CIA Slightly Scales Back Its Domestic Surveillance Powers In First Major Policy Update In Over 30 Years

from the we-promise-to-try-to-try dept

Ahead of Trump's inauguration, the CIA announced changes to its rules on gathering/using (inadvertently or otherwise) data and communications from American citizens. Other than this being the timeframe in which it happened, this process was likely in the works for months, rather than a panicked, last-minute attempt to keep an incoming president from redirecting the agency's foreign-based focus. (h/t Julian Sanchez)

But still, it's tempting to equate the two: Trump's swearing in and a slight scaling back of the CIA's domestic reach. The outgoing head of the agency was none too happy with Trump's tweets criticizing the intelligence community for not doing whatever it is Trump imagines it should have done about Buzzfeed publishing an opposition-funded dossier about his alleged ties to Russia. Trump compared life under this supposedly-incapable intelligence community to that of Nazi Germany, while also making statements about buddying up with Russia. Exiting CIA Director John Brennan seemed a little irked.

"I think he has to be mindful that he does not have a full appreciation and understanding of what the implications are of going down that road,” Brennan said on “Fox News Sunday,” a show Trump routinely watches. “Now that he’s going to have an opportunity to do something for our national security as opposed to talking and tweeting, he’s going to have tremendous responsibility to make sure that U.S. and national security interests are protected,” Brennan added.

Brennan also objected to the "Nazi Germany" comment, standing up for all the fine (and probably some not-so-fine) people in the intelligence community. Given this backdrop, it might appear as though the updated CIA interpretation [PDF] of Executive Order 12333 is a response to Trump's tweets and statements, but it's more likely the agency did this in response to the Snowden leaks, which made any form of domestic surveillance by foreign intelligence agencies look a whole lot sketchier.

In a rare case of proactivity, the CIA has finally altered something it hadn't officially revamped in more than 30 years.

Earlier this month, the Director and the Attorney General approved new Attorney General Guidelines consolidating and updating the CIA’s procedures, some of which had not been significantly updated since 1982. In the intervening decades, the CIA implemented a number of additional changes in internal regulations and policies to address changes in law and technology not contemplated in the 1980s. The new, consolidated Attorney General Guidelines now incorporate many of these intervening changes, thereby providing a more unified and comprehensive set of procedures that permit the CIA to use and share intelligence information to support national security objectives in a manner that protects the privacy rights and civil liberties of all Americans.

The new guidelines add more restrictions to the CIA's use of domestic data and communications. It requires the agency purge any incidentally-collected US persons' communications within five years -- a solid improvement over its previous deadline of "never."

But with that (incrementally) good news comes some bad news:

The five-year limit on holding information applies only to the most sensitive categories of information, including email or cellphone intercepts — data that might otherwise remain in agency systems without being exploited or evaluated. Less-sensitive information is to be expunged after 25 years.

There are also additional reporting and compliance requirements meant to curtail the CIA's snooping on US persons' communications and data. Unfortunately, the specifics of these requirements are left mostly to the imagination, despite the CIA -- for the first time ever -- publishing a fully-declassified and unredacted version of its 12333 rules.

Also on the bad news side is the fact that the new restrictions rely on the interpretation of an executive order, which could be altered or replaced by the incoming president. Not only that, but the new CIA head -- Mike Pompeo -- could just as easily roll back the latest policy updates.

Also of note is the fact that, despite the incremental changes, the CIA still isn't super-concerned about Americans' civil liberties.

CIA officials acknowledged that the revisions were made without input from civil liberties groups, including the American Civil Liberties Union, which have pushed for more aggressive measures to protect Americans’ privacy than are envisioned in the updated guidelines.

As an agency with no master but the President (its "oversight" never seemed too troubled about its independent actions until it was spied on), the CIA has a lot of leeway in how it carries out its foreign intelligence operations. Whether or not we can trust the CIA to play by its own rulebook is still up in the air. It still works closely with the FBI to perform foreign intelligence collections, and recent loosening of restrictions on sharing NSA-collected, unminimized US persons' data/communications means the FBI will have even more access to information the CIA isn't supposed to touch.

And there's nothing in the new rules that suggests the CIA's practice of engaging in Section 702 backdoor fishing expeditions (often at the behest of the FBI). The summary [PDF] notes the CIA is not allowed to engage in intelligence collections targeting US persons directly, but it is still allowed to point other agencies in this direction and make use of anything collected by that agency.

With narrowly defined exceptions regarding testing and training, the CIA may not use special collection techniques in the United States. The CIA is, however, permitted to ask another federal agency to perform special collection techniques in the United States under that agency’s legal authorities. The CIA may also provide technical equipment or knowledge to another federal agency in conducting authorized special collection in the United States with the approval of the CIA’s General Counsel. The CIA may conduct special techniques outside the United States that target a United States person only with the approval of the Director of the CIA (or his designee), the CIA General Counsel, the Attorney General, and (where applicable) the Foreign Intelligence Surveillance Court.

On the bright side, the push for greater transparency from the intelligence community appears to actually be working, as both 12333 documents have been provided in a timely manner by the agency, fully-declassified and free of redactions.

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community. Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis. While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: cia, domestic surveillance, surveillance