From Zazi to Stasi

June 9, 2013, 3:00 p.m.

This series includes: "Lavabit Confronts 'Complicit or Close?' Levison Closes," August 9, 2013; "A Simple Matter to Drag People Along," August 6, 2013; "The Future of Surveillance and How to Stop It," August 4, 2013; "Surveillance: Differences of Degree and of Kind," July 3, 2013; "Shooting the Messenger; Should Government Be Able to Keep Its Abuses Secret?," June 11, 2013; "From Zazi to Stasi; Trusting a Government That Doesn't Trust You," June 9, 2013; "Law's Losing Race With Technology," June 7, 2013.

Trusting a Government That Doesn't Trust You
Yesterday being the 64th anniversary of the June 8, 1949, publication of George Orwell's novel 1984, I thought it an appropriate time to review surveillance in America.

Unless you've just returned from a vacation, during which you had the good sense to never consult a smart phone, laptop, or newspaper, you know that we've just found out more about the government's spying on our phone calls and Internet activity.

The London Guardian's Glenn Greenwald broke the story that the U.S. super-secret FISA Court (Foreign Intelligence Surveillance Act) has given the NSA (National Security Agency) the legal right to gather all of our phone records indiscriminately -- even if there is no reason for the NSA to suspect we've done anything wrong -- in this specific case, the records of every Verizon customer (with legitimate reason to suspect similar authorizations have been granted for all other major phone companies). Glenn Greenwald, "NSA Collecting Phone Records of Millions of Verizon Customers Daily; Exclusive: Top Secret Court Order Requiring Verizon to Hand Over All Call Data Shows Scale of Domestic Surveillance Under Obama," The Guardian (London), June 5, 2013 (with link to text of FISA Court order). [Photo credit: multiple sources.]

Not to be outdone by The Guardian, the Washington Post soon had a story of its own to break: "The National Security Agency and the FBI are tapping directly into the central servers of nine leading U.S. Internet companies, extracting audio and video chats, photographs, e-mails, documents, and connection logs that enable analysts to track one target or trace a whole network of associates, according to a top-secret document obtained by The Washington Post." Barton Gellman and Laura Poitras, "Documents: U.S. Mining Data From 9 Leading Internet Firms; Companies Deny Knowledge,” Washington Post, June 6, 2013.

Note the rather stark conflict here -- one that underscores the fact that it is the major corporations as much or more than the government that should be the focus of our privacy concerns. I'm not sure anyone has the facts at this point; I don't. But my intuition is that the NSA would have had little to no reason to lie, in a highly classified document it had no reason to believe would fall into the hands of the media, that it had the ability to tap "directly into the central servers of nine leading U.S. Internet companies" if it didn't have that ability. On the other hand, the "nine leading U.S. Internet companies" would have had an incentive to hide from their customers the fact that they were permitting the government to peruse your electronic files and mine.

In an earlier blog essay I provided some background regarding privacy law, and reasons why I think we need a new Supreme Court interpretation of the protections provided by the Fourth Amendment, given the current governmental and corporate access to intrusive technologies not dreamed of decades ago, let alone centuries ago. "Law's Losing Race With Technology; Redefining 'Privacy,'" June 7, 2013.

Ultimately, of course, these stories were picked up and repeated by mainstream U.S. media, as U.S. officials scrambled to reassure Americans that they (members of the U.S. House and Senate) had known of this all along and always considered it a dandy way to protect us from terrorists -- carefully noting that at least this order did not include the government’s right to listen to the content of our calls. "All they were doing" was gathering the date and times our calls begin and end, the locations of the parties to the calls, and the phone numbers involved. Charlie Savage and Edward Wyatt, "U.S. Is Secretly Collecting Records of Verizon Calls," New York Times, June 6, 2013, p. A16.

I don't deny these are significant distinctions. There is a difference between a corporation or government agency scanning, recording, storing, analyzing, and ultimately having a human listen to the content of your phone conversations, on the one hand, and, on the other, its focusing exclusively on tracking the phone numbers from and to which you make calls, how long you talk during each, their date and time, and the location of the parties.

But (1) both are a significant intrusion on your privacy, (2) taken alone, but especially when blended with "Big Data" collections of other personal information about you, they reveal a lot of information about you, and (3) the government has not always limited itself to this "meta data" (e.g., phone numbers and time).

Thirteen years ago, February 27, 2000, CBS 60 Minutes reported on "Echelon," a global fish net operated by the NSA that, according to those who had worked with the project and were interviewed, covered all of Planet Earth, monitoring airwaves and optic fiber, picking up everything from e-mail and faxes to cell phones and baby monitors. Today, President Obama and the Chairs of the Senate and House Intelligence Committees are assuring us that no one is listening to the content of our calls. But a former employee of Echelon said on 60 Minutes that she was shocked to find a fellow employee listening to the voice of Senator Strom Thurmond. There have been a number of other reports over the years about this, prior, and subsequent programs, such as "Total Information Awareness."

There are many potential issues with what our government is doing. (1) There is what they are doing: monitoring our phone and Internet activity. (2) There are questions regarding how they are doing it: what data is being collected, how long it is held, how it is being used (including sharing with other agencies, other governments, or even corporations), what other databases it is being merged with, how many people within the agency have access to it, the quality control processes in place to, among other things, avoid mistaken identifications of people. (3) The oversight by the judicial and legislative branches. There are reports that the FISA Court seldom, if ever, has refused the government's requests to spy on Americans and others; we are told that Congress was kept fully informed, but a number of elected officials have said they knew nothing of the program. (4) Secrecy. It was said during the Soviet era that their spies, and ours, were sufficiently well informed that each pretty well knew what the other was up to; the only people who were uninformed as a result of secrecy and classified documents were the American people. The government has expressed extreme concern about terrorists finding out about these cell phone and Internet monitoring programs. It is highly unlikely -- given terrorists' use of couriers and throw-away cell phones, that there is much in this month's papers that they did not already know.

Put aside, if you must, Benjamin Franklin's judgment that, "They who can give up essential liberty to obtain a little temporary safety, deserve neither liberty nor safety." Benjamin_Franklin, Wikiquote.org. It may well be that the American people, once honestly and fully informed regarding how corporations and the government are collecting personal information about our activities, would support such spying programs as a fair trade for the added security they provide. But at the moment, they do not even have enough information to address the issues, let alone form an opinion which could be polled.

The government says that we have been saved from terrorist attacks as a result of their spying on us. But their proof is limited to two leaked examples because, they claim, all the others are classified. One is the case of Najibullah Zazi.

Zazi was an Afghan-American living in Denver, who drove to New York with the intention of creating an explosion in the New York City Subway. Interestingly for our purposes, he was one of those potential terrorists who became aware that he was under surveillance, was stopped and let go by police, abandoned his plans, and flew back to Denver, where he was arrested. He is currently awaiting sentencing. "Intelligence Official: Phone Records Tracking Helped Foil Subway Bomb Plot; Suicide Bomb Plot Was Halted After Suspect Realized He Was Being Tracked," CBS New York/AP, June 8, 2013.

Hard to argue with those results -- though that doesn't automatically lead to the conclusion that the massive spying on Americans is worth it. Especially is this so because we are not going to be told how many other cases there have been -- or whether any of them could not have been solved by other means, or a significantly more restricted spy apparatus.

So I have concerns about what we already know is going on. But those concerns pale by comparison with my most serious concerns. "Give a small boy a hammer and the whole world becomes a nail." Make massive data gathering and analysis and other spying technology available to corporations and governments, and the temptation to use it is almost irresistible.

It is a very small step -- one we know the government has already taken in the past -- from collections of "meta data" (information about our communications) to collections of the content of those communications. We also know that many governments over the years have not trusted their people, and have gone to great lengths to find out what they are up to in order to control them.

Has that already happened to us? Are we being asked by our government to trust it, when it has demonstrated by its actions that it doesn't trust us?

If it is not already obvious, permit me to make express that this should not be about "trust." Most of all, it should not be about the personality of whoever occupies the White House at a given time. Some Americans seemingly hate President Obama, everything he stands for and advocates, everything about him. Others are such solid supporters that they can see no flaws, and become defensive when confronted with anything other than praise of the President. Personally, I was pleased to see Obama elected, and wanted him to be successful. But when I think he's wrong, I've said so, in this blog and elsewhere, believing that to be engaged in his presidency by doing so shows more respect for him, and the office, than blind obeisance.

My concerns about the direction of our government are institutional, not personal. I do not believe President Obama seeks a totalitarian state, a military takeover, or a 1984-style total surveillance of the American people. But I definitely do think that we have the risk, not the inevitability, but the risk, that a future president might seek to exercise such power. Most of what prevents that happening is the basic decency of the individuals involved, for the potential power is there, and the temptations to use it are powerful.

From Zazi to Stasi. Following World War II, the eastern portion of Germany came under Soviet control. In 1950 this German Democratic Republic, known as "East Germany," created the Ministerium für Staatssicherheit, MfS, or Ministry for State Security, commonly known as the Stasi. "It has been described as one of the most effective and repressive intelligence and secret police agencies in the world." "Stasi," Wikipedia.org.

Stasi had, amongst other divisions (including prison camps for "political offenders"), an "'Administration 12' . . . responsible for the surveillance of mail and telephone conversations," and a "'Main Administration for Struggle Against Suspicious Persons' . . . charged with the surveillance of foreigners . . . legally traveling or residing within the country." Ibid.

Fortunately, nothing like this exists in our country. For starters, we don't have "ministries," we have "departments." We don't refer to the "state;" we use the word, "Homeland," similar to the German Vaterland, or Fatherland. Obviously, there's a big difference between a "Ministry for State Security" and a "Department of Homeland Security."

Nor do we have anything with a name like "Administration 12." If we were ever to have a "surveillance of mail and telephone conversations" by the government, we would use legitimate, legal American organizations like the National Security Agency, the Central Intelligence Agency, and the Federal Bureau of Investigation, among others. Very different from an "Administration 12."

# # #

Law's Losing Race With Technology

June 7, 2013, 5:25 p.m.

This series includes: "Lavabit Confronts 'Complicit or Close?' Levison Closes," August 9, 2013; "A Simple Matter to Drag People Along," August 6, 2013; "The Future of Surveillance and How to Stop It," August 4, 2013; "Surveillance: Differences of Degree and of Kind," July 3, 2013; "Shooting the Messenger; Should Government Be Able to Keep Its Abuses Secret?," June 11, 2013; "From Zazi to Stasi; Trusting a Government That Doesn't Trust You," June 9, 2013; "Law's Losing Race With Technology," June 7, 2013.

Redefining 'Privacy'
Our decades-long suspicions that our government has been spying on us have recently been confirmed. Once again, public opinion -- not to mention our policy analysis and law -- are lagging far behind leaping technological advances.

The London Guardian broke the story that the U.S. super-secret FISA Court (Foreign Intelligence Surveillance Act) has given the NSA (National Security Agency) the legal right to gather all of our phone records indiscriminately -- even if there is no reason for the NSA to suspect we've done anything wrong -- in this specific case, the records of every Verizon customer (with legitimate reason to suspect similar authorizations have been granted for all other major phone companies). Glenn Greenwald, "NSA Collecting Phone Records of Millions of Verizon Customers Daily; Exclusive: Top Secret Court Order Requiring Verizon to Hand Over All Call Data Shows Scale of Domestic Surveillance Under Obama," The Guardian (London), June 5, 2013 (with link to text of FISA Court order). [Photo credit: multiple sources.]

Ultimately, of course, the story was picked up and repeated by mainstream U.S. media, as U.S. officials scrambled to reassure Americans that they (members of the U.S. House and Senate) had known of this all along and always considered it a dandy way to protect us from terrorists -- carefully noting that at least this order did not include the government’s right to listen to the content of our calls. "All they were doing" was gathering the date and times our calls begin and end, the locations of the parties to the calls, and the phone numbers involved. Charlie Savage and Edward Wyatt, "U.S. Is Secretly Collecting Records of Verizon Calls," New York Times, June 6, 2013, p. A16; Editorial, "President Obama’s Dragnet," New York Times, June 7, 2013, p. A26 ("The administration has now lost all credibility on this issue. Mr. Obama is proving the truism that the executive branch will use any power it is given and very likely abuse it. That is one reason we have long argued that the Patriot Act, enacted in the heat of fear after the Sept. 11, 2001 attacks, by members of Congress who mostly had not even read it, was reckless in its assignment of unnecessary and overbroad surveillance powers.") [Photo credit: www.loohan.com]

Not to be outdone by The Guardian, the Washington Post soon had a story of its own to break:

The National Security Agency and the FBI are tapping directly into the central servers of nine leading U.S. Internet companies, extracting audio and video chats, photographs, e-mails, documents, and connection logs that enable analysts to track one target or trace a whole network of associates, according to a top-secret document obtained by The Washington Post.

The program, code-named PRISM, has not been made public until now. It may be the first of its kind. The NSA prides itself on stealing secrets and breaking codes, and it is accustomed to corporate partnerships that help it divert data traffic or sidestep barriers. But there has never been a Google or Facebook before, and it is unlikely that there are richer troves of valuable intelligence than the ones in Silicon Valley.

Barton Gellman and Laura Poitras, "Documents: U.S. Mining Data From 9 Leading Internet Firms; Companies Deny Knowledge,” Washington Post, June 6, 2013.

As I sometimes say, "The major problem is not so much that big corporations violate the law, it's that they write the law." The same thing's true of government. The White House, Justice Department, and the Intelligence Committees of the House and Senate tell us that all their spying on us is perfectly legal. They may well be right. Only problem is that the court that can tell us is so secret we aren't even supposed to know it exists; and unless the Guardian gets another leaked copy of an opinion we can't ever know what those judges decide, let alone their reasoning.

Legal or not, once again the technology is so far ahead of the ethicists, policy analysts, legislators and lawyers that we really need to "take it from the top," and totally rethink what we mean by "privacy" and what aspects of it are so important to us that we want legal protection.

Let's begin with a very brief review of the law.

The Fourth Amendment asserts a "right of the people to be secure in their persons, houses, papers, and effects" -- seemingly a kind of place-based security, a protection from trespassers -- albeit a protection that only extends to the exclusion of evidence so obtained. In 1928 the Supreme Court was still reading those words literally. Olmstead v. United States was a case in which the defendant had violated the prohibition laws. The prosecutor wanted to use evidence obtained by federal officers who had put wire taps on the defendant's phone lines a short distance from his property. The Supreme Court ruled that a phone tap, off the defendant's property, did not violate the language of the Fourth Amendment -- although it noted that Congress could pass a law prohibiting wiretaps (as it ultimately did).

By 1967, in Katz v. United States, Justice Stewart wrote for the Court, "the Fourth Amendment protects people, not places," even people who, as in that case, use public phones far from their homes. Justice Harlan, concurring, thought that was not enough: "The question, however, is what protection it affords to those people." Then, answering his own question, he posed the standard that has become the primary legacy of Katz: "there is a twofold requirement, first that a person have exhibited an actual (subjective) expectation of privacy and, second, that the expectation be one that society is prepared to recognize as 'reasonable'" -- generally truncated into the shorter expression, "a reasonable expectation of privacy."

So far so good. But in the 1976 U.S. v. Miller case the Court explained that once you've shared information with another, even though you did so in confidence and for very limited purposes, you no longer have an expectation of privacy in that information, let alone an expectation that courts will consider "reasonable." In Miller the defendant, Miller, attempted to claim a Fourth Amendment right of privacy in the cancelled checks and other records and documents maintained by his bank.

Few people find it possible to function without a bank account; a relationship with a bank is more of a necessity than an option. A necessary feature of a bank account is that the bank maintain some records of your financial transactions. You may consider those records private, and that you have an implied understanding of confidentiality with the bank. However, the Miller court concluded that by giving those records to the bank Miller could no longer claim a reasonable expectation that they would remain private. Because he had no "reasonable expectation of privacy" law enforcement could get access to those records from the bank, without providing Miller the protections he would have received under the Fourth Amendment if Miller had no bank account and law enforcement had come to his home for his copies of those "papers."

That standard may or may not have made sense during the last decades of our pre-cyber life. Most of our "papers and effects" were kept in our homes, protected by the Fourth Amendment. Not all; the phone company had records of our long distance calls, the gas and electric company would have records of our consumption, and there were probably other exceptions. But for the most part we weren't giving information to third parties that we considered private and confidential.

Today the combination of electronics, digitization, the Internet, computers and telecommunication result in your sharing a large portion of your "papers" with others. Neither librarians nor store owners used to keep records of what books or other merchandise you examined. Today you share a record of every search with Google, a record of every product you examine on a company's Web site, your Kindle book library with Amazon, your music choices with iTunes. You've shared your email and text messages with some company, your photos with Picasa and Facebook, your videos with YouTube, your documents with Dropbox or some other firm that offers you real estate in their "cloud." In addition to your bank, "your" financial records are held by your credit card companies, airlines, rental car companies, hotels, and many local merchants.

As Chief Justice Taft noted in Olmstead, we still have some legislative protections from invasions of our privacy by corporations and government, and the opportunity for more. But there is very little left of the Fourth Amendment protections Americans once enjoyed -- at least with regard to the records maintained by corporations, and often handed over by them to agencies such as the NSA, CIA and FBI.

As yesterday's stories regarding the government's massive, sweeping collections of phone records and Internet traffic make clear, technology has left the Fourth Amendment in the dust as it speeds past. When law enforcement had to get a search warrant to tap one individual's phone, the Fourth Amendment's requirements were administratively feasible. When the government wants to tap everyone's phones, and collect everyone's Internet traffic, that system collapses.

Remember the song with the line, "If it weren't for bad luck, I'd have no luck at all"? Well, if it weren't for the FISA court we'd have no court at all; indeed, we didn't, not that many years ago. The government contended it didn't need any judicial approval to spy on Americans. But a "Top Secret" (that is the classification on the FISA court's Verizon order) court that reportedly grants virtually every request, and never releases its cases, their resolution, or its reasons, is a pretty thin reed on which to rest the public's confidence in their government.

The Supreme Court needs to rethink the Fourth Amendment's protection of our privacy in a post-cyber world. The mere fact that today's technology means that no American can have a "reasonable expectation of privacy" anywhere, at any time, requires that standard -- and its deadly presumption regarding records shared with third parties -- be discarded.

There's much, much more to be said on this subject. And I'm told there are more revelations coming from the Guardian's Glenn Greenwald. But that's all for now.

# # #