic backbone. This copying, even if the messages are only retained briefly, matters under the law. Under U.S. constitutional law, when the federal government "meaningfully interferes" with an individual’s protected communications, those communications have been "seized" for purposes of the U.S. Constitution’s Fourth Amendment. Thus, when the U.S. government copies (or has copied) communications wholesale and diverts them for searching, it has "seized" those communications under the Fourth Amendment.

Similarly, U.S. wiretapping law triggers a wiretap at the point of "interception by a device," which occurs when the Upstream mechanisms gain access to our communications.[13]

Why does the government insist that it’s targeted?  For Upstream, it may be because the initial collection and searching of the communications—done by service providers like AT&T on the government’s behalf—is really, really fast and much of the information initially collected is then quickly disposed of. In this way the Upstream collection is unlike the telephone records collection where the NSA kept all of the records it seized for years. Yet this difference should not change the conclusion that the surveillance is "mass surveillance." First, all communications flowing through the collection points upstream are seized and searched, including content and metadata. Second, as noted above, the amount of information retained—over 250 million Internet communications per year—is astonishing.

Thus, regardless of the time spent, the seizure and search are comprehensive and invasive. Using advanced computers, the NSA and its agents can do a full-text, content search within a blink of an eye through billions, if not trillions of your communications, including emails, social media, and web searches. Second, as demonstrated above, the government retains a huge amount of the communications—far more about innocent people than about its targets—so even based on what is retained the surveillance is better described as "mass" rather than "targeted."

Yes, it is Mass Surveillance

So it is completely correct to characterize Section 702 as mass surveillance. It stems from the confluence of: (1) the method NSA employs to accomplish its surveillance, particularly Upstream, and (2) the breadth of that surveillance.

Next time you see the government or its supporters claim that PRISM and Upstream are "targeted" surveillance programs, you’ll know better. 

 

[1] See, e.g., Charlie Savage, NSA Said to Search Content of Messages to and From U.S., N.Y. Times (Aug 8, 2013) (“The National Security Agency is searching the contents of vast amounts of Americans’ e-mail and text communications into and out of the country[.]”). This article describes an NSA practice known as “about surveillance”—a practice that involves searching the contents of communications as they flow through the nation’s fiber-optic Internet backbone. 

[2] FISA Court Opinion by Judge Bates entitled [Caption Redacted], at 29 (“NSA acquires more than two hundred fifty million Internet communications each year pursuant to Section 702”), https://www.eff.org/document/october-3-2011-fisc-opinion-holding-nsa-surveillance-unconstitutional (Hereinafter, “Bates Opinion”). According to the PCLOB report, the “current number is significantly higher” than 250 million communications. PCLOB Report on 702 at 116.

[3] Bates Opinion at 29; PCLOB at 116.

[4] Id. at 35.

[5] PCLOB at 33-34

[6] First,  the Bush Administration relied solely on broad claims of Executive power, grounded in secret legal interpretations written by the Department of Justice. Many of those interpretations were subsequently abandoned by later Bush Administration officials.  Beginning in 2006, DOJ was able to turn to the Foreign Intelligence Surveillance Court to sign off on its surveillance programs. In 2007, Congress finally stepped into the game, passing the Protect America Act; which, a year later, was substantially overhauled and passed again as the FISA Amendments Act. While neither of those statutes mention the breadth of the surveillance and it was not discussed publicly during the Congressional processes, both have been cited by the government as authorizing it.

[7] See note 1.

[8] Barton Gellman, Julie Tate, and Ashkan Soltani, In NSA-Intercepted Data, Those Not Targeted Far Outnumber the Foreigners Who Are, Washington Post (July 5, 2014),  

[9] Id.

[10] Id.

[11] Bates Opinion at 15.

[12] PCLOB report at 119-120.

[13] See 18 U.S.C § 2511(1)(a); U.S. v. Councilman, 418 F.3d 67, 70-71, 79 (1st Cir. 2005) (en banc).

Related Cases: Jewel v. NSA
Share this: Join EFF

Campaigning firms

BBC World News -

A look at the growing number of businesses who are trying to make a positive difference to society by speaking out on societal or political issues, and their reasons for doing so.

French Police Create Propaganda for ISIS by Ticketing Muslim Women on Beaches

The Intercept -

Photographs and video of French police officers issuing tickets to Muslim women — for violating new local ordinances that ban modest beachwear as an offense against “good morals and secularism” in more than a dozen towns along the Riviera — spread widely on social networks on Wednesday, prompting waves of outrage and mockery by opponents of the laws.

Just let this sink in. Men with guns forcing a women to undress, with the weight of the law behind them. pic.twitter.com/4BI16Bbss9

— Abdul-Azim ???? (@AbdulAzim) August 23, 2016

Let's stop pretending France is the land of "liberté" and "egalité" – when it allows something like this #WTFFrance pic.twitter.com/txSN4vw4In

— ?? Elena Rossini ?? (@_elena) August 24, 2016

L?i?b?e?r?t?é?, égalité, fraternité pic.twitter.com/QwzXfLBKFK

— Karl Sharro (@KarlreMarks) August 24, 2016

Un dessin du Soudanais Khalid Albaih sur la polémique française du #Burkini pic.twitter.com/YSntEP3rAT

— David Thomson (@_DavidThomson) August 24, 2016

Arrêté anti-burkini: une nouvelle photo de femme voilée verbalisée à Nice https://t.co/XRxe18g0WV pic.twitter.com/R3Q5bJoj7r

— L'Express (@LEXPRESS) August 24, 2016

Voici la vidéo des deux jeunes filles se faisant sortir de l'eau par la police à #Nice06 Sans porter de burkini… pic.twitter.com/NoY6i6V7bK

— Feiza Ben Mohamed (@FeizaK) August 22, 2016

Verbalisées pour un simple voile : la dérive des arrêtés "anti-burkinis" https://t.co/C8DVNAl12t pic.twitter.com/NOkIdO9s7i

— L'Obs (@lobs) August 24, 2016

"The body of the Muslim woman has always been a way for the French state to assert power over an entire population" pic.twitter.com/bgTqmkXiaP

— ????? ??????? (@Boutaina) August 22, 2016

But the same images were greeted with undisguised glee by extremists eager to make the case that observant Muslims have no place in European countries. A series of photographs published by The Daily Mail — showing armed officers confronting a woman wearing a headscarf, leggings and a long-sleeved shirt on a beach in Nice on Tuesday — was hailed by the anti-Muslim, Dutch politician Geert Wilders.

Fantastic.

Armed police order Muslim woman to remove burkini on packed Nice beach https://t.co/NmjWt5Y8Lw via @MailOnline

— Geert Wilders (@geertwilderspvv) August 24, 2016

David Thomson, a French journalist who tracks jihadist activity online, told Radio France that Islamic State sympathizers on social networks seemed surprised to find police officers in Nice “creating propaganda on their behalf,” by providing the perfect illustration of their case that France humiliates Muslims.

“For them, this is a godsend,” Thomson said. “The jihadist narrative has insisted for years that it is impossible for a Muslim to practice their religion with dignity in France.” Within minutes of publication, he said, these photographs became one of the most discussed topics in the online “jihadosphere.”

“These shots of Nice,” he added, “will fuel years of jihadist propaganda.”

The irony, Thomson noted last week, is that the specific swimming costume the bans have targeted, the full-body swimsuit known as the “burkini,” is rejected as immodest by Islamist ideologues.

Although the authorities in Nice confirmed that the incident reported by the Mail did take place — and that at least 23 other women have been ticketed there this week, and forced to pay 38-euro fines, or about $40 — defenders of the so-called “burkini ban” accused the unnamed woman of taking part in a staged “provocation.”

Jérémie Boulet, a member of the xenophobic National Front party, argued that the woman must have been trying to bait the authorities into approaching her by wearing such an outfit on a warm day. He also suggested, incorrectly, that she was not sitting on a towel when approached by the officers.

– Photo de bonne qualité
– Sans serviette sur des galets
– Habillée sous 36°
La provocation est réussie! #WTFFrance pic.twitter.com/ON7L1lauRt

— Jérémie Boulet (@BouletJeremie) August 24, 2016

Christian Estrosi, a former mayor of Nice who is now the regional president of the Côte d’Azur, issued a statement on Wednesday in which he called the behavior of the two dozen women fined for their dress this week, “unacceptable provocations” intended to “undermine the city’s police officers.” Estrosi also warned people who share images of the police ticketing women on social networks that they could be prosecuted for endangering the officers.

A French photo agency that acquired the rights to the images told Libération that the photographs were “certainly not staged, as some people have alleged,” and were the work of an unnamed freelancer “who happened to be on the beach at the time,” looking for images of the ban being enforced. He was about 100 meters away from the woman when he saw the officers approach and shot the encounter using a telephoto lens.

“The freelancer witnessed the scene, which took place at 11 a.m. on Tuesday and lasted roughly 10 minutes,” the agency, Best Image, said in a statement. “The woman was issued with a fine and left the beach a few minutes later. That is all the photographer was able to see.”

Speculation that the officers could have been set up was fueled by the fact that the photographer’s name was not released, but the incident took place the same day that a French journalist, Mathilde Cusin, witnessed something worse: a woman in Cannes being fined by the police and harassed by on-lookers. That woman, a 34-year-old mother who gave her first name as Siam, told Agence France-Presse that she was given a ticket for sitting on the beach with her family, wearing a headscarf and leggings. “I had no intention of swimming,” she said.

In an interview with Le Nouvel Observateur, a weekly magazine, the woman said that she was baffled at first by the police officers who told her that beachgoers were obliged to “dress properly” according to a new ordinance. When she asked the officers what that meant she was told that she could only stay on the beach if she agreed to wrap her scarf into a headband.

“My children were crying, witnessing my humiliation,” Siam told the magazine. “Even I could not help crying. They humiliated us.”

During her standoff with the police, a crowd of onlookers gathered. Some of them defended the woman, arguing that she was causing no harm and was not even wearing a burkini. Others, however, taunted her with racist remarks. “I was stunned,” she said. “I heard things no one had ever said to my face, like ‘Go home!'” Siam, who was born to French parents in Toulouse, said that someone else added, “We are Catholics here!”

“People demanded that she leave or remove her veil, it was pretty violent,” Cusin told the magazine. “I had the impression of watching a pack go after a woman sitting on the ground in tears with her little girl.”

“What shocked me is that it was mostly people in their thirties, not the elderly as one might imagine,” Cusin added.

“In the country of human rights, I see no trace of the principles of liberty, equality and fraternity,” Siam said. “I am outraged that this could happen in France.”

“Today we are banned from the beach,” she told Al Jazeera’s AJ+ later in a video interview. “Tomorrow it will be the street.”

This Muslim woman was forced to undress by armed French police. Social media reacted with #WTFFrance.https://t.co/RcC5mMIfX9

— AJ+ (@ajplus) August 24, 2016

“We are women. We are adults,” she added. “And if the headscarf is a personal choice, and if women want to wear it, why stop them?”

Top Photo: At a beach in Nice, France, the text of a bylaw was posted last week that bars women from wearing full-body swimsuits.

Sign up for The Intercept Newsletter here.

The post French Police Create Propaganda for ISIS by Ticketing Muslim Women on Beaches appeared first on The Intercept.

Latest Windows 10 Update Breaks PowerShell

Slashdot -

whoever57 writes: According to a report via InfoWorld, the latest Windows 10 update [KB 3176934] breaks Desired State Configuration (DSC) functionality in PowerShell. Some things that were broken in the prior update, such as support of many webcams and a freeze issue, don't appear to have been fixed in this update. Windows PowerShell Blog reported last night: "Due to a missing .MOF file in the build package, the update breaks DSC. All DSC operations will result in an 'Invalid Property' error. If you are using DSC from or on any Windows client, take the following steps: Uninstall the update if already installed [...]; If using WSUS, do not approve the update. Otherwise, Use Group Policy to set the 'Configure Automatic Updates' to '2 -- Notify for download and notify for install' [...] A fix for this issue will be included in the next Windows update which is due out 8/30/2016."

Read more of this story at Slashdot.

Cancer now beats heart disease as top cause of death in 22 U.S. states

Boing Boing -

A new report out today from the Centers for Disease Control and Prevention says cancer is now the leading cause of death in California and 21 other states, surpassing heart disease.

Back in the early 2000s, only Alaska and Minnesota lost more lives to cancer than heart disease. And back in the 1950s, heart disease deaths were overall 2.5 times the number of cancer deaths.

(more…)

Self-Driving Cars Aren't Going To Be So Great Until We Make Our Maps Better

Slashdot -

Uber is debuting its self-driving cars in Pittsburgh this month, a move that has many taxi drivers upset. The Verge's Nilay Patel argues that this move should change the way we think about maps and addresses. He adds that Uber is currently unable to pinpoint his home, and often ends up at the door of a "widely different address." Citing the CEO of a "large ridesharing company", Patel writes that this issue is known as the "egress problem" -- "the way we locate buildings on a map doesn't really describe how people move in and out of those buildings." Though there are workarounds and inventive ways to pinpoint your exact address, Patel argues that when we grow reliant on self-driving cars, things will get far more complicated and futile if we don't make our maps and navigation services better. He writes: Driverless cars are one of the ultimate signifiers of the future -- the real Jetsons stuff. And we're so close to making them happen: tons of cars have sophisticated adaptive cruise control that can basically keep you going on the highway, prototypes of true self-driving cars from Google and others are already on the road, and the momentum is only increasing. But maybe we shouldn't hand control of how we get somewhere to the machines until we're entirely sure the robots know where we're going.

Read more of this story at Slashdot.

Pages

Subscribe to debianHELP aggregator