Homeland Security Watch

News and analysis of critical issues in homeland security

October 29, 2015

CISA and us

Filed under: Cybersecurity,Infrastructure Protection,Privacy and Security — by Philip J. Palin on October 29, 2015

Tuesday the Senate passed the Cybersecurity Information Sharing Act of 2015 by a vote of 74 to 21.   This bill is similar to a measure passed previously by the House.  Reconciliation is likely.

Part of the Congressional Research Service summary:

Requires the Director of National Intelligence (DNI), the Department of Homeland Security (DHS), the Department of Defense (DOD), and the Department of Justice (DOJ) to develop and promulgate procedures to promote: (1) the timely sharing of classified and declassified cyber threat indicators in possession of the federal government with private entities, non-federal government agencies, or state, tribal, or local governments; (2) the sharing of unclassified indicators with the public; and (3) the sharing of cybersecurity threats with entities to prevent or mitigate adverse effects…

Permits private entities to monitor, and operate defensive measures to detect, prevent, or mitigate cybersecurity threats or security vulnerabilities on: (1) their own information systems; and (2) with authorization and written consent, the information systems of other private or government entities. Authorizes such entities to monitor information that is stored on, processed by, or transiting such monitored systems.

Allows entities to share and receive indicators and defensive measures with other entities or the federal government. Requires recipients to comply with lawful restrictions that sharing entities place on the sharing or use of shared indicators or defensive measures.

Requires the federal government and entities monitoring, operating, or sharing indicators or defensive measures: (1) to utilize security controls to protect against unauthorized access or acquisitions, and (2) prior to sharing an indicator, to remove personal information of or identifying a specific person not directly related to a cybersecurity threat…

Exempts from antitrust laws private entities that, for cybersecurity purposes, exchange or provide: (1) cyber threat indicators; or (2) assistance relating to the prevention, investigation, or mitigation of cybersecurity threats. Makes such exemption inapplicable to price-fixing, allocating a market between competitors, monopolizing or attempting to monopolize a market, boycotting, or exchanges of price or cost information, customer lists, or information regarding future competitive planning.

Basically, CISA allows — encourages — owners and operators of cyber-networks to work with each other and the public sector to monitor and defend the networks. The legislation does this by reducing the chance of successful lawsuits involving actions taken for this purpose.

DHS will play a key role brokering private with private and private with public information flows.  In fact, according to The Hill — and what was said and done on the Senate floor Tuesday — “funneling the vast majority of CISA data through DHS was a key compromise the bill’s backers struck to win the support of on-the-fence lawmakers.” For some DHS is considered more circumspect than other federal options.

Many in the tech community have resisted the measure.  Most privacy advocates have been adamantly opposed.  There is evidence that some at DHS do not want the authority being granted to it.  But that’s not what Secretary Johnson seemed to say.

According to Wired:

The version of CISA passed Tuesday, in fact, spells out that any broadly defined “cybersecurity threat” information gathered can be shared “notwithstanding any other provision of law.” Privacy advocates consider that a vague and potentially reckless exemption in the protections of Americans’ personal information. “Every law is struck down for the purposes of this information sharing: financial privacy, electronic communications privacy, health privacy, none of it would matter,” says Robyn Greene, policy counsel for the Open Technology Institute. “That’s a dangerous road to go down.”

Given the recent spike in hacks, seems the body-politic has decided better the devil you know than the devil not known.

June 4, 2015

What do you know and how do you know it?

Filed under: General Homeland Security,Legal Issues,Privacy and Security,Radicalization,Strategy — by Philip J. Palin on June 4, 2015

Monday the Supreme Court remanded for further consideration Equal Employment Opportunity Commission v. Abercrombie & Fitch Stores, Inc.   In 2008 the Company decided not to hire an otherwise well-suited prospective employee because it is her religious practice to wear a hijab (below).

The EEOC sued on behalf of Samantha Elauf under Title VII of the Civil Rights Act of 1964.  The Act “prohibits a prospective employer from refusing to hire an applicant in order to avoid accommodating a religious practice that it could accommodate without undue hardship.”

A Federal District Court jury originally found on behalf of the EEOC and awarded damages to Ms. Elauf, but the Tenth Circuit Court of Appeals reversed the decision finding that Ms. Elauf had not explicitly informed the Company that her head-covering is an act of religious devotion.  Without this “actual knowledge” of a need for religious accommodation the Tenth Circuit found that the Company was within its rights to stand-by a dress-code that does not allow employees to wear “caps”.

The Supreme Court disagrees.

The 8-to-1 decision written by Justice Scalia strikes me as narrowly framed to discern the law’s intent.  The decision is, nonetheless, being hailed as a victory for inclusion, tolerance, and respect for religious practice.  The Executive Director of the Council on American-Islamic Relations commented, “We welcome this historic ruling in defense of religious freedom at a time when the American Muslim community is facing increased levels of Islamophobia.”

Samantha Elauf and her mother

Samantha Elauf with her mother

Title VII establishes what Justice Scalia characterizes as “favored treatment” for ” all aspects of religious observance and practice, as well as belief, unless an employer demonstrates that he is unable to reasonably accommodate to” a “religious observance or practice without undue hardship on the conduct of the employer’s business.”  On remand the lower courts will take up whether or not accommodation in this case would cause undue hardship.

Meanwhile, Congress struggles to determine what constitutes an undue hardship on personal privacy, especially in collection of meta-data and other often prosaic but powerful tools of digital tracking.  Can the National Security Agency reasonably accommodate citizens varied expectations of privacy?  Or has any such expectation become an unreasonable delusion?

Meanwhile, a DHS red team encountered barely any hardship at all penetrating TSA security protocols.  ABC News reports, “According to officials briefed on the results of a recent Homeland Security Inspector General’s report, TSA agents failed 67 out of 70 tests, with Red Team members repeatedly able to get potential weapons through checkpoints.”  Overly accommodating?

Meanwhile, how well can the US economy reasonably accommodate continued drought in California, recurring floods in Texas and Oklahoma, and the accelerating financial and human costs of natural hazards around the globe?  As the escalating controversy regarding federal flood insurance demonstrates (and Bill Cumming has explained), even measures meant to help accommodate individuals to risk can actually end up causing undue hardship.

In their consideration of EEOC v A&F, I hear the Supremes offering some wisdom that can extend well-beyond the religious significance of our fashion choices.

This wisdom, at least for me, is amplified by the paradoxies — some would say, absurdities — of Samantha Elauf’s situation.   As devout, even pious, as many of her fellow citizens of Oklahoma, Ms. Elauf regularly covers her head to symbolize her obedience to God and as an expression of personal modesty.  As an all-American girl — evidenced by her Instagram account — Ms. Elauf is at ease blending this religious sensibility with the merchandising strategy of Abercrombie and Fitch.  One sample immediately below.

A&F Merry Christmas

For its 2012 calendar A&F kept the Christ in Christmas

This is a profoundly American — some adversaries would insist, satanic — tendency to accommodate what many, perhaps most, of the world could perceive as irreconcilably dueling realities.  We are being challenged again and again to appear on a supposed field of honor to kill or be killed defending this convergence of contradictions.

The brief Supreme Court opinions — Scalia for the majority: 7 pages, Alito concurring: 6 pages, Thomas dissenting: 10 pages — are examinations of applied epistemology.  What do we know and how do we know it?  And applied ethics: what is our obligation to act in accordance with what we know?

According to our magistrates, knowledge is often implicit, typically contingent on context, and, when involving humans, requires a careful assessment of intention. Knowledge is applied rightly and wisely when it recognizes contending values, honors diversity, and is especially solicitous regarding the role of individuals as moral agents.

This is a radical view of the world and our place in it that is considered naive and/or heretical and/or threatening by many millions.  It is also the great attraction of the American experience for millions more.

When we look to our most contentious homeland security issues — for example, privacy v. intelligence-operations, liberty v. security, individual v. community  — are the epistemological principles articulated in EEOC v A&F the rule or the exception?  Are we predisposed to accommodate or insist?  Are we exclusive or inclusive? How much are we tempted to the dogmatism of our critics?

When challenged to a duel do we have sufficient knowledge of self and other to select the most appropriate weapon: sword, plowshare, or pie shell (whipped cream or lemon custard)?

Non sequitur_Messing with Absolutists

Is this heresy, comedy, or serious commentary? (Non Sequitur by Wiley Miller)

December 28, 2014

NSA internal privacy audits released

Filed under: Intelligence and Info-Sharing,Privacy and Security — by Philip J. Palin on December 28, 2014

While most of us were either dreaming of sugar plums or battling traffic to get over the river to grandma’s house, the National Security Agency released a set of heavily redacted, but still interesting reports.

According to the NSA’s December 23 cover-letter:

Following a classification review, the National Security Agency (NSA) is releasing in redacted form NSA reports to the President’s Intelligence Oversight Board (IOB). The release includes quarterly reports submitted from the fourth quarter of 2001 to the second quarter of 2013. The materials also include four annual reports (2007, 2008, 2009, 2010) which are consolidations of the relevant quarterly reports…

The released reports demonstrate that NSA has multi-layered protections in place for signals intelligence information. These protections apply across the full spectrum of the signals intelligence process. At the targeting stage, NSA collects only those communications that it is authorized by law to collect in response to valid foreign intelligence and counterintelligence requirements. After foreign intelligence or counterintelligence information is acquired, it must be analyzed to remove or mask certain protected categories of information, including U.S. person information, unless specific exceptions apply. This process is referred to as “minimization.” Without appropriate minimization, NSA intelligence reporting generally cannot be distributed to other agencies—“disseminated,” in intelligence parlance—even if the other agency requires the information. Reports generated as a result of this process are subject to further constraints on access and handling.

NSA accounts for all identified errors and violations, no matter how slight, in its oversight reporting process. Internally, a wide range of NSA offices currently exercise oversight authority, including the Office of the Inspector General, the Office of the General Counsel, the Office of the Director of Compliance, the Office of Civil Liberties and Privacy, and compliance offices embedded within NSA’s mission elements. Externally, errors are reported to a variety of departments and offices across all three branches of government, depending on the nature of the authority involved. The quarterly reports released today are provided to the Department of Defense Senior Intelligence Oversight Official (DOD SIOO) (formerly the Assistant to the Secretary of Defense for Intelligence Oversight (ATSD(IO)), which plays an important role in ensuring NSA operates within the law.

The link will take you to the NSA website where each of the quarterly or calendar year reports can be opened and read.


November 6, 2014

Klayman appeal

Filed under: Intelligence and Info-Sharing,Legal Issues,Privacy and Security — by Philip J. Palin on November 6, 2014

Tuesday oral arguments were heard by the Federal Appeals Court for the DC circuit in a key case related to NSA mass surveillance.

Last December, finding for the plaintiffs in Klayman v Obama, Federal District Judge Richard Leon wrote,

I cannot imagine a more “indiscriminate” and “arbitrary invasion” than this systematic and high-tech collection and retention of personal data on virtually every single citizen for purposes of querying and analyzing it without prior judicial approval. Surely such a program infringes on that “degree of privacy” that the Founders enshrined in the Fourth Amendment.  Indeed,  I have little doubt that the author of our Constitution, James Madison, who cautioned us to be beware “the abridgement of freedom of the people by gradual and silent encroachments by those in power,” would be aghast. (Prior attention by HLSWatch)

Judge Leon stayed his injunction of further surveillance of citizen phone records pending appellate review, given the national security implications and, what the Judge called, “novel” privacy implications of the case.

Josh Gerstein, writing in Politico of Tuesday’s proceedings, perceives:

During oral arguments Tuesday, three judges of the U.S. Court of Appeals for the D.C. Circuit seemed skeptical in various ways about the lawsuits that led to U.S. District Court Judge Richard Leon’s ruling last December that the NSA’s surveillance was likely unconstitutional.

Reporting for The Hill, Julie Hattem seems to agree:

Critics of the National Security Agency’s most embattled program harshly condemned the spying in a top appeals court on Tuesday. Judges, however, seemed largely skeptical of their claims that the spy agency’s bulk collection of Americans’ phone records was unconstitutional. Instead, they seemed to express a desire to reverse a lower court ruling nearly one year ago that called the NSA program “almost Orwellian.”

An audio recording of Tuesday’s Oral Arguments is available here.  I have not yet seen a transcript. Writing at the always informative Lawfare blog, Wells Bennett provides his own summary of the arguments.

Mr. Bennett is less inclined than the reporters quoted above to hear a predisposition in the three judge panel’s line of inquiry.  Bennett notes, “the day’s questioning was even-handed and vigorous, and exposed weaknesses in arguments advanced by both the government and plaintiffs alike…”

Before the end of the year appellate decisions are expected in three cases emerging from the Snowden revelations: Klayman v Obama, ACLU v Clapper, and Smith v  Obama.  If all meet with similar appellate findings, then no Supreme Court review is likely.  If they disagree — and depending on the nature of the disagreement — the Supreme Court is more likely to take action to resolve.

Late last year, just before the Klayman decision, Edward Snowden commented to the Washington Post, “For me, in terms of personal satisfaction, the mission’s already accomplished,” he said. “I already won. As soon as the journalists were able to work, everything that I had been trying to do was validated. “

A buddy in the intelligence community insists, “Snowden has made all of us less secure.”  A long-time lawyer complains of domestic surveillance, “It’s like an ulcer.  Maybe it originated with external stress, but now it’s eating us from the inside.”

What’s the right balance?  The courts are being asked to decide.

July 3, 2014

Hope, fear, and prospect theory

CBP and 8 year old

Photograph by Jennifer Whitney  for the New York Times

Chris Bellavita hopes the QHSR  will advance homeland security.  I fear too few will engage the QHSR to produce a sufficient effect. (Chris, btw bases his hope on evidence from the first QHSR while I deploy mostly worry and cynicism.)

Parents in Honduras, El Salvador, Guatemala, and elsewhere hope their children will find a better life in the United States. Others in Virginia’s Seventh Congressional District, Murietta, California, and elsewhere fear these children will unravel the rule of law.

Some Sunni Salafist fighters hope they are creating the foundations of a just and righteous society across what is now Northern Syria and Iraq, eventually the whole world.  Many Shia faithful and others fear they are numbered among the unrighteous to be converted or killed.

Google, Facebook, Yahoo, Twitter and many geeks still unknown, hope to bring the whole world into our hand-helds, opening exciting opportunities for meaningful relationships and untold riches.  Some of us fear our credit-scores — and more substantive identities — are being delivered into the hands of criminals, terrorists, con-artists, corporate voyeurs, NSA spooks and more.

The current Executive hopes to establish and consistently apply a rigorous set of principles and due process by which evil can be prevented and sacred values preserved (while sources and methods are protected).  Senators Paul and Wyden among others fear that any hidden act claimed as lawful is a hot-house of hubris where the very best intentions will be incrementally reversed.

They want to retire to the beauty of the shore or mountainside or river or forest or such.  The prospect of hurricane, flood, earthquake, and fire prompt some second-thoughts.

We are tempted — especially those of us in homeland security — to treat risk as something that might be measured as accurately as an average shoe-size… if only we can gather enough shoes.  Imelda where art thou?

But the risk that matters most may be imagined more than measured.  Big hirsute Hobbit feet may be the common heuristic, no matter how many ballerinas bounce about us.

Over thirty years ago Tversky and Kahneman showed us, “Decision making under risk can be viewed as a choice between prospects or gambles.”  It is how we frame our expectations that decide our perspective on risk and thereby determine what choices seem rational.

For most our frame-on-reality is decided by a reference point: typically an expectation of the status quo persisting.  If we are more-or-less satisfied (or psychologically risk-averse) we worry more over the prospect of losing than embrace an opportunity to gain.  This can apply even if we have little to lose.  We  tend  to over-weight the downside and under-estimate positive likelihood.

Unless we are risk-seeking. As is typical with criminals, terrorists, and teenage boys. By the early 1990s Tversky and Kahneman had found, “Risk-seeking choices are consistently observed in two classes of decision problems. First, people often prefer a small probability of winning a large prize over the expected value of that prospect. Second, risk seeking is prevalent when people must choose between a sure loss and a substantial probability of a larger loss.”

There are other variations of human rationality that do not square with “expected utility” (rationality according to economists).  But risk-seeking has particular relevance for homeland security.

When my great-grandfather returned to England from another colonial war and had the audacity to marry a Scots seamstress of another (Christian) faith, they faced the disdain of family and very constrained prospects. Perceiving only losses to lose, he and she set out for Philadelphia.  The risk was real, but seemed less to them than remaining in Newcastle.

Nineteenth century Newcastle had a murder-rate considerably less than today’s Tegucigalpa (10 per million versus 1690 per million).  Who says the parent of the eight-year-old in the picture above has not made a reasonable calculation?

Today I will purchase a lottery ticket with a small probability of winning a large prize.  Early this week a new Caliphate was proclaimed.  Was the self-styled Caliph’s reasoning all that different than mine?

There are too many whose reference point is a land-of-loss, especially loss of hope.  The risks they are willing to take — heroic or demonic depending on taste — are worth our notice, a touch of fear, and some courageous creativity.  If reduction of risk-seeking is a goal, our target is their prospective imagination.

April 10, 2014

Mass aggregation and analysis of data: Debate, discussion, desiderata

Filed under: Intelligence and Info-Sharing,Legal Issues,Media,Privacy and Security — by Philip J. Palin on April 10, 2014

On Monday the Supreme Court declined a petition to expedite consideration of Klayman v. Obama.   The plantiffs had sought to by-pass appellate review given the government’s “outrageous intrusion of privacy” confirmed by a Federal District Court’s finding.

Klayman is one of several cases focused on the government’s aggregation and analysis of metadata, as exposed by the Edward Snowden document releases.  (Prior consideration by HLSWatch is available here.)

Since the December decision in Klayman at least one other Federal District Court has affirmed the constitutionality of actions that the judge in Klayman suggested would cause Madison to spin in his grave.  A variety of related cases — and contending judgments — are working their way through the courts.

It would have been unusual for the Supreme Court to abbreviate the process.  On this issue a fulsome set of legal engagements should serve to clarify key issues.

The political process around mass surveillance is also advancing.  On March 25 the President outlined several reforms to how metadata is collected and accessed.  The Republican Chair and ranking Democrat on the House Intelligence Committee have proposed their own reforms. There is also an effort underway to frame-up policy directions for the digital domain that go beyond a privacy-v-security binary.

The political context features several advocacy groups, such as the ACLU and EFF, pressing for privacy rights; several commercial organizations including AT&T, Verizon, Google and Facebook reluctant to be identified  as co-conspirators in invading consumer privacy; and a mainstream media keen to cover any source of conflict.

At least in the United States there is deeply divided public opinion.  For example one January poll found that 48 percent of respondents approved and 47 percent did not approve of tracking phone calls for potential terrorist links. Roughly twenty-percent of those who approved of the phone tracking also agreed the program is “too much intrusion into Americans’ private life”.   This tracks with what seems to be increasing concern that “anti-terrorism policies” threaten civil liberty, even as support for specific anti-terrorism activities remains strong.

TREND: What concerns you more about the government’s anti-terrorism policies, that they have gone too far in restricting the average person’s civil liberties, or that they have not gone far enough to adequately protect the country?
                     Jan 09  Oct 01  Aug 02  Jul 10  Jan 14
                     2014    2013    2013    2013    2010

Gone too far         51      43      46      45      25
Not gone far enough  33      40      39      40      63
DK/NA                16      17      15      15      12

Are these public attitudes contradictory… ambivalent… paradoxical?  Are these the ill-considered judgments of a poorly informed mass or a signal of profound crowd-wisdom?

Our intellectual culture is (mostly unconsciously) influenced by Hegel (abstract, negative, concrete or sometimes thesis, antithesis, synthesis and more).  The law is especially Hegelian in its dependence on the adversarial process.  Well beyond the law we are inclined to engage contending perspectives in search for ideal solutions.  For some this ideal emerges from historical (empirical) context.  For others there is an ideal that transcends history and experience.  In either case there can be a tendency to exclude or negate one option in order to achieve an other.

It is worth noting this is Hegelianism without Hegel who wrote, “Genuine tragedies in the world are not conflicts between right and wrong. They are conflicts between two rights.”  But much of our current discontent with so many aspects of politics, law, and governance may very well emerge from an intellectual conceit that seeks the best and disdains the rest.

If you characterize an issue as privacy versus security, I will probably lean toward privacy.  To acknowledge this predisposition can be helpful. It ought not be confused with thought. First principles inform but very seldom resolve our problem-solving.  Thinking requires an examination of context and contingencies and potential consequences.

Privacy and security are not necessarily in conflict, as for example in the language of the Fourth Amendment: “The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated…”

When privacy and security are perceived to be in conflict, what is the source of conflict? What are the contingent Goods that an active instance of privacy or security seems to threaten?  For surely neither privacy nor security are ends-in-themselves.  Rather each are aspects of a more comprehensive Good or Goods.  Can we articulate our valuations to each other so that we might resolve the perceived conflict by directly addressing the goals which privacy and security are thought to advance (or retard)?  Are we disagreeing over first principles or tertiary techniques?

Issues of privacy and security are clearly being considered as matters of law.  In these legal considerations ancient ethical concerns are referenced and there will clearly be contemporary ethical implications whatever the legal outcomes.

The current political arguments strike me as mostly rhetorical rather than ethical.   Typically absolute rights or obvious needs are assumed much more than demonstrated. Strawmen are set forth by every side.

In both the legal and political domains the consideration tends to be adversarial — pseudo-Hegelian — in method.   I have no objection to this as one of several methods by which a shared understanding can emerge.  I am concerned if it is the predominant method.

Where do you participate in serious and sustained consideration of important ethical issues?   Especially civic issues such as the matter of privacy v. security?  Where and how have you seen non-adversarial methods generate practical solutions?

I hope your answers are more fruitful than my own.  If not, I wonder how much the paucity of such approaches suggest a social-civic anemia for which our current political confrontations are but a symptom?

March 11, 2014

Privacy is theft

Filed under: Cybersecurity,General Homeland Security,Privacy and Security — by Christopher Bellavita on March 11, 2014

News item:

The Custom and Border Protection (CBP) official at Hartsfield–Jackson airport scanned Martin Bryant’s fingerprints.

“What’s that little device you’ve got clipped on?” he asked.

Bryant was entering the United States from the UK.  He was wearing a Narrative Clip.  The Clip is “a tiny camera that takes a photo of what’s in front of you every 30 seconds.”


Bryant planned to use the Clip to document his trip, to “capture the flavor of his journey.” As he approached the CBP official, “a terrible realization dawned on me – I’d forgotten to take the Clip off.”

The story has a sort of happy ending.  Bryant had to delete the airport pictures he took — or rather, the Clip took, but he was eventually allowed to continue his travels.

It was the first time the CBP officials had seen that particular device.  Bryant writes that he

…expected stern faced, intolerant treatment from officials who wanted to get rid of an odd British geek’s weird little camera as soon as possible, and instead they took the time to understand what they were dealing with and respond in an appropriate manner.”

News item:

Homeland security students contemplate how wearable technology, like Google Glass, can assist first responders for event security, disaster response, and other tasks.

Wearable glass technology could be valuable in reinforcing the [TSA’s]… security techniques for its Behavior Detection Officers…. A computerized eyeglass device could assist in gauging a passenger’s physiological responses, such as pupil dilation or micro facial expressions. The technology could also potentially monitor a traveler’s walking gait to determine if the person is concealing an item, as well as provide a remote feed where other officers can analyze what the wearer is seeing.


News item:

The PEW Research Center issues a report on Digital Life in 2025, reminding readers that the World Wide Web is 25 years old on March 12.

Among the report’s good news bad news hopes:

Augmented reality and wearable devices will be implemented to monitor and give quick feedback on daily life….

People will continue – sometimes grudgingly – to make tradeoffs favoring convenience and perceived immediate gains over privacy; and privacy will be something only the upscale will enjoy.


There is no need to worry about this Brave New World

Here are three slogans from the David Eggers book, The Circle. Repeating them 15 minutes twice a day will put any concerns you might have to rest, once in the morning and once before you turn off all your devices and go to sleep.

Sharing is caring.

Secrets are lies.

Privacy is theft.

Here’s an excerpt from The Circle (208 ff).  An elected official decides to provide ultimate transparency by wearing a steroids version of the Clip during every waking moment.

Everything she does will be streamed in real time.

Showing care by sharing everything.

Embracing truth by having no secrets.

Demonstrating honesty by shedding privacy.

I intend to show how democracy can and should be: entirely open, entirely transparent,  Starting today… I will be wearing [the Clip on steroids]. My every meeting, movement, my every word, will be available to all my constituents and to the world.

“And what if those who want to meet with you don’t want a given meeting to be broadcast?” she is asked.

‘Well, then they will not meet with me.… You’re either transparent or you’re not. You’re either accountable or you’re not. What would anyone have to say to me that couldn’t be said in public? What part of representing the people should not be known by the very people I’m representing?

It begins now for me… And I hope it begins soon for the rest of the elected leaders in this country – and for those in everyone of the world’s democracies.

Before too long, in Eggers’ transparent new world, no one gets elected or appointed to any office unless they promise to wear “the Device.”

Why would they refuse to wear it?

What are they trying to hide?


News item:

Happy birthday, World Wide Web.  Without you, life would be

January 17, 2014

The President’s remarks on signals intelligence

Filed under: Cybersecurity,Intelligence and Info-Sharing,Privacy and Security — by Philip J. Palin on January 17, 2014

This is a cut-and-paste from the White House website of the President’s remarks given at the Department of Justice earlier today. The topic. as headlined by the White House, is “signals intelligence”. I have highlighted a few phrases in bold, toward the end of a long day and longer week. No particular insight is promised in the highlights. But especially with this President, a careful read of the whole is almost always worth it.


THE PRESIDENT: At the dawn of our Republic, a small, secret surveillance committee borne out of the “The Sons of Liberty” was established in Boston. And the group’s members included Paul Revere. At night, they would patrol the streets, reporting back any signs that the British were preparing raids against America’s early Patriots.

Throughout American history, intelligence has helped secure our country and our freedoms. In the Civil War, Union balloon reconnaissance tracked the size of Confederate armies by counting the number of campfires. In World War II, code-breakers gave us insights into Japanese war plans, and when Patton marched across Europe, intercepted communications helped save the lives of his troops. After the war, the rise of the Iron Curtain and nuclear weapons only increased the need for sustained intelligence gathering. And so, in the early days of the Cold War, President Truman created the National Security Agency, or NSA, to give us insights into the Soviet bloc, and provide our leaders with information they needed to confront aggression and avert catastrophe.

Throughout this evolution, we benefited from both our Constitution and our traditions of limited government. U.S. intelligence agencies were anchored in a system of checks and balances — with oversight from elected leaders, and protections for ordinary citizens. Meanwhile, totalitarian states like East Germany offered a cautionary tale of what could happen when vast, unchecked surveillance turned citizens into informers, and persecuted people for what they said in the privacy of their own homes.

In fact, even the United States proved not to be immune to the abuse of surveillance. And in the 1960s, government spied on civil rights leaders and critics of the Vietnam War. And partly in response to these revelations, additional laws were established in the 1970s to ensure that our intelligence capabilities could not be misused against our citizens. In the long, twilight struggle against Communism, we had been reminded that the very liberties that we sought to preserve could not be sacrificed at the altar of national security.

If the fall of the Soviet Union left America without a competing superpower, emerging threats from terrorist groups, and the proliferation of weapons of mass destruction placed new and in some ways more complicated demands on our intelligence agencies. Globalization and the Internet made these threats more acute, as technology erased borders and empowered individuals to project great violence, as well as great good. Moreover, these new threats raised new legal and new policy questions. For while few doubted the legitimacy of spying on hostile states, our framework of laws was not fully adapted to prevent terrorist attacks by individuals acting on their own, or acting in small, ideologically driven groups on behalf of a foreign power.

The horror of September 11th brought all these issues to the fore. Across the political spectrum, Americans recognized that we had to adapt to a world in which a bomb could be built in a basement, and our electric grid could be shut down by operators an ocean away. We were shaken by the signs we had missed leading up to the attacks — how the hijackers had made phone calls to known extremists and traveled to suspicious places. So we demanded that our intelligence community improve its capabilities, and that law enforcement change practices to focus more on preventing attacks before they happen than prosecuting terrorists after an attack.

It is hard to overstate the transformation America’s intelligence community had to go through after 9/11. Our agencies suddenly needed to do far more than the traditional mission of monitoring hostile powers and gathering information for policymakers. Instead, they were now asked to identify and target plotters in some of the most remote parts of the world, and to anticipate the actions of networks that, by their very nature, cannot be easily penetrated with spies or informants.

And it is a testimony to the hard work and dedication of the men and women of our intelligence community that over the past decade we’ve made enormous strides in fulfilling this mission. Today, new capabilities allow intelligence agencies to track who a terrorist is in contact with, and follow the trail of his travel or his funding. New laws allow information to be collected and shared more quickly and effectively between federal agencies, and state and local law enforcement. Relationships with foreign intelligence services have expanded, and our capacity to repel cyber-attacks have been strengthened. And taken together, these efforts have prevented multiple attacks and saved innocent lives — not just here in the United States, but around the globe.

And yet, in our rush to respond to a very real and novel set of threats, the risk of government overreach — the possibility that we lose some of our core liberties in pursuit of security — also became more pronounced. We saw, in the immediate aftermath of 9/11, our government engaged in enhanced interrogation techniques that contradicted our values. As a Senator, I was critical of several practices, such as warrantless wiretaps. And all too often new authorities were instituted without adequate public debate.

Through a combination of action by the courts, increased congressional oversight, and adjustments by the previous administration, some of the worst excesses that emerged after 9/11 were curbed by the time I took office. But a variety of factors have continued to complicate America’s efforts to both defend our nation and uphold our civil liberties.

First, the same technological advances that allow U.S. intelligence agencies to pinpoint an al Qaeda cell in Yemen or an email between two terrorists in the Sahel also mean that many routine communications around the world are within our reach. And at a time when more and more of our lives are digital, that prospect is disquieting for all of us.

Second, the combination of increased digital information and powerful supercomputers offers intelligence agencies the possibility of sifting through massive amounts of bulk data to identify patterns or pursue leads that may thwart impending threats. It’s a powerful tool. But the government collection and storage of such bulk data also creates a potential for abuse.

Third, the legal safeguards that restrict surveillance against U.S. persons without a warrant do not apply to foreign persons overseas. This is not unique to America; few, if any, spy agencies around the world constrain their activities beyond their own borders. And the whole point of intelligence is to obtain information that is not publicly available. But America’s capabilities are unique, and the power of new technologies means that there are fewer and fewer technical constraints on what we can do. That places a special obligation on us to ask tough questions about what we should do.

And finally, intelligence agencies cannot function without secrecy, which makes their work less subject to public debate. Yet there is an inevitable bias not only within the intelligence community, but among all of us who are responsible for national security, to collect more information about the world, not less. So in the absence of institutional requirements for regular debate — and oversight that is public, as well as private or classified — the danger of government overreach becomes more acute. And this is particularly true when surveillance technology and our reliance on digital information is evolving much faster than our laws.

For all these reasons, I maintained a healthy skepticism toward our surveillance programs after I became President. I ordered that our programs be reviewed by my national security team and our lawyers, and in some cases I ordered changes in how we did business. We increased oversight and auditing, including new structures aimed at compliance. Improved rules were proposed by the government and approved by the Foreign Intelligence Surveillance Court. And we sought to keep Congress continually updated on these activities.

What I did not do is stop these programs wholesale — not only because I felt that they made us more secure, but also because nothing in that initial review, and nothing that I have learned since, indicated that our intelligence community has sought to violate the law or is cavalier about the civil liberties of their fellow citizens.

To the contrary, in an extraordinarily difficult job — one in which actions are second-guessed, success is unreported, and failure can be catastrophic — the men and women of the intelligence community, including the NSA, consistently follow protocols designed to protect the privacy of ordinary people. They’re not abusing authorities in order to listen to your private phone calls or read your emails. When mistakes are made — which is inevitable in any large and complicated human enterprise — they correct those mistakes. Laboring in obscurity, often unable to discuss their work even with family and friends, the men and women at the NSA know that if another 9/11 or massive cyber-attack occurs, they will be asked, by Congress and the media, why they failed to connect the dots. What sustains those who work at NSA and our other intelligence agencies through all these pressures is the knowledge that their professionalism and dedication play a central role in the defense of our nation.

Now, to say that our intelligence community follows the law, and is staffed by patriots, is not to suggest that I or others in my administration felt complacent about the potential impact of these programs. Those of us who hold office in America have a responsibility to our Constitution, and while I was confident in the integrity of those who lead our intelligence community, it was clear to me in observing our intelligence operations on a regular basis that changes in our technological capabilities were raising new questions about the privacy safeguards currently in place.

Moreover, after an extended review of our use of drones in the fight against terrorist networks, I believed a fresh examination of our surveillance programs was a necessary next step in our effort to get off the open-ended war footing that we’ve maintained since 9/11. And for these reasons, I indicated in a speech at the National Defense University last May that we needed a more robust public discussion about the balance between security and liberty. Of course, what I did not know at the time is that within weeks of my speech, an avalanche of unauthorized disclosures would spark controversies at home and abroad that have continued to this day.

And given the fact of an open investigation, I’m not going to dwell on Mr. Snowden’s actions or his motivations; I will say that our nation’s defense depends in part on the fidelity of those entrusted with our nation’s secrets. If any individual who objects to government policy can take it into their own hands to publicly disclose classified information, then we will not be able to keep our people safe, or conduct foreign policy. Moreover, the sensational way in which these disclosures have come out has often shed more heat than light, while revealing methods to our adversaries that could impact our operations in ways that we may not fully understand for years to come.

Regardless of how we got here, though, the task before us now is greater than simply repairing the damage done to our operations or preventing more disclosures from taking place in the future. Instead, we have to make some important decisions about how to protect ourselves and sustain our leadership in the world, while upholding the civil liberties and privacy protections that our ideals and our Constitution require. We need to do so not only because it is right, but because the challenges posed by threats like terrorism and proliferation and cyber-attacks are not going away any time soon. They are going to continue to be a major problem. And for our intelligence community to be effective over the long haul, we must maintain the trust of the American people, and people around the world.

This effort will not be completed overnight, and given the pace of technological change, we shouldn’t expect this to be the last time America has this debate. But I want the American people to know that the work has begun. Over the last six months, I created an outside Review Group on Intelligence and Communications Technologies to make recommendations for reform. I consulted with the Privacy and Civil Liberties Oversight Board, created by Congress. I’ve listened to foreign partners, privacy advocates, and industry leaders. My administration has spent countless hours considering how to approach intelligence in this era of diffuse threats and technological revolution. So before outlining specific changes that I’ve ordered, let me make a few broad observations that have emerged from this process.

First, everyone who has looked at these problems, including skeptics of existing programs, recognizes that we have real enemies and threats, and that intelligence serves a vital role in confronting them. We cannot prevent terrorist attacks or cyber threats without some capability to penetrate digital communications — whether it’s to unravel a terrorist plot; to intercept malware that targets a stock exchange; to make sure air traffic control systems are not compromised; or to ensure that hackers do not empty your bank accounts. We are expected to protect the American people; that requires us to have capabilities in this field.

Moreover, we cannot unilaterally disarm our intelligence agencies. There is a reason why BlackBerrys and iPhones are not allowed in the White House Situation Room. We know that the intelligence services of other countries — including some who feign surprise over the Snowden disclosures — are constantly probing our government and private sector networks, and accelerating programs to listen to our conversations, and intercept our emails, and compromise our systems. We know that.

Meanwhile, a number of countries, including some who have loudly criticized the NSA, privately acknowledge that America has special responsibilities as the world’s only superpower; that our intelligence capabilities are critical to meeting these responsibilities, and that they themselves have relied on the information we obtain to protect their own people.

Second, just as ardent civil libertarians recognize the need for robust intelligence capabilities, those with responsibilities for our national security readily acknowledge the potential for abuse as intelligence capabilities advance and more and more private information is digitized. After all, the folks at NSA and other intelligence agencies are our neighbors. They’re our friends and family. They’ve got electronic bank and medical records like everybody else. They have kids on Facebook and Instagram, and they know, more than most of us, the vulnerabilities to privacy that exist in a world where transactions are recorded, and emails and text and messages are stored, and even our movements can increasingly be tracked through the GPS on our phones.

Third, there was a recognition by all who participated in these reviews that the challenges to our privacy do not come from government alone. Corporations of all shapes and sizes track what you buy, store and analyze our data, and use it for commercial purposes; that’s how those targeted ads pop up on your computer and your smartphone periodically. But all of us understand that the standards for government surveillance must be higher. Given the unique power of the state, it is not enough for leaders to say: Trust us, we won’t abuse the data we collect. For history has too many examples when that trust has been breached. Our system of government is built on the premise that our liberty cannot depend on the good intentions of those in power; it depends on the law to constrain those in power.

I make these observations to underscore that the basic values of most Americans when it comes to questions of surveillance and privacy converge a lot more than the crude characterizations that have emerged over the last several months. Those who are troubled by our existing programs are not interested in repeating the tragedy of 9/11, and those who defend these programs are not dismissive of civil liberties.

The challenge is getting the details right, and that is not simple. In fact, during the course of our review, I have often reminded myself I would not be where I am today were it not for the courage of dissidents like Dr. King, who were spied upon by their own government. And as President, a President who looks at intelligence every morning, I also can’t help but be reminded that America must be vigilant in the face of threats.

Fortunately, by focusing on facts and specifics rather than speculation and hypotheticals, this review process has given me — and hopefully the American people — some clear direction for change. And today, I can announce a series of concrete and substantial reforms that my administration intends to adopt administratively or will seek to codify with Congress.

First, I have approved a new presidential directive for our signals intelligence activities both at home and abroad. This guidance will strengthen executive branch oversight of our intelligence activities. It will ensure that we take into account our security requirements, but also our alliances; our trade and investment relationships, including the concerns of American companies; and our commitment to privacy and basic liberties. And we will review decisions about intelligence priorities and sensitive targets on an annual basis so that our actions are regularly scrutinized by my senior national security team.

Second, we will reform programs and procedures in place to provide greater transparency to our surveillance activities, and fortify the safeguards that protect the privacy of U.S. persons. Since we began this review, including information being released today, we have declassified over 40 opinions and orders of the Foreign Intelligence Surveillance Court, which provides judicial review of some of our most sensitive intelligence activities — including the Section 702 program targeting foreign individuals overseas, and the Section 215 telephone metadata program.

And going forward, I’m directing the Director of National Intelligence, in consultation with the Attorney General, to annually review for the purposes of declassification any future opinions of the court with broad privacy implications, and to report to me and to Congress on these efforts. To ensure that the court hears a broader range of privacy perspectives, I am also calling on Congress to authorize the establishment of a panel of advocates from outside government to provide an independent voice in significant cases before the Foreign Intelligence Surveillance Court.

Third, we will provide additional protections for activities conducted under Section 702, which allows the government to intercept the communications of foreign targets overseas who have information that’s important for our national security. Specifically, I am asking the Attorney General and DNI to institute reforms that place additional restrictions on government’s ability to retain, search, and use in criminal cases communications between Americans and foreign citizens incidentally collected under Section 702.

Fourth, in investigating threats, the FBI also relies on what’s called national security letters, which can require companies to provide specific and limited information to the government without disclosing the orders to the subject of the investigation. These are cases in which it’s important that the subject of the investigation, such as a possible terrorist or spy, isn’t tipped off. But we can and should be more transparent in how government uses this authority.

I have therefore directed the Attorney General to amend how we use national security letters so that this secrecy will not be indefinite, so that it will terminate within a fixed time unless the government demonstrates a real need for further secrecy. We will also enable communications providers to make public more information than ever before about the orders that they have received to provide data to the government.

This brings me to the program that has generated the most controversy these past few months — the bulk collection of telephone records under Section 215. Let me repeat what I said when this story first broke: This program does not involve the content of phone calls, or the names of people making calls. Instead, it provides a record of phone numbers and the times and lengths of calls — metadata that can be queried if and when we have a reasonable suspicion that a particular number is linked to a terrorist organization.

Why is this necessary? The program grew out of a desire to address a gap identified after 9/11. One of the 9/11 hijackers — Khalid al-Mihdhar — made a phone call from San Diego to a known al Qaeda safe-house in Yemen. NSA saw that call, but it could not see that the call was coming from an individual already in the United States. The telephone metadata program under Section 215 was designed to map the communications of terrorists so we can see who they may be in contact with as quickly as possible. And this capability could also prove valuable in a crisis. For example, if a bomb goes off in one of our cities and law enforcement is racing to determine whether a network is poised to conduct additional attacks, time is of the essence. Being able to quickly review phone connections to assess whether a network exists is critical to that effort.

In sum, the program does not involve the NSA examining the phone records of ordinary Americans. Rather, it consolidates these records into a database that the government can query if it has a specific lead — a consolidation of phone records that the companies already retained for business purposes. The review group turned up no indication that this database has been intentionally abused. And I believe it is important that the capability that this program is designed to meet is preserved.

Having said that, I believe critics are right to point out that without proper safeguards, this type of program could be used to yield more information about our private lives, and open the door to more intrusive bulk collection programs in the future. They’re also right to point out that although the telephone bulk collection program was subject to oversight by the Foreign Intelligence Surveillance Court and has been reauthorized repeatedly by Congress, it has never been subject to vigorous public debate.

For all these reasons, I believe we need a new approach. I am therefore ordering a transition that will end the Section 215 bulk metadata program as it currently exists, and establish a mechanism that preserves the capabilities we need without the government holding this bulk metadata.

This will not be simple. The review group recommended that our current approach be replaced by one in which the providers or a third party retain the bulk records, with government accessing information as needed. Both of these options pose difficult problems. Relying solely on the records of multiple providers, for example, could require companies to alter their procedures in ways that raise new privacy concerns. On the other hand, any third party maintaining a single, consolidated database would be carrying out what is essentially a government function but with more expense, more legal ambiguity, potentially less accountability — all of which would have a doubtful impact on increasing public confidence that their privacy is being protected.

During the review process, some suggested that we may also be able to preserve the capabilities we need through a combination of existing authorities, better information sharing, and recent technological advances. But more work needs to be done to determine exactly how this system might work.

Because of the challenges involved, I’ve ordered that the transition away from the existing program will proceed in two steps. Effective immediately, we will only pursue phone calls that are two steps removed from a number associated with a terrorist organization instead of the current three. And I have directed the Attorney General to work with the Foreign Intelligence Surveillance Court so that during this transition period, the database can be queried only after a judicial finding or in the case of a true emergency.

Next, step two, I have instructed the intelligence community and the Attorney General to use this transition period to develop options for a new approach that can match the capabilities and fill the gaps that the Section 215 program was designed to address without the government holding this metadata itself. They will report back to me with options for alternative approaches before the program comes up for reauthorization on March 28th. And during this period, I will consult with the relevant committees in Congress to seek their views, and then seek congressional authorization for the new program as needed.

Now, the reforms I’m proposing today should give the American people greater confidence that their rights are being protected, even as our intelligence and law enforcement agencies maintain the tools they need to keep us safe. And I recognize that there are additional issues that require further debate. For example, some who participated in our review, as well as some members of Congress, would like to see more sweeping reforms to the use of national security letters so that we have to go to a judge each time before issuing these requests. Here, I have concerns that we should not set a standard for terrorism investigations that is higher than those involved in investigating an ordinary crime. But I agree that greater oversight on the use of these letters may be appropriate, and I’m prepared to work with Congress on this issue.

There are also those who would like to see different changes to the FISA Court than the ones I’ve proposed. On all these issues, I am open to working with Congress to ensure that we build a broad consensus for how to move forward, and I’m confident that we can shape an approach that meets our security needs while upholding the civil liberties of every American.

Let me now turn to the separate set of concerns that have been raised overseas, and focus on America’s approach to intelligence collection abroad. As I’ve indicated, the United States has unique responsibilities when it comes to intelligence collection. Our capabilities help protect not only our nation, but our friends and our allies, as well. But our efforts will only be effective if ordinary citizens in other countries have confidence that the United States respects their privacy, too. And the leaders of our close friends and allies deserve to know that if I want to know what they think about an issue, I’ll pick up the phone and call them, rather than turning to surveillance. In other words, just as we balance security and privacy at home, our global leadership demands that we balance our security requirements against our need to maintain the trust and cooperation among people and leaders around the world.

For that reason, the new presidential directive that I’ve issued today will clearly prescribe what we do, and do not do, when it comes to our overseas surveillance. To begin with, the directive makes clear that the United States only uses signals intelligence for legitimate national security purposes, and not for the purpose of indiscriminately reviewing the emails or phone calls of ordinary folks. I’ve also made it clear that the United States does not collect intelligence to suppress criticism or dissent, nor do we collect intelligence to disadvantage people on the basis of their ethnicity, or race, or gender, or sexual orientation, or religious beliefs. We do not collect intelligence to provide a competitive advantage to U.S. companies or U.S. commercial sectors.

And in terms of our bulk collection of signals intelligence, U.S. intelligence agencies will only use such data to meet specific security requirements: counterintelligence, counterterrorism, counter-proliferation, cybersecurity, force protection for our troops and our allies, and combating transnational crime, including sanctions evasion.

In this directive, I have taken the unprecedented step of extending certain protections that we have for the American people to people overseas. I’ve directed the DNI, in consultation with the Attorney General, to develop these safeguards, which will limit the duration that we can hold personal information, while also restricting the use of this information.

The bottom line is that people around the world, regardless of their nationality, should know that the United States is not spying on ordinary people who don’t threaten our national security, and that we take their privacy concerns into account in our policies and procedures. This applies to foreign leaders as well. Given the understandable attention that this issue has received, I have made clear to the intelligence community that unless there is a compelling national security purpose, we will not monitor the communications of heads of state and government of our close friends and allies. And I’ve instructed my national security team, as well as the intelligence community, to work with foreign counterparts to deepen our coordination and cooperation in ways that rebuild trust going forward.

Now let me be clear: Our intelligence agencies will continue to gather information about the intentions of governments — as opposed to ordinary citizens — around the world, in the same way that the intelligence services of every other nation does. We will not apologize simply because our services may be more effective. But heads of state and government with whom we work closely, and on whose cooperation we depend, should feel confident that we are treating them as real partners. And the changes I’ve ordered do just that.

Finally, to make sure that we follow through on all these reforms, I am making some important changes to how our government is organized. The State Department will designate a senior officer to coordinate our diplomacy on issues related to technology and signals intelligence. We will appoint a senior official at the White House to implement the new privacy safeguards that I have announced today. I will devote the resources to centralize and improve the process we use to handle foreign requests for legal assistance, keeping our high standards for privacy while helping foreign partners fight crime and terrorism.

I have also asked my counselor, John Podesta, to lead a comprehensive review of big data and privacy. And this group will consist of government officials who, along with the President’s Council of Advisors on Science and Technology, will reach out to privacy experts, technologists and business leaders, and look how the challenges inherent in big data are being confronted by both the public and private sectors; whether we can forge international norms on how to manage this data; and how we can continue to promote the free flow of information in ways that are consistent with both privacy and security.

For ultimately, what’s at stake in this debate goes far beyond a few months of headlines, or passing tensions in our foreign policy. When you cut through the noise, what’s really at stake is how we remain true to who we are in a world that is remaking itself at dizzying speed. Whether it’s the ability of individuals to communicate ideas; to access information that would have once filled every great library in every country in the world; or to forge bonds with people on other sides of the globe, technology is remaking what is possible for individuals, and for institutions, and for the international order. So while the reforms that I have announced will point us in a new direction, I am mindful that more work will be needed in the future.

One thing I’m certain of: This debate will make us stronger. And I also know that in this time of change, the United States of America will have to lead. It may seem sometimes that America is being held to a different standard. And I’ll admit the readiness of some to assume the worst motives by our government can be frustrating. No one expects China to have an open debate about their surveillance programs, or Russia to take privacy concerns of citizens in other places into account. But let’s remember: We are held to a different standard precisely because we have been at the forefront of defending personal privacy and human dignity.

As the nation that developed the Internet, the world expects us to ensure that the digital revolution works as a tool for individual empowerment, not government control. Having faced down the dangers of totalitarianism and fascism and communism, the world expects us to stand up for the principle that every person has the right to think and write and form relationships freely — because individual freedom is the wellspring of human progress.

Those values make us who we are. And because of the strength of our own democracy, we should not shy away from high expectations. For more than two centuries, our Constitution has weathered every type of change because we have been willing to defend it, and because we have been willing to question the actions that have been taken in its defense. Today is no different. I believe we can meet high expectations. Together, let us chart a way forward that secures the life of our nation while preserving the liberties that make our nation worth fighting for.

Thank you. God bless you. May God bless the United States of America. (Applause.)

January 1, 2014

ACLU v Clapper: More complementary than conflicting?

Filed under: Intelligence and Info-Sharing,Legal Issues,Privacy and Security,Terrorist Threats & Attacks — by Philip J. Palin on January 1, 2014

Last Friday Federal District Judge William H. Pauley III released his decision in ACLU v. Clapper. Busy with post-Christmas travel and such I mostly heard the headlines.

Before reading the actual text — and overly influenced by those headlines — I intended to post today on the divergence of Judge Pauley from Judge Leon’s Klayman v Obama decision (see prior post).

But when I finally read the actual text of the decision, this non-lawyer finds significant complementarity in what Judges Leon and Pauley have decided.

Yes, Leon found bulk collection of meta-data to be illegal, while Pauley found the same practice legal.  But decisions (lawyerly or not) are often as icebergs where most of the weight is found below the surface.

In their analysis of what is being done by the US intelligence community and the potential implications for liberty, the two decisions seem to me to reach somewhat similar judgments. But Leon perceives innate abuse where, in the particular case before him, Pauley sees and hears mostly prospective rather than actual harm.

Again, you should read the original — which can be downloaded here — but to support my reading and entice you to read more, here is the opening of the Pauley decision, the bold highlights are my own:

The September 11th terrorist attacks revealed, in the starkest terms, just how dangerous and interconnected the world is. While Americans depended on technology for the conveniences of modernity, al-Qaeda plotted in a seventh-century milieu to use that technology against us. It was a bold jujitsu. And it succeeded because conventional intelligence gathering could not detect diffuse filaments connecting al-Qaeda.

Prior to the September 11th attacks, the National Security Agency (“NSA”) intercepted seven calls made by hijacker Khalid al-Mihdhar, who was living in San Diego, California, to an al-Qaeda safe house in Yemen. The NSA intercepted those calls using overseas signals intelligence capabilities that could not capture al-Mihdhar’s telephone number identifier.

Without that identifier, NSA analysts concluded mistakenly that al-Mihdhar was overseas and not in the United States. Telephony metadata would have furnished the missing infonnation and might have permitted the.NSA to notify the Federal Bureau of lnvestigation (“FBI”) of the fact that al-Mihdhar was calling the Yemeni safe house from inside the United States.

The Government learned from its mistake and adapted to confront a new enemy: a terror network capable of orchestrating attacks across the world. It launched a number of counter-measures, including a bulk telephony metadata collection program-a wide net that could find and isolate gossamer contacts among suspected terrorists in an ocean of seemingly disconnected data.

This blunt tool only works because it collects everything. Such a program, if unchecked, imperils the civil liberties of every citizen. Each time someone in the United States makes or receives a telephone call, the telecommunications provider makes a record of when, and to what telephone number the call was placed, and how long it lasted. The NSA collects that telephony metadata. If plumbed, such data can reveal a rich profile of every individual as well as a comprehensive record of people’s associations with one another.

The natural tension between protecting the nation and preserving civil liberty is squarely presented by the Government’s bulk telephony metadata collection program. Edward Snowden’s unauthorized disclosure of Foreign Intelligence Surveillance Court (“FISC”) orders has provoked a public debate and this litigation. While robust discussions are underway across the nation, in Congress, and at the White House, the question for this Court is whether the Government’s bulk telephony metadata program is lawful. This Court finds it is. But the question of whether that program should be conducted is for the other two coordinate branches of Government to decide.

Legality, efficacy, and wisdom are three quite different standards. They may — or may not — overlap.

December 19, 2013

Klayman v Obama

Filed under: Intelligence and Info-Sharing,Legal Issues,Privacy and Security,Terrorist Threats & Attacks — by Philip J. Palin on December 19, 2013

Many of the issues we have previously discussed in terms of balancing liberty and security are taken up in Monday’s decision by a federal district judge to grant a Motion for Preliminary Injunction regarding bulk collection of meta-data by the National Security Agency.

Among most legally-trained commentators, there seems to be a consensus the district court’s injunction will be overturned by the US Court of Appeals, based largely on the Supreme Court’s previous decision in Smith v Maryland where no reasonable expectation of privacy was extended to the telephone numbers we choose to dial.

Judge Richard Leon probably also expects his decision to be overturned at the appellate level.  His opinion is written, it seems to this non-lawyer, more for the benefit of the Supreme Court than as a matter of conforming with the details of current law.  Indeed, the Judge stayed his own order “in view of the national security interests at stake in this case and the novelty of the constitutional issues involved.” (My italics)

As regular readers might imagine, I am sorely tempted to opine on what the judge wrote.  I spent (too) much of Tuesday reading and re-reading the sixty -eight page decision.  I agree with most of what I read and while the government’s argument may still prevail I am grateful Judge Leon has teed-up the issues so well.

But in this instance I will exercise more restraint than usual and not share with you my favorite bits.  If you have cause to read Homeland Security Watch you really owe it to yourself — your life, fortune, sacred honor and posterity — to read the full opinion and order. Please find it here:  Klayman v Obama

Judge Leon has written the clearest non-technical description I have read of what the NSA has actually been doing.  His statement of facts places these actions in their full legal context. Some important operational judgments are offered.  His footnotes are especially insightful and trenchant.  Whatever your angle on this issue, this is an original text worth your time and careful attention.  Get it, read it, and reflect.


Almost a month earlier than previously promised (gosh, I wonder why?), Wednesday afternoon the White House released the Report and Recommendations of The President’s Review Group on Intelligence and Communications Technologies.   Including appendices the full report is 308 pages long.  I have not yet mastered the text.  Eventually we should try to compare and contrast Judge Leon’s text with this one.  It is entitled, “Liberty and Security in a Changing World.”

December 12, 2013

Five surveillance principles proposed

Filed under: Intelligence and Info-Sharing,Privacy and Security,Private Sector — by Philip J. Palin on December 12, 2013

Several leading technology companies have called on world governments — and especially the US government — to abide by five principles when engaging in information surveillance:

1.  Limiting Governments’ Authority to Collect Users’ Information

Governments should codify sensible limitations on their ability to compel service providers to disclose user data that balance their need for the data in limited circumstances, users’ reasonable privacy interests, and the impact on trust in the Internet. In addition, governments should limit surveillance to specific, known users for lawful purposes, and should not undertake bulk data collection of Internet communications.

2. Oversight and Accountability

Intelligence agencies seeking to collect or compel the production of information should do so under a clear legal framework in which executive powers are subject to strong checks and balances. Reviewing courts should be independent and include an adversarial process, and governments should allow important rulings of law to be made public in a timely manner so that the courts are accountable to an informed citizenry.

3.  Transparency About Government Demands

Transparency is essential to a debate over governments’ surveillance powers and the scope of programs that are administered under those powers. Governments should allow companies to publish the number and nature of government demands for user information. In addition, governments should also promptly disclose this data publicly.

4. Respecting the Free Flow of Information

The ability of data to flow or be accessed across borders is essential to a robust 21st century global economy. Governments should permit the transfer of data and should not inhibit access by companies or individuals to lawfully available information that is stored outside of the country. Governments should not require service providers to locate infrastructure within a country’s borders or operate locally.

5.  Avoiding Conflicts Among Governments

In order to avoid conflicting laws, there should be a robust, principled, and transparent framework to govern lawful requests for data across jurisdictions, such as improved mutual legal assistance treaty — or “MLAT” — processes. Where the laws of one jurisdiction conflict with the laws of another, it is incumbent upon governments to work together to resolve the conflict.

More background on this initiative and the guidelines can be found at reformgovernmentsurveillance.com

Eric Snowden’s exposure of National Security Agency practice has reminded me of a now quarter-century old critique of US intelligence practices by a British pal.  He commented that even the old rifle versus shotgun analogy did not capture the difference between US intelligence gathering and behavior by other spy agencies. “A shot-gun still requires some rough targeting.  US intelligence is more like a gas attack, wafting wherever the wind blows.”

My British colleague explained the difference as a matter of resources and especially budget.  “We have to choose our targets carefully.  The US has the money, men, and machines to spend billions on blind alleys.”

In this new century we have women and even better machines.  The so-called “black budget” also found in the Snowden leaks suggests the NSA spends about $10.5 billion per year, roughly 20 percent of the overall federal intelligence budget.  The British government spends about $3.2 billion on its overall intelligence operations.


I look forward to a great future for America – a future in which our country will match its military strength with our moral restraint, its wealth with our wisdom, its power with our purpose. (John F. Kennedy)

August 15, 2013

A welcome Presidential invitation (but please proceed even if there are no RSVPs)

Filed under: Intelligence and Info-Sharing,Legal Issues,Privacy and Security,Terrorist Threats & Attacks — by Philip J. Palin on August 15, 2013

AUGUST 16 UPDATE: Today the Washington Post reports on several hundred incidents of the NSA failing to conform with current regulations and legal boundaries for domestic surveillance.  This is where strong action by the executive — as outlined below — is most needed and can be most effective.


Friday the President used the White House press room to announce and take a few questions on proposals to better balance civil liberties with digital surveillance.

Monday the Wall Street Journal editorialized that these proposals constitute a “retreat on his core powers as Commander in Chief.”  If I understand the editorial correctly, the WSJ perceives the President has sovereign authority under Article II, Section 2 to spy on us as much as he perceives the nation’s security might require.  Judicial oversight as currently provided by the Foreign Intelligence Surveillance Act is, in their view, unconstitutional.  Any due process is, it would seem, collaboration with our enemies.

On the left hand: Writing in The Atlantic, Conor Friedersdorf conducts an eviscerating exegesis of the rather brief — even bland — Presidential statement and concludes, “Obama is still lying, obfuscating, and misleading the American people. In doing so, he is preventing representative democracy from functioning as well as it might.”   He perceives a President corrupted by power and given over to condescension, setting the stage for our liberties to be lost forever.

There are of course judgments farther to the right and left of these still recognizably reasoned opinions.  But rather quickly “right” and “left” are lost to something closer to Freudian obsessions or the deepest mysteries of Jung’s collective unconscious.  Obama becomes a token or talisman or target of spiritual warfare and whatever he says is treated like a just-discovered manuscript in a Dan Brown novel.

My take is more prosaic.  The President — like all of us — is a creature of his prior experiences.  Among these are 1) a black man with insider knowledge of white America, 2) community organizer, and 3) lawyer.

If the first prior is having any influence here, it is expressed in the President’s perpetual pragmatism.  He intends to “get ahead” (what this means specifically depends on context).  To do so he needs to be realistic about the impediments or threats he will encounter.  He is predisposed to action that mitigates or obviates knowable problems. The surveillance programs (and the drone program and much more) inherited from his predecessor are adapted, expanded, and subjected to more detailed processes.

As a community organizer he is sensitive to matching his interventions to the values, aspirations, capabilities, and readiness of those he is trying to organize.  He can facilitate, provoke, propose… but it is up to the community to choose and sustain (or not).  Fundamental issues can be teed up, but it is the community’s role  — not his — to decide.  Notice how often, including in this instance, he unveils a process that tends to turn the initiative over to others.  He will advocate for certain principles or objectives, but if and how these are adopted is really up to others.

As a lawyer President Obama is inclined to procedural solutions: a task force, a privacy advocate, checklists, reviews, appeals…  Justice Frankfurter once wrote, “The safeguards of due process of law and the equal protection of the laws summarize the history of freedom of English-speaking peoples running back to Magna Carta and reflected in the constitutional development of our people. The history of American freedom is, in no small measure, the history of procedure.”  Whether or not the President knows the quote, he regularly demonstrates his concurrent view.

As a white man I have not needed to be quite so pro-active regarding threats and impediments.  My approach to management and leadership is similar to that of a community organizer. The successes tend, I am proud to say, to be substantive and long-lasting.  But failure is much, much more common.   I am personally impatient with procedure, but as a matter of human history I agree with Frankfurter (and the President) on its important role.

There are tangible threats to the United States which surveillance can help prevent and mitigate.  There is a profound threat to our liberty that emerges from government surveillance, especially in this digitally networked era.  Procedures are, probably, the most important part of any large bureaucracy’s effort to mitigate abuse of this unprecedented surveillance capability.

In a different time or place I might, despite all my failures, still advocate for community-based engagement with these treacherous issues.  Unfortunately, in this time and place if our civil liberties are to be reasonably preserved in face of these extraordinary technical means, strong and specific Presidential action will be needed.  Legislation would be better, but I don’t think it will happen.  Community consensus would be even better, but on this issue nothing even close to consensus is possible any time soon.

It is problematic. It is paradoxical.  But a community’s strength sometimes depends on individuals to sacrifice legitimate power in order advance what is best for the community.  On Monday the Wall Street Journal editorial board complained, “Mr. Obama invited Congress to tie him and future presidents down with new oversight and limits on a surveillance program…”  It is right to extend the invitation.  It will be necessary to do even more.

June 10, 2013

I am, after all, a republican

Filed under: Legal Issues,Media,Privacy and Security,Terrorist Threats & Attacks — by Philip J. Palin on June 10, 2013

Glenn Greenwald and his colleagues at The Guardian continue to demonstrate the power of  the old school “mainstream media” to set an agenda.   Now we are hearing from Greenwald’s NSA source who explains, “I’m willing to sacrifice all… because I can’t in good conscience allow the US government to destroy privacy, internet freedom and basic liberties for people around the world with this massive surveillance machine they’re secretly building.”

And so, perhaps inevitably, a complicated issue of ethics and politics of the highest order will be personalized and reduced to melodrama.  Which, at least, gives me permission to tell my story.

The only claim I have on anything truly scholarly is a sort of silver-age knowledge of the constitution of late-republican Rome.  This involves the period from about 133 BC to the rise of Augustus (27 BC) when constitutional structures imploded and produced the Empire.  As a young man I read entirely too much Cicero and have carried the burden into old age.  It is a story of freedom thoughtlessly and selfishly sacrificed.

As a result the claims of a “unitary executive” by various players in the George W. Bush administration caused me considerable concern.  A life-long Republican (capital R) I had supported John McCain in 2000 and expected to do so again in 2008.  But in conversation with his national security team (in which homeland security was entirely subsumed) I became increasingly alarmed.

It was not so much what they intended to do.  It was how and why they were going to do it.   The world had, it seemed to them, become too dangerous for due process.  It depended on a few good men (mostly good, mostly men) to do what was needed to defend the nation against attack.   Further, the nation they sought to defend was an abstraction of power and interests that did not, listening carefully, seem to have much at all to do with the Constitution.

So in early 2008 I decided to work for the once-upon-a-time lecturer on constitutional law at the University of Chicago, who — it seemed to me at the time — combined a kind of tough Niebuhrian realism with a disciplined self-restraint that reflected both the Founders and a good slice of Cicero.

Like our NSA contractor/whistleblower/hero/traitor — Mr. Snowden — I suffered the consequences of my choice.  My wife has made the point that if we had given the campaign what we lost because we joined the campaign I might have at least been made ambassador to some obscure corner of the world.  More to the point, a lifetime of personal relationships and professional networks was largely sacrificed.  Even my Dad was disappointed.

Since his election President Obama has been very tough on terrorism or, as he prefers, “violent extremism”.  Several times he has exceeded what I perceive to be his appropriate constitutional role.  Especially in these cases the President has tended to argue that the controversial decision is an exception-that-proves-the-rule.  It may be little more than a fig leaf, but I have appreciated the nod to constitutional decorum even as I recall Augustus was a master of the technique.

Potentially more substantive, the President’s May 23 National Defense University speech called for a more extensive legal framework  that would explicitly limit his own authority and that of future executives.  But other than the classified PPD and other gracious acts of executive self-restraint will anything really change? Right now the speech is as likely to become a footnote — another fig leaf — in future explanations of the eventual collapse of our Constitution under conditions of perpetual war.

In this context I have found the revelations of NSA spying on you and me to be cause for considerable celebration.

Based on what can be known today it would seem that:

  • The spying has been undertaken in accordance with the laws and Congressional oversight — such as it is — has been consistently facilitated.
  • The spying has been undertaken only after judicial review and authorization of narrowly written warrants.
  • The spying has been structured and organized specifically to limit when and how the information is used consistent with the judicial warrants and is extended only with further judicial review.
  • The spying has been exposed by the unofficial fourth branch for public consideration.
  • The spying has caused political enemies who sometimes seem to personally despise each other to share the same or proximate podiums to not only explain the due process exercised in this case but the mysteries of meta-data as well.

What a world!

I regret living in an age when so much of what I do is tracked — and even more is trackable — by a whole host of players.  This is an issue Cicero did not need to consider. It is a temptation to which neither Julius nor Augustus Caesar could succumb.   But this is our reality.  It is not a question of being tracked.  It is an issue of how and why… and what will be done with the results.

And in dealing with the wicked problem of terrorism and the temptation of digital tracking, what we are seeing unfold is the way our Constitution — formal and informal — is supposed to work.  We have elected agents to make judgments on our behalf.  Thanks to Madison and others we have structured our Constitution so that these agents compete with each other.  Through this competition of branches and parties and people a self-restraining, privacy- protecting, freedom-preserving process is cobbled together. Thanks to the First Amendment to our Constitution we have empowered informal agents to hold our elected agents accountable.

As a result, we are given the opportunity to consider difficult issues and to decide how our agents are behaving regarding these issues and whether or not we are prepared to allow them to continue to be our agents.  For me this is the nation.  This is what is worth defending.

January 3, 2013

Due process: Collect, keep, and kill

No free man shall be seized or imprisoned, or stripped of his rights or possessions, or outlawed or exiled, or deprived of his standing in any other way, nor will we proceed with force against him, or send others to do so, except by the lawful judgment of his equals or by the law of the land. (Clause 39, Magna Carta)

No person shall… be deprived of life, liberty, or property, without due process of law… (Fifth Amendment to the Constitution of the United States)


Recent months have seen one-time expediencies dressed-up as new principles to frame the relationship between citizen and State.  Three examples:

On the Friday after Christmas the Senate reauthorized broad executive authority for  electronic surveillance and collection. The vote was 73-to-23 and extended for five years the Foreign Intelligence Surveillance Act. The House adopted the legislation earlier in the year.  On Sunday the President the signed the extension into law. Proposed amendments, including those offered by Senator Wyden,  that would have enhanced Congressional oversight of FISA were defeated.  FISA was originally intended to provide due process for the gathering of intelligence on non-citizens and so protect the privacy of citizens.  There has been increasing concern regarding how FISA methods now unintentionally — but perhaps quite widely — sweep up citizen communications as well.

According to a December 13, 2012 Wall Street Journal report, there may be good cause for concern.   In an exclusive investigative report, Julia Angwin found that new Department of Justice guidelines, “now allow the little-known National Counterterrorism Center to examine the government files of U.S. citizens for possible criminal behavior, even if there is no reason to suspect them. That is a departure from past practice, which barred the agency from storing information about ordinary Americans unless a person was a terror suspect or related to an investigation. Now, NCTC can copy entire government databases—flight records, casino-employee lists, the names of Americans hosting foreign-exchange students and many others. The agency has new authority to keep data about innocent U.S. citizens for up to five years, and to analyze it for suspicious patterns of behavior. Previously, both were prohibited.”

Meanwhile the White House is, according to several sources including Presidential adviser John Brennan, developing a legal and procedural framework for the deadly use of drones. Addressing the use of drones during an October 18 appearance on “The Daily Show,” President Obama said,  “One of the things we’ve got to do is put a legal architecture in place, and we need Congressional help in order to do that, to make sure that not only am I reined in but any president’s reined in terms of some of the decisions that we’re making.”  According to a May report in the New York Times, “Mr. Obama has placed himself at the helm of a top secret “nominations” process to designate terrorists for kill or capture, of which the capture part has become largely theoretical. He had vowed to align the fight against Al Qaeda with American values; the chart, introducing people whose deaths he might soon be asked to order, underscored just what a moral and legal conundrum this could be.”   Among the President’s decisions, presumably, was the targeted killing of Anwar al-Awlaki, a US citizen who was killed by drone-delivered Hellfire missiles on September 30, 2011 and his sixteen year-old son, also born in the US, who was killed in another drone attack two weeks later.  Both citizens were killed in Yemen.

The predominant motivation in each instance above — and others — is the protection of the American people and nation.  There is no imminent threat of Orwellian intention or intervention.

In each of these examples legislators and the executive are attempting to develop due process that is appropriate to their understanding of the present challenge.   (The judicial branch is poised to soon rejoin consideration of the issue.)

Nonetheless while it is, I suspect, the specific intention of no one, the space where individual liberty adjoins civil authority is being incrementally reshaped.  In the Anglo-American tradition there has long been in both theory and practice the presumptive primacy of individual initiative, what Blackstone termed “the absolute rights of man.”  The balance is shifting toward a presumed ability by the government to maintain order.

Perhaps this is the inevitable outcome of more and more diverse individuals living in dense proximity to each other.  Perhaps it is a prudent response to demonstrated risk.  Perhaps it reflects an emerging social consensus that liberty is less valued than previously.  Or we might be in the process of  redefining liberty.  These shifts might even be the accidental consequence of what Nassim Taleb has termed “naive interventionism”.  The preference, even obligation, to “do something” over doing nothing, even when the doing is non-productive or counter-productive.

Whatever the cause, the pattern can be perceived and seems to be persisting.

December 13, 2012

WSJ: National Counterterrorism Center given access to full-spectrum of Federal databases

Filed under: Intelligence and Info-Sharing,Privacy and Security — by Philip J. Palin on December 13, 2012

If you’re a Wall Street Journal subscriber, you  read the story late Wednesday night or earlier today.   If not it’s behind the Journal’s pay-wall.   I carried today’s (paper) Wall Street Journal to my morning meetings and didn’t see it until lunchtime.

But here’s how Wired magazine is summarizing the WSJ’s investigative journalism:

In a secret government agreement granted without approval or debate from lawmakers, the U.S. attorney general recently gave the National Counterterrorism Center sweeping new powers to store dossiers on U.S. citizens, even if they are not suspected of a crime, according to a news report.

Earlier this year, Attorney General Eric Holder granted the center the ability to copy entire government databases holding information on flight records, casino-employee lists, the names of Americans hosting foreign-exchange students and other data, and to store it for up to five years, even without suspicion that someone in the database has committed a crime, according to the Wall Street Journal, which broke the story.

Whereas previously the law prohibited the center from storing data compilations on U.S. citizens unless they were suspected of terrorist activity or were relevant to an ongoing terrorism investigation, the new powers give the center the ability to not only collect and store vast databases of information but also to trawl through and analyze it for suspicious patterns of behavior in order to uncover activity that could launch an investigation.

The changes granted by Holder would also allow databases containing information about U.S. citizens to be shared with foreign governments for their own analysis.

A former senior White House official told the Journal that the new changes were “breathtaking in scope.”


October 3, 2012

Committee duel over fusion center report

Filed under: Intelligence and Info-Sharing,Privacy and Security — by Philip J. Palin on October 3, 2012

As noted in several media, the Permanent Subcommittee on Investigations of the Senate Committee on Homeland Security and Governmental Affairs has released a report highly critical of state fusion centers.  (Access has been a bit difficult on Wednesday.) Here are a few paragraphs from the Subcommittee’s news release:

A two-year bipartisan investigation by the U. S. Senate Permanent Subcommittee on Investigations has found that Department of Homeland Security efforts to engage state and local intelligence “fusion centers” has not yielded significant useful information to support federal counterterrorism intelligence efforts.

“It’s troubling that the very ‘fusion’ centers that were designed to share information in a post-9/11 world have become part of the problem. Instead of strengthening our counterterrorism efforts, they have too often wasted money and stepped on Americans’ civil liberties,” said Senator Tom Coburn, the Subcommittee’s ranking member who initiated the investigation.

The investigation determined that senior DHS officials were aware of the problems hampering effective counterterrorism work with the fusion centers, but did not always inform Congress of the issues, nor ensure the problems were fixed in a timely manner. MORE

Chairman of the full-committee Joe Lieberman has taken exception to the subcommittee report.  From a Wednesday statement:

“I strongly disagree with the report’s core assertion that ‘fusion centers have been unable to meaningfully contribute to federal counterterrorism efforts,’” Lieberman said. “This statement is not supported by the examples presented in the report and is contrary to the public record, which shows fusion centers have played a significant role in many recent terrorism cases and have helped generate hundreds of tips and leads that have led to current FBI investigations.

“The report does include valuable findings in some areas. It cites examples of inappropriate use of homeland security grant funds and accurately notes that FEMA has struggled to account for how homeland security grant funds are allocated and used, a longstanding concern of mine.

“But the report also contradicts public statements by the Director of National Intelligence and the Director of the FBI, who have acknowledged the value fusion centers provide to the intelligence community. MORE

This is a case when I expect the same data could support two very different understandings of reality.

Next Page »