The Latest NSA Documents VI: Non-Compliance Redux, With More DOJ

Next came a period of relative calm, and somewhat less wrist-slappy FISC-NSA dynamics.  The respite nevertheless was short-lived, judging by the final three documents in this week’s trove of declassified NSA metadata stuff.  That said, NSA’s late 2009 discovery of further compliance problems, and its voluntary disclosure of them to the FISC, did not bring about as stern a judicial rebuke as before---though the court certainly expressed irritation at the flubs, and great concern over NSA's reporting about historical queries of telephony metadata.

The FISC Restores Unilateral Query Authority to NSA---While Adding Some More Restrictions

Our story picks up with the removal, by the FISC, of a specific constraint on metadata querying by NSA analysts. That’s how the United States views the first of our three documents, a September 3, 2009 “primary order” by FISC Judge (and now FISC Presiding Judge) Reggie Walton (“September 3 Order”). The ruling is somewhat boilerplate, in that it ticks off and approves a number of by-now-familiar features of the years-old telephony metadata program: the government secures an order compelling a telecommunications company (we don’t know which) to produce, for a discrete period, electronic copies of all of its telephony metadata; but the government also must heed minimization requirements for the produced material (reasonable suspicion standards, handling and reporting and auditing protocols, mandatory training and guidance for database-querying personnel, yaddity yoo).

What the September 3 Order does not do, as the government notes in materials accompanying this week’s document dump, is compel “NSA to seek FISC approval to query the telephony metadata program on a case-by-case basis.”  This proviso---which the FISC had handed down in response to widespread and evidently serious NSA non-compliance---was thus lifted, in at least partial recognition of remedial efforts undertaken or proposed by the the agency.  Under the September 3 Order, database queries now would be allowed, without specific FISC approval---though any queries would nonetheless be subject to FISC-imposed standards for metadata access and dissemination.  These appear to build upon restrictions initially devised in connection with program, by then-FISC judge Malcolm Howard, in 2006; and even some other restrictions imposed more recently, in March of 2009, by Judge Walton himself.

Some examples of the new marching orders for minimization and oversight: at least twice during the September 3 Order’s authorizing period, NSA must perform a “spot check” of a sample of call detail records, so as to ensure that the agency isn’t scooping up any content. The Justice Department also figures prominently here. DOJ attorneys must review, again on no less than two times during the authorization period, NSA metadata query activities, including the justifications given for queries. NSA also must provide copies of all briefing and training materials to the Justice Department. Moreover, prior to reporting back the FISC on compliance activities, NSA and Justice personnel must meet, a week before the FISC authorization’s expiry, and discuss NSA’s conformity with FISC orders. The outcome of that meeting must be reduced to writing and submitted to the court, when the NSA seeks to renew the metadata authorization.  Justice Department personnel likewise must, a week prior to any authorization’s lapse, meet with the NSA Inspector General and review oversight and compliance matters. Finally, any proposed automated metadata query processes must be vetted and approved by NSA, the Justice Department, and the FISC.  The outlines of a theme can be made out: DOJ oversight is on the rise.

So query subject to strict rules?  Yes. But ask the FISC each time whether it is okay to query? No. Perhaps this marked a modest thaw, in that the FISC restored to the NSA some unilateral---if quite controlled, more heavily DOJ-supervised---authority to consult its vast caches of telephony metadata.

Two Further Compliance Problems, and a "Deeply Troubled" FISC

The thaw---such as it was---didn’t last very long, considering our next declassified piece: an order issued by Judge Walton, “regarding further compliance incidents,” on September 25 (“September 25 Order”).

According to that document, four days before, a Justice Department attorney had told court staff that NSA likely violated the FISC’s September 3 Order, and with regard to two of its requirements: one, that NSA would maintain strict and mandatory protocols for the access and use of telephony metadata; and two, that NSA would ensure that persons authorized to receive database query results would receive needed briefings and guidance from the NSA’s general counsel.  Specifically, an NSA analyst had forwarded certain metadata database query results to some colleagues, most of whom had not yet received the required briefings.  (According to the DOJ lawyer, query results apparently had not been shared outside of NSA.)  On September 23, the same lawyer informed the court of a second, shared-query-results-with-folks-who-hadn’t-received-the-training incident.  The apparent culprit was an internal NSA distribution list.  It included fifty-three analysts who had received the required briefing, as well as one hundred and thirty six who had not.  The attorney reportedly believed that NSA and the Justice Department’s National Security Division could report preliminarily to the FISC about its investigation into the two episodes, soon---but neither agency had done so by the time of the September 25 Order, as the FISC noted with evident frustration.

An exasperated Judge Walton wrote further that he was “deeply troubled’ by the two snafus, which followed both the much-touted End-to-End Review, and submission of a report to the FISC, regarding the End-to-End Review’s findings.  Among other things, the latter had been meant, as Judge Walton put it in the September 25 Order, to “assure the Court that NSA had addressed and corrected the issues giving rise to the history of serious and widespread compliance problems in this matter[.]”  That not being the case, the FISC jurist ordered knowledgeable and sufficiently high-ranking NSA and Justice Department personnel to appear at specially arranged hearing, both to furnish more detail about what went wrong, and to describe why NSA, despite claims of changed behavior, recently had failed---twice---to comply with FISC-ordered rules.

More on Sharing and Reporting Requirements

So what happened next?  If the FISC was "deeply troubled," did its anxiety portend the scaling back of the metadata program, or further chiding of executive branch personnel, or even the suspension (once more) of unilateral NSA query powers?  Not quite.  Here's what happened.  NSA and Justice Department officials testified as to the details surrounding NSA's two internal dissemination errors and the imposition of further safeguards, and the FISC seemingly credited NSA’s account---or at least did not excoriate the agency as it had before. The FISC did, however, express anxiety and inquire further about certain queries of metadata---that is, queries linked to numbers that at one time met threshold standards for suspicion, but that did not meet it at the time of the query.

That’s the gist of the final document in this week’s declassification rodeo, a “Supplemental Opinion and Order” dated November 5, 2009 (“November 5 Order”).  (The “Supplemental” part apparently refers to an intervening, October 30, 2009 order, which renewed the government’s authority to engage in bulk metadata collection. That item has not been declassified, and it might well contain a key piece of the metadata story.)  The November 5 Order, Judge Walton writes, “reiterates the manner in which query results may be shared within the NSA … and elaborates on the reporting requirement imposed on the Court’s order of October 30.”

On the former, the FISC opens by reciting the relevant provisions of its September 3 and October 30 Orders, both of which limited the ability to access metadata, and to receive metadata query results, to NSA personnel who had received, from NSA lawyers, the necessary training and guidance on FISC metadata procedures. Judge Walton then summarizes the events of September---as described by executive branch witnesses, during the September 28 hearing---in which NSA had internally disseminated query results in violation of those rules.  Oddly enough, the first over-share was followed by the issuance of guidance from NSA’s general counsel, on September 21, which prohibited the dissemination of metadata query results in “any form.” Nevertheless, the next day, a second NSA staffer shared a “situation report”---which contained information derived from a metadata query---with an internal distribution list consisting of trained-in-FISC-orders analysts and not-trained-in-FISC-orders analysts. Of course this meant new fixes from the agency, so as to prevent the problems from recurring. As for those, Judge Walton’s opinion observes that NSA lawyers recently had interpreted its ban on sharing query results with untrained persons as extending to any information of any kind derived from metadata queries.  The agency also said, according to the November 5 Order, that it would limit sharing “to NSA personnel who have received the necessary training and guidance to receive those query results,” save only for exceptional cases previously approved by the court. If the FISC doubted the agency's remedial steps here, it didn’t say so.

That left obligatory FISC compliance reporting, on the narrow topic of “historical” metadata queries. Earlier, NSA had sought permission---and the FISC had given it explicitly, in a footnote---for the government to query metadata, “using a telephone identifier that is not currently associated with one of the targeted foreign powers, but that was for a period of time in the past.” That meant satisfying the usual “reasonable and articulable suspicion” standard at some point---but not currently. Such inquiries (and any related contact chaining analysis) were limited to an identified period, for which the necessary legal level of suspicion existed; after that point, the authority to query lapsed.

In his November 5 Order, Judge Walton called historical searches a “source of concern”---the reasons for concern being that NSA sweeps up extraordinary volumes of metadata daily, and that, with telephone numbers being so frequently assigned and re-assigned, an old, once-suspicious number might today belong to a U.S. person “not under investigation by the FBI.” Walton therefore had insisted on detailed, regular reporting about historical searches of NSA’s metadata. Thus his current gripe: NSA’s bare-bones reporting. The latest report filed by agency was “not sufficiently detailed to allay the Court’s concerns,” wrote the FISC, “and the Court continues to be concerned that these queries could reveal communications of United States person users of the telephone identifier who are not the subject of FBI investigations.”

Accordingly, Judge Walton ordered NSA to bolster the substance of its historical search reports, among other things by including the amount of queries run during the reporting period, expressed both in absolute terms and as a percentage of all conducted queries.  The FISC also asks whether NSA would, after a single historical query, automatically change a telephone number from RAS (reasonable and articulable suspicion) approved to “non-RAS approved;” and how an NSA analyst will know that historical queries are limited to a particular timeframe. Relatedly, Judge Walton asks whether, if NSA’s retrospective queries reveal that a number was not, in fact, classified as RAS at a particular time, the approved search period would be narrowed.  Finally, the FISC asks whether, in such a case, NSA analyst would have to “delete or otherwise mask” any uncovered records belonging to U.S. persons.