4 December 2015

DNI Releases Details of NSA’s New Bulk Metadata Eavesdropping Program

ODNI Announces Transition to New Telephone Metadata Program 

Office of the Director of National Intelligence, November 27, 2015

In January 2014, in a speech at the Department of Justice to address domestic and international concerns regarding U.S. intelligence activities, President Obama announced that the Intelligence Community would end the NSA bulk telephony metadata program conducted under Section 215 of the USA PATRIOT Act. The President directed the Intelligence Community and the Attorney General to develop options for a new approach to match the capabilities and fill the gaps that the Section 215 program was designed to address without the government acquiring this metadata in bulk. Based on a recommendation from the Director of National Intelligence and the Attorney General, and after carefully considering the available options, in particular accepting one of the key recommendations of the President’s Review Group on Intelligence and Communications Technologies, the President announced in March 2014 that the government should no longer acquire this data in bulk. Instead, the President indicated that the data should remain at the telephone companies with a legal mechanism in place that would allow the government to obtain data pursuant to individual orders from the Foreign Intelligence Surveillance Court (FISC) approving the use of specific numbers to serve as the basis for the targeted production of telephony metadata. 

The President also noted, however, that legislation would be required to implement this new approach and the administration worked closely with Congress to enact the President’s proposal. On June 2, 2015, Congress passed and the President signed the USA FREEDOM Act of 2015. The Act reauthorized several important national security authorities; banned bulk collection under Section 215 of the USA PATRIOT Act, under the pen register and trap and trace provisions found in Title IV of Foreign Intelligence Surveillance Act (FISA), or pursuant to National Security Letters; adopted the new legal mechanism proposed by the President regarding the targeted production of telephony metadata; made significant modifications to proceedings before the FISC; and built on the U.S. Government’s unprecedented transparency about intelligence activities. With respect to the new mechanism for the targeted production of telephony metadata, to allow sufficient time to implement a new system while at the same time avoiding any lapse in a national security program, the USA FREEDOM Act provided for a 180-day transition period during which the existing NSA bulk telephony metadata program may continue.

On November 29, the transition period ends. Beginning Sunday, November 29, the government is prohibited from collecting telephone metadata records in bulk under Section 215, including of both U.S. and non-U.S. persons. And, while under the prior program NSA collected metadata in bulk and sought court approval for individual queries, the USA FREEDOM Act requires that the government must now base any application for telephone metadata records under FISA on a “specific selection term”—a term that specifically identifies a person, account, address, or personal device in a way that limits the scope of information sought to the greatest extent reasonably practicable. This further ensures that collection of information for intelligence purposes is appropriately focused and targeted, and is limited to information that telephone service providers have historically used for their internal billing and operational needs. Moreover, under the Act, the Government will report annually to Congress and to the public, among other things, the total number or orders issued under this authority and the number of targets of such orders.


As previously stated, NSA analytic access to the historical metadata collected under Section 215 has ceased. However, NSA has requested limited access to historical Section 215 metadata until February 29, 2016, limited to technical personnel and solely for the purpose of verifying that the new targeted production mechanism authorized by the USA FREEDOM Act is working as intended. The FISC is currently considering this request.


Separately, NSA remains under a continuing legal obligation to preserve its bulk 215 telephony metadata collection until civil litigation regarding the program is resolved, or the relevant courts relieve NSA of such obligations. The telephony metadata preserved solely because of preservation obligations in pending civil litigation will not be used or accessed for any other purpose, and NSA will destroy the Section 215 bulk telephony metadata as soon as possible upon expiration of its litigation preservation obligations.


With the transition period ending, the Intelligence Community has fulfilled an important Presidential commitment that allows national security professionals to retain the capabilities necessary to continue protecting the country, while strengthening the civil liberties protections that the American people cherish.




FACT SHEET: Implementation of the USA FREEDOM Act of 2015


November 27, 2015


In 2014, the Office of the Director of National Intelligence and the Department of Justice recommended to the President an approach that would end the National Security Agency’s (NSA) bulk telephony metadata program conducted under Section 215 of the USA PATRIOT Act, while preserving key capabilities and strengthening privacy protections. That approach was enshrined in the USA FREEDOM Act of 2015, which directs that the United States Government will no longer collect telephony metadata records in bulk under Section 215 of the USA PATRIOT Act, including records of both U.S. and non-U.S. persons. The new approach becomes effective on November 29, 2015, following a 6-month transition period from the previous system. This fact sheet describes key changes to the process for obtaining important lead information about international terrorist threats from telephony metadata held by U.S. telecommunications providers.


When will NSA end the collection of bulk telephony metadata under Section 215?


•The collection of bulk telephony metadata (call detail records) authorized

under the transition provision of the USA FREEDOM Act of 2015 will end by

11:59 PM on November 28, 2015.


•There will be no analytic access to the collected metadata after this time

because the data available under the USA FREEDOM Act is expected to be

operationally sufficient.


•NSA has requested continued access to historical bulk telephony metadata

until February 29, 2016 solely for technical testing purposes. Separately, NSA

remains under a continuing legal obligation to preserve records subject to

ongoing civil litigation actions.


•Upon receiving direction from the appropriate Court, NSA will destroy the

required call detail records received under the bulk program.


How does the new process required by the USA FREEDOM Act differ from the previous program?


•Effective November 29, the United States Government will no longer be

authorized to collect bulk telephony metadata under Section 215.


•Under the new process, the call detail records will be held and queried by the

telecommunications service providers, not by the government. That means

NSA will send specific telephone numbers or other identifying “selectors”

related to international terrorism to the providers and receive results from the

providers’ queries of their business records.


•Absent an emergency situation, the government may obtain the records only

pursuant to individual orders from the FISC approving the use of specific

selectors for queries based on a link to international terrorism.


•In an emergency situation, the Attorney General, or her designee, approves

the use of specific selectors in the first instance, and then NSA subsequently

submits them to the FISC for final approval. If an emergency request is

appropriate and all necessary statutory determinations have been made, the

Attorney General or her designee will generally be able to approve it within

hours or less of the initial request.


When will NSA implement the new, selected telephony metadata process required by the USA FREEDOM Act?


•Implementation will officially occur once the government submits to the FISC

an appropriately predicated application consistent with the USA FREEDOM

Act and then receives orders approving the use of specific selection terms for

the targeted production of call detail records. NSA has developed a technical

architecture to support the new process and expects to be operationally ready

on November 29, 2015.


•Testing of internal system functionality at both NSA and the

telecommunications providers has been ongoing. NSA will continue to work

with the telecommunications providers to address issues that might arise

during testing and the initial stages of operational use.


What is the purpose of the new process?


•The new process has been designed to continue supporting necessary

intelligence capabilities and fill the gaps that the previous Section 215

program addressed, without the government acquiring the telephony

metadata in bulk.


•There is still a need to be able to identify communications between terrorists

abroad and individuals with whom they are in contact in the United States.

Passage of the USA FREEDOM Act acknowledged the need to address such

threats, while strengthening privacy protections for all Americans. Neither

terrorist threats nor Americans’ expectations for privacy have receded.


Under the USA FREEDOM Act, will the Intelligence Community still be able to access the call detail records from selectors that it suspects are related to international terrorism?


•Yes. The process established by the USA FREEDOM Act will continue to

provide important lead information for investigation into terrorist threats by

making call detail records (which contain information about the fact of calls,

but not the content) available to the Intelligence Community to aid in the

investigation of these threats.


•Moreover, the overall volume of call detail records subject to query pursuant

to court order is greater under USA FREEDOM Act.


How does the new process work?


•NSA analysts will identify specific selectors (such as a phone number or

handset identifier) used by individuals associated with international

terrorism. They will document evidence of this association and submit it to

the Department of Justice for filing with the FISC (or to the Attorney General,

Deputy Attorney General, or Assistant Attorney General for National

Security, in emergency situations) for approval of the specific selection terms

based on the legal standard of reasonable, articulable suspicion – the standard

mandated by the USA FREEDOM Act.


•Only the FISC (or the Attorney General, Deputy Attorney General, or

Assistant Attorney General for National Security, in an emergency) can

approve the request.


•If approval is received, NSA will generate query requests and send them to

the providers. The legal framework permits providers to return call detail

records which are either one or two “hops” away from a FISC-approved,

terrorist-associated selection term. First hop selection terms (e.g., those that

are in direct contact with a FISC-approved selection term) may be obtained

from providers as well as from information identified independently by the

government. These first hop selection terms may then be sent by NSA as

query requests to the providers to obtain second hop records.


•The court-approved selectors may be used to query the providers’ call detail

records over a limited period of time (up to 180 days) without returning to

the FISC for approval.


Does the new USA FREEDOM Act process protect individuals’ privacy rights?


•By barring the government from collecting bulk telephony metadata under

the Section 215 Program and having the telecommunication providers hold

and query this data, we have made great strides in strengthening privacy

safeguards for individuals.


•The goal of the new USA FREEDOM Act was to create a technical solution

that enables the government to still obtain necessary phone records essential

to an investigation involving international terrorism while increasing privacy

and civil liberties protections.


•The minimization procedures, which must be adopted by the Attorney

General and approved by the FISC, are reasonably designed to protect

privacy consistent with the government’s needs to obtain, produce and

disseminate necessary foreign intelligence information related to

international terrorism. Technical controls will limit access to only those

personnel who are authorized and have been appropriately and adequately

trained.


•Moreover, NSA’s Civil Liberties and Privacy Office has played an integral

role in implementing the new process, ensuring that privacy risks and

impacts were thoroughly assessed from the outset.

No comments: