The NSA Will Apparently Still Be Accessing The Old Phone Metadata It Said It Would No Longer Be Accessing

from the 'reform'-as-in-'maintain-status-quo' dept

The NSA's bulk phone metadata collection may no longer technically be a "collection" (the NSA now has to seek responsive metadata from telcos using targeted court orders), but that doesn't mean the agency isn't still seeking ways to keep the "dragnet" in "dragnet surveillance."



The NSA was only supposed to have access to previously collected bulk metadata for "analytic purposes." Apparently, "analyzing" the data also means searching the data, as was pointed out by FISA Court on Twitter (not affiliated at all with the actual FISA Court).



Fascinating: the Court will let NSA compare old bulk call data to new responses for a while. https://t.co/sY0PQxKJYM pic.twitter.com/XQrpeHnqOP — FISA Court (@FISACourt) December 5, 2015

Fascinating: the Court will let NSA compare old bulk call data to new responses for a while.

[F]or a period ending on February 29, 2016, appropriately trained and authorized technical personnel will have access to the BR Metadata solely for the purpose of verifying the completeness and accuracy of call detail records produced under the targeted (i.e., non-bulk) production orders issued by the Court after November 28, 2015. According to the government, verification will involve a comparison of the two sets of records (i.e., the BR Metadata and call detail records received pursuant to subsequent, targeted orders). See Government Response at 9. NSA technical personnel will compare the number of call detail records produced for a specific selection term with the number of call detail records identified in response to a query of the BR Metadata using the same identifier. See id at 9-10. Such comparisons will help provide assurance that the new collection process is working as intended.

Information obtained or derived from call detail records which has been previously disseminated in accordance with approved minimization procedures will not be recalled or destroyed.[2] Also, select query results generated by pre-November 29, 2015, queries of the bulk records that formed the basis of a dissemination in accordance with approved minimization procedures will not be destroyed.



[2] This practice does not differ from similar circumstances where, for example Court-authorized electronic surveillance and/or physical search authorities under Title I or III expire. While raw (unminimized) information is handled and destroyed in accordance with applicable minimization procedures, prior authorized disseminations and the material underpinning those disseminations are not recalled or otherwise destroyed.

This means that everyone within two or three degrees of a target that the NSA has found interesting — potentially over the last decade — will remain available and subject to NSA’s analytical toys from here on out.

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community. Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis. While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

The court finds that the USA Freedom Act did not expressly dictate limits on use of the metadata collected under Section 215 previous to the enactment of the surveillance reform bill. Because of this lack of statutory specificity, the court has agreed to grant NSA both access and extended retention of the data for two reasons.The first is to verify the completeness of phone records obtained with targeted FISC orders.Extended retention of the bulk metadata will be permitted because the records themselves are still the subject of multiple lawsuits Analysis of the data will also double as a search of the data, mixing newly-obtained phone records with the old ones and muddying the line between what is explicitly permitted under USA Freedom and what isn't explicitlyOnce the NSA has obtained the responsive records, they will stay in the agency's hands for five years, presumably. At that point, they will become part of the larger collection -- some of which willbe destroyed.It would appear that minimization, as far as the NSA is concerned, occurs at the point of handover from telcos. Records considered "minimized" by the FISA Court include those swept up by the agency's contact chaining, and these also will be compared to the "old" database for analytical purposes. As Marcy Wheeler explains, the dragnet isn't dead yet So, while some of the bulk metadata "ages off" at the five-year point, the NSA apparently considers "material" it has previously disseminated to other agencies or to its own analysts to be excluded from this time limit. How much data that involves is only known to the agency, which is being trusted to abide by the stipulations of the USA Freedom Act and destroy its Section 215 records once given the go-ahead from the FISA Court.

Filed Under: database, fisa court, metadata, nsa, phone records, section 215, surveillance