Above Photo: FBI director James Comey, left, and director of national intelligence James Clapper at a House committee hearing last month. Photograph: Kevin Lamarque/Reuters
Exclusive: Classified revisions accepted by secret Fisa court affect NSA data involving Americans’ international emails, texts and phone calls
The FBI has quietly revised its privacy rules for searching data involving Americans’ international communications that was collected by the National Security Agency, US officials have confirmed to the Guardian.
The classified revisions were accepted by the secret US court that governs surveillance, during its annual recertification of the agencies’ broad surveillance powers. The new rules affect a set of powers colloquially known as Section 702, the portion of the law that authorizes the NSA’s sweeping “Prism” program to collect internet data. Section 702 falls under the Foreign Intelligence Surveillance Act (Fisa), and is a provision set to expire in 2017.
A government civil liberties watchdog, the Privacy and Civil Liberties Oversight Group (PCLOB), alluded to the change in its recent overview of ongoing surveillance practices.
The watchdog confirmed in a 2014 report that the FBI is allowed direct access to the NSA’s massive collections of international emails, texts and phone calls – which often include Americans on one end of the conversation. The activists also expressed concern that the FBI’s “minimization” rules, for removing or limiting sensitive data that could identify Americans, did not reflect the bureau’s easy access to the NSA’s collected international communications.
FBI officials can search through the data, using Americans’ identifying information, for what PCLOB called “routine” queries unrelated to national security. The oversight group recommended more safeguards around “the FBI’s use and dissemination of Section 702 data in connection with non-foreign intelligence criminal matters”.
As of 2014, the FBI was not even required to make note of when it searched the metadata, which includes the “to” or “from” lines of an email. Nor does it record how many of its data searches involve Americans’ identifying details – a practice that apparently continued through 2015, based on documents released last February. The PCLOB called such searches “substantial”, since the FBI keeps NSA-collected data with the information it acquires through more traditional means, such as individualized warrants.
But the PCLOB’s new compliance report, released last month, found that the administration has submitted “revised FBI minimization procedures” that address at least some of the group’s concerns about “many” FBI agents who use NSA-gathered data.
“Changes have been implemented based on PCLOB recommendations, but we cannot comment further due to classification,” said Christopher Allen, a spokesman for the FBI.
Sharon Bradford Franklin, a spokesperson for the PCLOB, said the classification prevented her from describing the rule changes in detail, but she said they move to enhance privacy. She could not say when the rules actually changed – that, too, is classified.
“They do apply additional limits” to the FBI, Franklin said.
Timothy Barrett, a spokesman for the office of the director of national intelligence, also confirmed the change to FBI minimization rules.
Barrett also suggested that the changes may not be hidden from public view permanently.
“As we have done with the 2014 702 minimization procedures, we are considering releasing the 2015 procedures. Due to other ongoing reviews, we do not have a set date that review will be completed,” he said.
Until that hypothetical release, it remains unknown whether the FBI will now make note of when and what it queries in the NSA data. The PCLOB did not recommend greater record-keeping.
Last February, a compliance audit alluded to imminent changes to the FBI’s freedom to search the data for Americans’ identifying information.
“FBI’s minimization procedures will be updated to more clearly reflect the FBI’s standard for conducting US person queries and to require additional supervisory approval to access query results in certain circumstances,” the review stated.
The reference to “supervisory approval” suggests the FBI may not require court approval for their searches – unlike the new system Congress enacted last year for NSA or FBI acquisition of US phone metadata in terrorism or espionage cases.
Privacy advocates say that this leeway for searches that NSA and FBI officials enjoy is a “backdoor” around warrants that the law should require. In 2013, documents leaked to the Guardian by Edward Snowden revealed an internal NSA rule that Senator Ron Wyden has called the “backdoor search provision”, for instance.
While the NSA performs warrantless collection, internal rules permit the FBI to nominate surveillance targets. Those targets are supposed to be non-Americans abroad, but Americans’ data is often swept up in the surveillance.
The legal underpinnings for the dragnet, a 2008 amendment to the Foreign Intelligence Surveillance Act, are set to expire next year. A scheduled expiration of the Patriot Act last year gave critical leverage to legislators who wanted to rein in the bulk collection of domestic phone records, and intelligence officials last month implored Congress to reauthorize the measure wholesale.
“Reasonable people could and did argue about how important the telephone metadata collection was,” FBI director James Comey told the House intelligence committee last month. “This is not even a close call. This is – if we lost this tool, it would be a very bad thing for us.”
Several civil-libertarian legislators have vowed to push for an expiration of Section 702, arguing that it represents a growing surveillance authority that has moved beyond terrorism and espionage, and into the hunt for general weaknesses in the internet. The chief lawyer for the intelligence community, Robert Litt, said in 2014 that the law provides surveillance authorities the powers are “not only about terrorism, but about a wide variety of threats to our nation”.
A representative for the Fisa court deferred comment to the administration.
- This article was amended on 8 March 2016 to correct a line that said the PCLOB’s new compliance report was released this past Saturday, 5 March. It was released on 5 February.
- This article was amended on 10 March 2016 to correct the expiration date of Section 702.