NSA Slide Tells Agents NOT To Worry About 'Incidental' Collection Of Info On Americans

[kpete]

Lesson 4: So you got a U.S. Person Information?

And then explains what to do about it. They're pretty clear that if you're directly targeting a US person, that's a problem (and it is, because that's illegal). If it's considered "inadvertent," then you also have to stop, write up an incident report and notify people. That sounds reasonable. But... then there's the "incidental" section. Here, incidental is described as:

You targeted a legitimate foreign entity and acquired information/communications to/from/about a U.S. Person in your results.

That doesn't seem particularly "incidental" to me. But, here's the kicker. While with all the other forms of collection the NSA is told to stop, when it's "incidental" they're told:

This does not constitute a USSID SP008 violation, so it does not have to be reported in the IG quarterly.

Note that the IG report is the one that was revealed, listing all of the abuses. Yet, here they seem to be indicating that these "incidental" collections of information (and note that it's not just "metadata" here, but full "communications" as well) aren't a real problem. They're told to "apply... minimization procedures" to limit the info on US persons, but we've already seen what a joke those minimization procedures can be.

As Gellman also notes in his report, it appears that the info collected "incidentally" here gets added to NSA databases and can be searched freely:

The NSA uses the term “incidental” when it sweeps up the records of an American while targeting a foreigner or a U.S. person who is believed to be involved in terrorism. Official guidelines for NSA personnel say that kind of incident, pervasive under current practices, “does not constitute a . . . violation” and “does not have to be reported” to the NSA inspector general for inclusion in quarterly reports to Congress.

SLIDE HERE:
https://www.documentcloud.org/documents/758637-lesson-4-job-aid-usp-info.html

http://www.techdirt.com/articles/20130816/02000924201/wacky-nsa-slide-tells-agents-not-to-worry-about-incidental-collection-info-americans.shtml

[dixiegrrrrl]

1. and no where is the term "violation of rights" used.

Language...so important.

[WillyT]

2. K & R !!!

[msanthrope]

3. He's right. The "incidental" collection of evidence is not a violation of civil rights--

Let me give you an example of this--

The FBI targets a well-known figure in organized crime, say John H. Doe. Through a grand jury, they obtain the authority to get bank and phone records.
But here's the thing. The bank sends the records of John R. Doe. That's you. The phone company sends the records of John B. Doe. That's a cousin of yours.
The FBI can look at those records. And if they find something that gives rise to reasonable suspicion to investigate you, they certainly can proceed. No civil rights of yours have been violated.

Here's another example: Let's say John M. Doe, international terrorist, misdials his friend's number and ends up calling your house. Can the NSA then look at your meta data? Yes, since the target of the investigation has called your number. Can they tap your phone? No--still need a warrant for that. Can they place a pen register on your phone (which seems to be the meta data, so I may be repeating myself here.) Yes. They can. Can they "check you out?" Yes. They can.

Now, can the results of that be put in a database? Yes--and here is where it gets interesting. Law enforcement is allowed to keep records of incidental contacts with citizens--and they do, as any good police officer will fill out 'cards' or other paperwork used to track incidental contacts, particularly those around crime scenes. Can this all be put in a database? Well, if you can put it in a filing cabinet (the cards) then probably, a database is permissible. Heck--NCIC wouldn't exist without this kind of information.

It's technology that makes this a pretty scary thing to contemplate--we aren't talking incident reports or field cards--we are talking about the government being able to leapfrog connections that pick up a vast amount of people, and a vast amount of information, and then store it. It makes me uneasy, and I think Congress, particularly Senate Judiciary needs to do some work here and figure out how to safeguard against abuses. Abuses by both government and private companies .... like Facebook.

[woo me with science]

4. K&R