Wyden Gets DIA To Acknowledge Buying Location Data

Another agency admits to buying and using smartphone location data, using a loophole in the Fourth Amendment.

Senator Ron Wyden (D-OR) has again prompted a national security agency to admit it is circumventing the Fourth Amendment bar against unreasonable searches and seizures in the United States (U.S.) However, given the current state of Fourth Amendment law and the loophole that permits the buying or accepting of evidence from third parties, it is not clear this latest revelation will change much. However, it could give Wyden further ammunition to get a narrow provision included in the Foreign Intelligence Surveillance Act (FISA) reauthorization and bar the collection of location data in the U.S. Wyden and his cosponsor came within one vote of being added to the FISA reauthorization the Senate considered last spring. Thereafter the effort to reauthorize three FISA authorities collapsed, letting them lapse for new investigations. The common wisdom is that the Biden Administration will be easier to work with than the Trump Administration was on FISA-related matters.

In a brief memorandum, the Defense Intelligence Agency (DIA) responded to two very specific questions posed by Wyden’s Senior Advisor for Privacy and Cybersecurity regarding the buying and use of “commercial location data, which originates from apps installed by consumers on their smartphones.” The DIA acknowledged it “currently provides funding to another agency that purchases commercially available geolocation metadata aggregated from smartphones.” However, the agency claimed these data are not segregated into those obtained in the U.S. and those from outside the country. Moreover, the DIA explained there was a process in place to limit queries of these data, and this program has only been used five years over the last two and a half years. Of course, left unsaid, intentionally or not, is whether this program existed before two and half years ago and, if so, how many times was it used.

The DIA agreed with the second question that the agency is interpreting the 2018 Supreme Court of the United States (SCOTUS) decision Carpenter v. United States “as only applying to location data obtained through compulsory legal process and that Carpenter does not apply to data purchased by the government.” In other words, the DIA is reading Carpenter as applying only to the warrant process law enforcement agencies need to utilize for most searches and seizures, including in that landmark case cell phone records to track suspects. And so, the DIA is utilizing the Third Party Doctrine and is not the only national security or law enforcement agency in the U.S. doing so as Wyden and other Members have been highlighting recently.

Under the Fourth Amendment’s Third-Party Doctrine (seems like there’s a good joke in there somewhere), people give up their reasonable expectation of privacy in using services such a cell phone providers. Consequently, quite a lot of the data one’s phone shares with the telecommunications carrier or app developers is fair game for law enforcement and national agencies if they go to the third party such as Verizon, AT&T, T-Mobile, etc. Consequently, there have been legion stories about U.S. agencies doing just this, causing alarm and outrage among some on Capitol Hill.

In remarks during floor consideration of Avril Haines to the be the Director of National Intelligence (DNI), Wyden said:

I asked Ms. Haines about circumstances in which the government, instead of getting an order, just goes out and purchases the private records of Americans from these sleazy and unregulated commercial data brokers who are sim-ply above the law—literally above the law. I believe this practice is unacceptable, and soon I will be introducing legislation to make it clear that the Fourth Amendment is not for sale.

It is not clear if Wyden will fold such language into the privacy bill he introduced in the last Congress, the “Mind Your Own Business Act,” (S.2637) (see here for more analysis of Wyden’s bill), introduce a standalone bill, or pursue such a change in the FISA reauthorization.

In December, Wyden got a different national security agency to admit it may have been spying on a website and its users under a FISA provision. In a follow-on letter to correct his previous letter the then DNI acknowledged the Federal Bureau of Investigation (FBI) has indeed used Section 215 of the PATRIOT Act to surveil a website and its users.

DNI John Ratcliffe conceded in a 25 November letter to Wyden that web browsing has been the subject of at least one FISA application and production. Ratcliffe stated “the Department of Justice provided additional information to my office indicating that one of those 61 orders [issued pursuant to applications under Title V of FISA in 2019] resulted in the production of information that could be characterized as information regarding browsing.” He added “[s]pecifically, as relevant to an authorized investigation to obtain foreign intelligence information, the order directed the production of log entries for a single, identified U.S. web page reflecting connections from IP addresses registered in a specified foreign country that occurred during a defined period of time.” Of course, Ratcliffe only referenced searches in 2019, and so, it is an open question as to how many FISA searches authorized under Section 215 authority have been conducted in recent years for web browsing and internet search histories.

In his 20 May letter to Ratcliffe’s successor as DNI, Wyden explained:

• I am writing to inquire whether public reporting on the use of Section 215 of the PATRIOT Act would capture the government’s collection of web browsing and internet searches. As you know, on May 13, 2020, 59 U.S. Senators voted to prohibit this form of warrantless surveillance, reflecting the broad, bipartisan view that it represents a dangerous invasion of Americans’ privacy.
• There have also been long-standing concerns about the inadequacy of public reporting on the use of Section 215, including whether the data released annually by the DNI adequately captures the extent of the government’s collection activities and its impact on Americans. These concerns are magnified by the lack of clarity as to how the public reporting requirements would apply to web browsing and internet searches.

In a statement to the New York Times, Wyden argued “the DNI has provided no guarantee that the government wouldn’t use the Patriot Act to intentionally collect Americans’ web browsing information in the future, which is why Congress must pass the warrant requirement that has already received support from a bipartisan majority in the Senate.” Apparently, Ratcliffe’s follow-on letter was a result of the newspaper’s reporters pressing the DNI on how it was defining web browsing. And yet, Ratcliffe refused to answer other questions about whether these practices occurred before 2019 or in 2020 because his letter is specific only to 2019.

The amendment Wyden referred to was considered earlier this year when the House, Senate, and White House seemed close to a deal to extend Section 215 and two other related surveillance provisions that had lapsed. That amendment would have barred the use of this FISA exception to the Fourth Amendment to surveil search histories, web browsing, location and GPS data. If all Senators had been present and voting, it would have likely been added to the bill, suggesting it will be added when FISA reauthorization is addressed next year. However, a compromise provision in the House was narrower than the Wyden/Daines amendment, which caused Wyden to announce his opposition to that language. Hence, there remains work on finding language acceptable to stakeholders in Congress and the Biden Administration.

In March 2020, the House passed “USA FREEDOM Reauthorization Act of 2020” (H.R. 6172) by a 278-136 vote to reauthorize three expiring FISA provisions used by the National Security Agency (NSA) primarily to conduct surveillance: the business records exception, roving wiretaps, and the “lone wolf” provision. These authorities had been extended in December 2019 to March 15, 2020. However, the Senate did not act immediately on the bill and opted instead to send a 77-day extension of these now lapsed authorities to the House, which did not to take up the bill. The Senate was at an impasse on how to proceed, for some Members did not favor the House reforms while others wanted to implement further changes to the FISA process. Consequently, then Senate Majority Leader Mitch McConnell (R-KY) promised amendment votes when the Senate took up H.R.6172.

Moreover, H.R. 6172 ends the NSA’s ability to use the so-called call detail record (CDR) program that had allowed the agency to access data on many billions of calls. Nonetheless, the NSA shut down the program in 2018 due to what it termed technical problems. This closure of the program was included in the bill even though the Trump Administration had explicitly requested it also be reauthorized.

As mentioned, H.R. 6172 would reauthorize the business records exception, which includes “any tangible thing,” in FISA first instituted in the USA PATRIOT Act in 2001 but would reform certain aspects of the program. For example, if the Federal Bureau of Investigation (FBI) or NSA is seeking a business record under FISA for which a law enforcement agency would need to obtain a warrant, then the FBI or NSA will also need to obtain a warrant. Currently, this is not the case. Additionally, under H.R.6172, the FISA application process under Section 215 could not be used to obtain a person’s cell site location or GPS information. However, the FBI or NSA would still be able to use Title I of FISA to seek cell site location or GPS data for purposes of conducting electronic surveillance related to alleged foreign intelligence. The bill would require that prosecutors must inform defendants of the evidence derived from electronic surveillance unless doing so would harm national security.

Moreover, records obtained under Section 215 could be retained no longer than five years subject to a number of exceptions that may serve to make this limitation a dead letter. For example, if such records are deemed to have a “secret meaning” or are certified by the FBI as being vital to national security, then such records may be held longer than five years. Given the tendency of agencies to read their authority as broadly as possible and the past record of Intelligence Community (IC) agencies, it is likely these authorities will be stretched as far as legally possible. It bears note that all restrictions are prospective, meaning that current, ongoing uses of Section 215 would be exempted. The business records provision would be extended until December 1, 2023 as are the other two expiring authorities that permit so-called roving wiretaps and allow for surveillance of so-called “lone wolves.”

For FISA applications under Title I (i.e., electronic surveillance), any agency seeking a FISA order to surveil will need to disclose to the FISA court any information that may call into question the accuracy of the application or any doubtful information. Moreover, certain FISA applications to surveil Americans or residents would need to spell out the proposed investigative techniques to the FISA court. Moreover, any FISA application targeting U.S. officials or candidates for federal office must be approved by the Attorney General in writing before they can be submitted. H.R.6172 would permit the suspension or removal of any federal official, employee, or contractor for misconduct before the FISA court and increases criminal liability for violating FISA from five to eight years. Most of these reforms seem aimed at those Members, many of whom are Republican, that were alarmed by the defects in the FISA surveillance process of Trump Campaign associate Cater Page as turned up by the Department of Justice’s Office of the Inspector General investigation. Some of these Members were opposed to the House Judiciary Committee’s initial bill, which they thought did not implement sufficient reforms to the larger FISA process.

In May, the Senate amended and passed H.R. 6172 by an 80-16 vote. Consideration of the bill was stalled in March when some Senators pushed for amendments, a demand to which the Senate Majority Leader finally agreed, provided these amendments would need 60 votes to be adopted. Consequently, once COVID-19 legislation had been considered, the Senate returned to H.R.6172, and debated and voted upon three amendments, one of which was agreed to.

Wyden and Senator Steve Daines (R-MT) offered an amendment to narrow the Section 215 exception to the Fourth Amendment’s requirement that a search requires a warrant. Section 215 currently allows for FISA court approved searches of business records and all tangible things in the course of a national security investigation, and the underlying text of H.R. 6172 would exclude cell site location and GPS location from Section 215. The Wyden/Daines amendment would also exclude web browsing and search engine histories.

As Wyden explained during debate,

With web browsing and searches, you are talking about some of the most intimate, some of the most personal, some of the most private details of the lives of Americans. Every thought that can come into people’s heads can be revealed in an internet search or in a visit to a website: their health histories, their medical fears, their political views, their romantic lives, their religious beliefs. Collecting this information is as close to reading minds as surveillance can get. It is the digital mining of the personal lives of the American people.

However, the amendment failed to reach the 60-vote threshold necessary for adoption under the rule of debate for H.R. 6172, failing by one vote as four Senators did not vote.

Two weeks later, when the House was gearing up to consider the Senate-amended version of H.R.6172, Representatives Zoe Lofgren (D-CA) and Warren Davidson (R-OH) submitted an amendment along the lines of the language Wyden and Daines proposed that the Senate rejected by one vote to bar the collection of web browsing and internet search history via a FISA order under Section 215. Lofgren and Davidson had negotiated with other House Democratic stakeholders on language acceptable to them.

Regarding their amendment, in their press release, Lofgren and Davidson claimed “[t]he amendment – which is supported by Reps. Adam Schiff, Chair of the House Permanent Select Committee on Intelligence, and Jerrold Nadler, Chair of the House Judiciary Committee – is an outright prohibition: the government will not be able to use Section 215 to collect the websites that a U.S. person visits, the videos that a U.S. person watches, or the search queries that a U.S. person makes…[and] [s]pecifically:

• If the government is not sure if you’re a U.S. person, but you could be, the government cannot get your internet activity without a Title I FISA warrant.
• If the government wants to order a service provider to produce a list of everyone who has visited a particular website, watched a particular video, or made a particular search query: the government cannot make that order unless it can guarantee that no U.S. persons’ IP addresses, device identifiers, or other identifiers will be disclosed to the government.
  • This amendment does not allow for the incidental collection of U.S. persons’ web browsing or search information when the target is a specific-selection term that would or could produce such information.
• This prohibition is a strict liability-type provision. (It isn’t a knowledge standard or a reasonable-belief standard. An order must not result in the production of a U.S. person’s web browsing or search information.)
• If the order would or could result in the production of a U.S. person’s web browsing or search information, the government cannot order it without a Title I FISA warrant that must be narrowly tailored toward the subject of the warrant.

It appeared this amendment would be made in order during debate, but opposition from both the left and right in the House and among stakeholders made this untenable. The fact that the Lofgren/Davidson amendment was narrower in that it would only provide this protection to people in the United States whereas the Wyden/Daines amendment would have outright barred the practice under FISA led to opposition on the left. Early on 27 May 2020, Wyden supported this language, but when House Intelligence Committee Chair Adam Schiff (D-CA) suggested that intelligence agencies could continue to collect web browsing and search histories of Americans, Wyden withdrew his support. Thereafter, House Democratic Leadership ultimately decided against allowing this amendment to have a vote. Consequently, the effort to enact a FISA reauthorization collapsed.

In summer 2020, Wyden, Senator Bill Cassidy (R-LA) and ten other Members wrote the Federal Trade Commission (FTC) urging the agency “to investigate widespread privacy violations by companies in the advertising technology (adtech) industry that are selling private data about millions of Americans, collected without their knowledge or consent from their phones, computers, and smart TVs.” They asked the FTC “to use its authority to conduct broad industry probes under Section 6(b) of the FTC Act to determine whether adtech companies and their data broker partners have violated federal laws prohibiting unfair and deceptive business practices.” They argued “[t]he FTC should not proceed with its review of the Children’s Online Privacy Protection Act (COPPA) Rule before it has completed this investigation.”

In October 2020, Representatives Anna Eshoo (D-CA) and Bobby L. Rush (D-IL), and D-OR wrote the Privacy and Civil Liberties Oversight Board (PCLOB) asking that the privacy watchdog “investigate the federal government’s surveillance of recent protests, the legal authorities for that surveillance, the government’s adherence to required procedures in using surveillance equipment, and the chilling effect that federal government surveillance has had on protesters.”They argued:

• Recent surveillance of protests involves serious threats to liberty and requires a thorough investigation. We ask that PCLOB thoroughly investigate, including by holding public hearings, the following issues and issue a public report about its findings:
• Whether and to what extent federal government agencies surveilled protests by collecting or processing personal information of protesters.
• What legal authorities agencies are using as the basis for surveillance, an unclassified enumeration of claimed statutory or other authorities, and whether agencies followed required procedures for using surveillance equipment, acquiring and processing personal data, receiving appropriate approvals, and providing needed transparency.
• To what extent the threat of surveillance has a chilling effect on protests.

In December 2020, Wyden and Senators Elizabeth Warren (D-MA) Edward J. Markey (D-MA) and Brian Schatz (D-HI) “announced that the Department of Homeland Security (DHS) will launch an inspector general investigation into Customs and Border Protection’s (CBP) warrantless tracking of phones in the United States following an senators earlier this year” per their press release. The Senators added:

• As revealed by public contracts, CBP has paid a government contractor named Venntel nearly half a million dollars for access to a commercial database containing location data mined from applications on millions of Americans’ mobile phones. CBP officials also confirmed the agency’s warrantless tracking of phones in the United States using Venntel’s product in a September 16, 2020 call with Senate staff.
• In 2018, the Supreme Court held in Carpenter v. United States that the collection of significant quantities of historical location data from Americans’ cell phones is a search under the Fourth Amendment and therefore requires a warrant.
• In September 2020, Wyden and Warren successfully pressed for an inspector general investigation into the Internal Revenue Service’s use of Venntel’s commercial location tracking service without a court order.
• In a letter, the DHS Office of the Inspector General (OIG) explained:
  • We have reviewed your request and plan to initiate an audit that we believe will address your concerns. The objective of our audit is to determine if the Department of Homeland Security (DHS) and it [sic] components have developed, updated, and adhered to policies related to cell-phone surveillance devices. In addition, you may be interested in our audit to review DHS’ use and protection of open source intelligence. Open source intelligence, while different from cell phone surveillance, includes the Department’s use of information provided by the public via cellular devices, such as social media status updates, geo-tagged photos, and specific location check-ins.

In an October letter, these Senators plus Senator Sherrod Brown (D-OH) argued:

CBP is not above the law and it should not be able to buy its way around the Fourth Amendment. Accordingly, we urge you to investigate CBP’s warrantless use of commercial databases containing Americans’ information, including but not limited to Venntel’s location database. We urge you to examine what legal analysis, if any, CBP’s lawyers performed before the agency started to use this surveillance tool. We also request that you determine how CBP was able to begin operational use of Venntel’s location database without the Department of Homeland Security Privacy Office first publishing a Privacy Impact Assessment.

© Michael Kans, Michael Kans Blog and michaelkans.blog, 2019-2021. Unauthorized use and/or duplication of this material without express and written permission from this site’s author and/or owner is strictly prohibited. Excerpts and links may be used, provided that full and clear credit is given to Michael Kans, Michael Kans Blog, and michaelkans.blog with appropriate and specific direction to the original content.

Photo by Will Truettner on Unsplash