Security

How bad can the new spying legislation be? Exhibit 1: it's called the USA Liberty Act

Freedom doesn't mean what you think it does


Analysis The US Senate Judiciary Committee has unveiled its answer to a controversial spying program run by the NSA and used by the FBI to fish for crime leads.

Unsurprisingly, the proposed legislation [PDF] reauthorizes Section 702 of the Foreign Intelligence Surveillance Act (FISA) – which allows American snoops to scour communications for information on specific foreign targets.

It also addresses the biggest criticisms of the FISA spying: that it was being used to build a vast database on US citizens, despite the law specifically prohibiting it; was being abused to do a mass sweep of communications, rather than the intended targeting of individuals; and that there was no effective oversight, transparency or accountability built into the program.

But in case you were in any doubt that the new law does not shut down the expansive – and in some cases laughable – interpretations put on FISA by the security services, you need only review the proposed legislation's title: the USA Liberty Act. Nothing so patriotic sounding can be free from unpleasant compromises.

And so it is in this case. While the draft law, as it stands, requires the FBI to have "a legitimate national security purpose" before searching the database and to obtain a court order "based on probable cause" to look at the content of seized communications, it still gives the domestic law enforcement agencies the right to look at data seized on US citizens by the NSA. And agents only need supervisory authority to search for US citizens' metadata.

Huh

That is very, very far from what FISA was intended to do: the clue being in the "F" for "Foreign" in FISA. This legislation would legitimize the highly questionable interpretation that the NSA and FBI decided to place on Section 702: that the information gathered under FISA didn't require another step of authorization to look for American citizens' information – something that many claim breaks the Fourth Amendment on unreasonable search.

This legislative approach lends weight to the argument pushed by the security services in the wake of other illegal spying operations: that metadata is sufficiently innocuous that it does not require legal protections. That is a conclusion that many civil liberties and privacy groups fiercely disagree with.

Wonder why Congress doesn't clamp down on its gung-ho spies? Well, wonder no more

READ MORE

The "safeguards" set out in the proposed law are similar to those introduced to other spying programs: the surveillance services must keep records of their queries and submit to Congressional oversight; and the Director of National Intelligence (DNI) must report to Congress twice a year on the number of US citizens whose communications are collected, and the number of requests that identified US citizens.

Again, though, there is implicit acceptance of the snoopers' questionable assumptions over Section 702 built into this approach. The details on US citizens are referred to as being "incidentally collected" – language that is used by the security services to justify not providing constitutional protections.

There is also precious little evidence that forcing the DNI to provide a report to Congress has a knock-on impact on the spies' accountability or transparency. All it has resulted in so far is the DNI either outright lying to Congress, or pretending to having heard a different question to the one asked.

Blind eye

In asking the DNI to provide the number of US citizens who communications have been collected in the previous six months, the bill's sponsors have also purposefully ignored one of the most visible efforts by the people's representatives to keep the security services in check.

For several years, Congress has been asking for the NSA and others to provide a figure on the number of American citizens included in the existing 702 database, and they have played years of games in response. Ultimately, the spies simply refused to provide a figure, sparking something close to apoplexy in Senator Ron Wyden (D-OR).

The remaining changes follow a similar pattern: more window-dressing than real reform.

The bill does specifically prohibit the NSA from collecting so-called "about" communication – where anyone even mentioning a specific target could also have their communications stored. But the NSA has already agreed to that change, largely because it was never going to withstand legal scrutiny.

It uses the same formulation as other spying program reforms and allows for a representative of civil liberties groups to argue in front of the secretive Foreign Intelligence Surveillance Court (FISC) as it makes a determination. But, as has been repeatedly noted by such groups, that role is strictly limited. There is no right for that representative to attend hearings; the representative does not have the right to access all the relevant information; and the court is not obliged to listen to, act on, or even reference their arguments. The situation is ripe for abuse.

The bill extends whistleblower protections given to government employees to private contractors that work for the intelligence community. Which sounds good but, again, a look at what has happened in the real world means such protections are likely to be no more than window dressing. No one working for the security services will seriously imagine that attempting to use whistleblower protections will do anything but paint a giant Edward Snowden-shaped target on their back. At least not without a number of public signs of a change in culture – and we have yet to see any.

Return of the PCLOB

And finally, the bill reintroduces the Privacy and Civil Liberties Oversight Board (PCLOB) back into the mix after it was effectively killed off by Congress for daring to criticize other illegal spying programs. The PCLOB was stripped of many of its power – and this bill does not return them. It is notable that President Trump also nominated an NSA-friendly person to chair the PCLOB.

The oversight board has no real independent power and no one worth their salt would apply to fill the empty positions on the panel having seen what was done to the previous directors when they challenged the status quo. In short, it is yet another fig leaf.

And so the USA Liberty Act is exactly what you imagine it to be: a piece of law written to give the illusion of reform by adding reports and paperwork, and yet quietly retains highly questionable spying programs – keeping the real levers of power in the hands of the security services and the Congressmen who wrote the law. ®

Send us news
86 Comments

Psst, hey. It's the NSA. You want some AI security advice?

You can trust us, we're the good guys

Ex-Microsoft engineer gets seven years after trying to hire hitman for double murder

Hint: If someone says they're an assassin on the dark web, they're probably not

Uncle Sam's had it up to here with 'unforgivable' SQL injection flaws

Software slackers urged to up their game

Crypto scams more costly to the US than ransomware, Feds say

Latest figures paint grim picture of how viciously the elderly are targeted

FBI v the bots: Feds urge denial-of-service defense after critical infrastructure alert

You better watch out, you better not cry, better not pout, they're telling you why

FBI: Critical infrastructure suffers spike in ransomware attacks

Jump in overall cybercrime reports, $60M-plus reportedly lost to extortionists alone, Feds reckon

The federal bureau of trolling hits LockBit, but the joke's on us

When you can't lock 'em up, lock 'em out

Cops turn LockBit ransomware gang's countdown timers against them

Authorities dismantle cybercrime royalty by making mockery of their leak site

Uncle Sam sweetens the pot with $15M bounty on Hive ransomware gang members

Honor among thieves about to be put to the test

FBI recruits Amazon Rekognition AI to hunt down 'nudity, weapons, explosives'

Honestly, it sounds like a fun time

As NSA buys up Americans' browser records, Uncle Sam is asked to simply knock it off

If you could just not harvest our info unlawfully and without a warrant, that would be great

Facial recognition tech has outpaced US law – and don't expect the Feds to catch up

Let's be realistic: If the EU can't regulate it well, America definitely won't