DOJ: We Can’t Tell Which Secret Application of Section 215 Prevents Us From Telling You How You’re Surveilled

Posted on February 1, 2013 by emptywheel

As Mike Scarcella reported yesterday, the government has moved for summary judgment in an Electronic Privacy Information Center FOIA suit for details on the government’s investigation into WikiLeaks. EPIC first FOIAed these materials in June 2011. After receiving nothing, they sued last January.

The government’s motion and associated declarations would be worth close analysis in any case. All the more so, though, in light of the possibility that the government conducted a fishing expedition into WikiLeaks as part of its Aaron Swartz investigation, almost certainlyusing PATRIOT Act investigative techniques. The government’s documents strongly suggest they’re collecting intelligence on Americans, all justified and hidden by their never ending quest to find some excuse to throw Julian Assange in jail.

EPIC’s FOIA asked for information designed to expose whether innocent readers and supporters of WikiLeaks had been swept up in the investigation. It asked for:

1. All records regarding any individuals targeted for surveillance for support for or interest in WikiLeaks;
2. All records regarding lists of names of individuals who have demonstrated support for or interest in WikiLeaks;
3. All records of any agency communications with Internet and social media companies including, but not limited to Facebook and Google, regarding lists of individuals who have demonstrated, through advocacy or other means, support for or interest in WikiLeaks; and
4. All records of any agency communications with financial services companies including, but not limited to Visa, MasterCard, and PayPal, regarding lists of individuals who have demonstrated, through monetary donations or other means, support or interest in WikiLeaks. [my emphasis]

At a general level, the government has exempted what files it has under a 7(A) (ongoing investigation) exemption, while also invoking 1 (classified information), 3 (protected by statute), 5 (privileged document), 6 (privacy), 7(C) (investigative privacy), 7(D) (confidential source, which can include private companies like Visa and Google), 7(E) (investigative techniques), and 7(F) (endanger life or property of someone) exemptions.

No one will say what secret law they’re using to surveil Americans

But I’m most interested in how all three units at DOJ — as reflected in declarations from FBI’sDavid Hardy, National Security Division’s Mark Bradley, and Criminal Division’s John Cunningham – claimed the files at issue were protected by statute.

None named the statute in question. All three included some version of this statement, explaining they could only name the statute in their classified declarations.

The FBI has determined that an Exemption 3 statute applies and protects responsive information from the pending investigative files from disclosure. However, to disclose which statute or further discuss its application publicly would undermine interests protected by Exemption 7(A), as well as by the withholding statute. I have further discussed this exemption in my in camera, ex parte declaration, which is being submitted to the Court simultaneously with this declaration

And then, as if DOJ didn’t trust the Court to keep sealed declarations secret, it added this plaintive request in the motion itself.

Defendants respectfully request that the Court not identify the Exemption 3 statute(s) at issue, or reveal any of the other information provided in Defendants’ ex parte and in camera submissions.

DOJ refuses to reveal precisely what EPIC seems to be seeking: what kind of secret laws it is using to investigate innocent supporters of WikiLeaks.

By investigating a publisher as a spy, DOJ gets access to PATRIOT Act powers, including Section 215

There’s a very very large chance that the statute in question is Section 215 of the PATRIOT Act (or some other national security administrative subpoena). After all, the FOIA asked whether DOJ had collected business records on WikiLeaks supporters, so it is not unreasonable to assume that DOJ used the business records provision to do so.

Moreover, the submissions make it very clear that the investigation would have the national security nexus to do so. While the motion itself just cites a Hillary Clinton comment to justify its invocation of national security, both the FBI and the NSD declarations make it clear this is being conducted as an Espionage investigation by DOJ counterintelligence people, which — as I’ve been repeating for over two years – gets you the full PATRIOT Act toolbox of investigative approaches.

Media outlets take note: The government is, in fact, investigating a publisher as a spy. You could be next.

So it’s likely DOJ is trying to hide that they’re using Section 215 to investigate supporters of a media outlet.

Which is pretty ironic. Ever since Section 215 went into place, the one issue about which there was occasionally debate was whether the government could be permitted to find out, either from libraries or book stores, what people were reading. Because people feared precisely this kind of thing would happen.

DOJ doesn’t want to reveal how many WikiLeaks supporters’ data has been data mined

And it’s not just whether they’re using Section 215 to collect information that DOJ is trying to hide. They’re also trying to hide the scope of the data collected.

The Government should not be required to divulge sensitive information concerning an investigation, including non-public information concerning the scope or size of the investigation, in order to protect other sensitive information.

[snip]

In justifying its reliance on Exemption 7(A), the Government need not discuss the exemption on a document-by-document basis. To do so could itself impede the investigation, as providing details such as the volume of the responsive material or the nature of particular documents could itself reveal sensitive information that could impede the investigation. [my emphasis]

Revealing how many WikiLeaks supporters’ data DOJ vacuumed up, perhaps to data mine with other data (FBI and NSD have records from Other Government Agencies, plural, suggesting they may be cross-referencing this information with NSA; since Julian Assange is a foreigner, he and all his American contacts could be legally collected under the FISA Amendments Act), would “itself reveal sensitive information.”

You know? Like that they’re sucking up the data of totally innocent people and data mining it with wiretap information?

The FBI doesn’t have lists, it has data sets

Then there’s the squirmy way the FBI, in particular, deals with the question of whether or not it keeps lists of WikiLeaks supporters.

Hardy’s unclassified declaration offers this reassurance.

Plaintiffs request seeks “[a]ll records regarding any individuals targeted for surveillance for support for or interest in WikiLeaks,” as well as certain information regarding “lists of individuals who have demonstrated support for or interest in WikiLeaks.” The FBI is not investigating individuals who simply support or have an interest in WikiLeaks. However, reading Plaintiffs request broadly, the FBI concluded that records concerning its investigation of the disclosure of classified information that was published on the WikiLeaks website would be responsive to Plaintiffs request. The FBI does not, however, maintain lists of individuals who have demonstrated support for or interest in WikiLeaks, and thus has no records responsive to this portion of Plaintiffs request. [my emphasis]

Read plainly, this reassurance would seem to say it has no records responsive to bullets 2, 3, and 4 above, as all of them pertain to lists of individuals.

Though maybe not. Bullets 3 and 4 request, primarily, agency communications, not the lists themselves. After all, it is always possible the private entities or the NSA keeps any lists in question, not the FBI.

Moreover, the motion itself refers to a comment in Hardy’s sealed declaration that seems a lot fuzzier.

In responding to the request, Defendants confirm that they have records responsive to the request as a whole, the terms of which they have interpreted broadly. See LaCedra v. Exec. Office of U.S. Attorneys, 317 F.3d 345, 348 (D.C. Cir. 2003) (requiring agencies to interpret requests “liberally in favor of disclosure”). But Defendants do not confirm the existence of records responsive to any particular portion of the request. See Hardy Ex Parte Decl. (Ex. 2) ¶ 8 n.1. [my emphasis]

Maybe all FBI has is surveillance information, not any lists. Or perhaps rather than lists, per se, FBI has data sets from each of these vendors that it sticks into a computer to cross-reference.

But don’t worry — these data sets were only “compiled” for this investigation

Of course, the success of this entire motion depends on whether DOJ went out and got these records after an investigation started or not. That probably is what happened — at least with the Section 215 material (assuming that’s what they used).

Nevertheless, the government’s argument that this material was “compiled” for “law enforcement purposes” — as opposed to intelligence purposes — betrays some doubt, in my opinion.

“In assessing whether records are compiled for law enforcement purposes, . . . the focus is on how and under what circumstances the requested files were compiled, and ‘whether the files sought relate to anything that can fairly be characterized as an enforcement proceeding.’” Jefferson v. DOJ, 284 F.3d 172, 176-77 (D.C. Cir. 2002) (quoting Aspin v. Dep’t of Defense, 491 F.2d 24, 27 (D.C. Cir. 1973)). “Because the DOJ is an agency ‘specializ[ing] in law enforcement, its claim of a law enforcement purpose is entitled to deference.” Ctr. for Nat’l Sec. Studies, 331 F.3d at 926. To demonstrate that the records were compiled for law enforcement purposes, an agency “must establish (1) ‘a rational nexus between the investigation and one of the agency’s law enforcement duties;’ and (2) ‘a connection between an individual or incident and a possible security risk or violation of federal law.’” Id. (quoting Campbell v. Dep’t of Justice, 164 F.3d 20, 32 (D.C. Cir. 1998)).

Here, each component’s declaration makes clear that the information withheld under this exemption was “compiled for law enforcement purposes” because it is part of a broader investigation being conducted by the Department of Justice into the unauthorized disclosure of classified information. See Hardy Decl. (Ex. 1) ¶ 23; Bradley Decl. (Ex. 3) ¶ 13; Cunningham Decl. (Ex. 5) ¶ 12. The investigation of criminal conduct, particularly when it entails serious threats to the national security, is plainly a high-priority law enforcement duty of the Department. See Ctr. for Nat’l Sec. Studies, 331 F.3d at 926 (recognizing that the Exemption 7(A) threshold is satisfied by an investigation concerning “a heinous violation of federal law as well as a breach of this nation’s security”). Insofar as individuals are being investigated for their role in the unauthorized disclosure of classified information, there is a clear nexus between the subjects “and a possible security risk or violation of federal law.” Id. Because the records at issue were compiled as part of a Department of Justice investigation into possible violations of federal law, they were “compiled for law enforcement purposes,” and the threshold inquiry under Exemption 7(A) is satisfied.

From the start, DOJ asserts the standard that something has been “compiled” for law enforcement if it “relates” to anything that might be law enforcement. Remember, the standard for collection under Section 215 is whether it is relevant to an investigation, which may be an intelligence investigation, so you might have relation on top of relevance to an intelligence investigation serving as “proof” that this is a law enforcement investigation.

Also: the citation from 2001 that DOJ specializes in law enforcement seems rather quaint, given that every time FBI reports in to Congress it boasts it is an intelligence agency.

DOJ then cites a case — CNSS v. DOJ — that not only served to hide information on the thousands of people rounded up after 9/11 (making it an ignoble citation in any case), but also referred to actual arrests rather than what seems likely to fall solidly under DOJ’s renewed intelligence mandate. It’s one thing to say an arrest for an immigration violation counts as law enforcement, and yet another to say that data collected under the standard of “relevance” to an intelligence investigation counts as law enforcement.

Next, it says this information is part of a broader investigation (note, even here the boundary between intelligence gathering and criminal investigation seems iffy). And then it asserts that the investigation of generic criminal conduct related to national security is a very serious thing, without asserting that the conduct at issue here is criminal.

It has been two years since leaked reports indicated that DOJ’s theory implicating Julian Assange in an actual crime had fallen flat. Which suggests the government hasn’t found any criminal conduct on the part of the primary target of the investigation (though I’ll have more to say about the investigation into Assange in a later post). Which suggests — particularly given the involvement of multiple OGAs and particularly given that they were conducting intelligence investigations of WikiLeaks before the State cable leaks in question — that this is an intelligence investigation, not a law enforcement one.

Which brings us to the sketchiest part of this sketchy passage:

Insofar as individuals are being investigated for their role in the unauthorized disclosure of classified information, there is a clear nexus between the subjects “and a possible security risk or violation of federal law.”

To the extent that individuals (defined as supporters of WikiLeaks, remember) are being investigated in the unauthorized disclosure of classified information, DOJ asserts, there is a nexus between them and law enforcement.

Except that the government is almost certainly using Section 215, which doesn’t require that those being investigated have any imagined tie at all to an actual crime to have their data sucked up and data mined. Insofar as these people have a role in an illegal leak, they have a law enforcement nexus, DOJ says, without admitting what the rest of the filing strongly suggests — insofar as most of the people “being investigated” have zero suspected role in the actual disclosure (as distinct from the publication and consumption) of this information — then their data has been collected as intelligence, not law enforcement.

While it never explicitly says any of this (indeed, it doesn’t even admit the very likely possibility the records at issue come from intelligence collection under Section 215), this filing hints at the huge problem with FBI’s dual hat as an intelligence and law enforcement agency. It has not, apparently, found any crime to charge the primary target of this investigation with. But because Assange is a foreigner and — especially — is someone the Attorney General has called a spy, without presenting any evidence, FBI can legally continue to investigate him and anyone they want to say is relevant to their investigation of him.

They can suck up the data of thousands of Americans guilty of doing no more than reading about how their government really works.

Which seems to be what the government is hiding in those classified declarations.

Update: I made some changes to this post after first posting, mostly for grammar and clarity. Also, it appears that the refusal to name a statute like this is actually an unusual thing in FOIA response.

 2 17 19