Wednesday, July 31, 2013

Don't Further Privatize National Security

There are proposals in Congress that would prohibit NSA from collecting communications metadata. If enacted this would have the effect of further privatizing intelligence gathering and national security. This is a bad idea. The intelligence community is already using far too many contractors, such as Booz Allen, to conduct what are essentially government functions. The last thing we need is more privatization of the government.

The Senate held an informative hearing on the NSA metadata collection program this morning. The purpose was to identify problems in the program and possible legislative changes. This article addresses one of those issues - Who should maintain the data.

By way of background here are links to the three documents that were declassified today regarding this program. 1) 2009 Report to Congress 2) FISA Court Primary Order 3) 2011 Report To Congress

Here's the issue. If the intelligence agencies have identified a phone number that they have a reasonable, articulable suspicion belongs to a person who has engaged in terrorism or is otherwise an enemy of the United States they investigate further. Most people believe that the Government should do something with that information, not just sit on it. The logical thing for them to do is see whether that phone number has contacted any phone numbers in the United States or any other country. At this point they do not know if there have been any contacts within the United States let alone who those contacts may be or where they may be located. Therefore they need to do as broad a search as possible to determine whether that phone number shows up in the call data of phone calls in the United States. To do that, intelligence agencies must have access to phone numbers in the United States that could have been contacted by that foreign number.

There are three ways to go about this. The United States can collect the phone call data from all of the phone companies and combine it in a way that enables the Agency to quickly do a search on the entire database. Keep in mind that at this point the only thing the government is trying to do is identify domestic phone numbers that communicated with the foreign phone number and, potentially, numbers that those people may be calling. That is what is currently happening.

There are two other ways to do this. Rather than collecting the data, the United States could require that the phone companies maintain the databases themselves. Then, when the agency wishes to see if a phone number that is linked to a terrorist has been in contact with any phone numbers in the United States it could send its agents to each of the phone companies and do separate searches of the individual databases to see if there are any contacts. Alternatively the United States could request that the phone company employees do the search and provide the information to the government.

For the system to work if the Government doesn't maintain the data, laws would have to be enacted which require the phone companies to keep the records for some period of time beyond what their pure business purpose is. The government generally likes to keep these records for up to five years whereas many phone companies may only keep them for a year or less. There will also be some other requirements. The phone companies will have to comply with government requirements for security. The data will have to be maintained in a way that is searchable for intelligence purposes, separate from the companies business purposes. In addition the phone companies will have to employ persons who have the proper security clearances and laws will have to be enacted similar to those applicable to government employees, which criminalize the unauthorized use of those phone data logs. And since all of these requirements will cost money the Government will have to pay the companies for carrying out these activities.

Also, the United States is going to have to feel good about having to ask China Mobile, Verizon, AT&T, and all of the other phone companies, whether domestic or foreign, that do telecon business in the United States, to carry out our foreign intelligence activities, essentially handing over an essential government function to private companies including foreign companies.

Most people, including me, have concerns about the way the current NSA program is being conducted. There are real concerns about transparency, monitoring and controls. But we need to think carefully before embracing alternatives. Turning each American phone companies let alone foreign companies into privatized NSAs is not a good idea. We need to address the concerns about transparency by addressing those concerns directly, not by privatizing the activity. We need to address the concerns about the FISA court directly, not by thinking they will go away if the databases are maintained and queried by private companies as opposed to the NSA.

One thing is certain. The American people will never accept a situation in which the US government obtains intelligence about potential terrorism in the United States and does nothing about it. It is hard to imagine many Americans, let alone Members of Congress, who would advocate ignoring actionable intelligence. Here is an excerpt from the 2011 memorandum that explains why:

Prior to the attacks of 9/11, the NSA intercepted and transcribed seven calls from hijacker Khalid al-Mihdhar to a facility associated with an al Qa'ida safehouse in Yemen. However, NSA's access point overseas did not provide the technical data indicating the location from where al-Mihdhar was calling. Lacking the originating phone number, NSA concluded that al-Mihdhar was overseas. In fact, al-Mihdhar was calling from San Diego. California. According to the 9/11 Commission Report (pages 269-272):

"Investigations or interrogation of them [Khalid al-Mihdhar, etc], and investigation of their travel andfinancial activities could have yielded evidence of connections to other participants in the 9/1] plot. The simple fact of their detention could have derailed the plan. In any case, the opportunity did not arise."

Today, under FISA Court authorization pursuant to the "business records" authority of the FISA (commonly referred to as "Section 215"), the govemment has developed a program to close the gap that allowed al-Mihdhar to plot undetected within the United States.

When overseas contact information is developed the first action is always to see whether a phone number of a suspected terrorist has been in contact with phone numbers in the United States or elsewhere in the world. That will not stop. The issue before the Congress now is to ensure that it is done in the most effective and efficient manner, that is as protective as possible of the privacy rights of Americans.

There are many good ideas that are being discussed in connection with the administration of the NSA's phone data collection activities. Clearly the issue of transparency is one that needs to be worked on. Also, there may be ways to make people have more confidence in the activities of the FISA court. But turning our private phone companies into arms of the federal government makes no sense at all. It is not only a logistic and operational nightmare but it furthers the process of turning government activities into corporate activities. We have been going down this road for many decades whether in the area of prisons, defense contracting, and virtually anything else you can name. In virtually every instance the result is higher cost, lower quality, and less accountability.

For people who are concerned about accountability of the government, imagine what happens if Verizon and China Mobile are storing the data and conducting searches. One can guess that most people will come to the conclusion that this is not the way we want to go.

Monday, July 15, 2013

The Outrage In The Zimmerman Case Is The Law – Not The Judge, Jury, Defense Or Prosecution

The verdict in the trial of the Zimmerman for the homicide of Trayvon Martin is an outrage. George Zimmerman killed him. George Zimmerman instigated the events which resulted in Martin's death. Unfortunately the law prevented justice in this case, and it is the standard self defense law, not the "Stand Your Ground" law.

Disclaimer. There is no question the George Zimmerman killed Trayvon Martin. It is difficult to believe that Zimmerman was not motivated at least in part by racial animus. If Zimmerman had not taken the steps he did that night Trayvon Martin would be alive. The evidence included many self-serving statements by Zimmerman and in many instances he lied. Having said that, the verdict in this case was a product of the law that the jury had to deal with.

The Zimmerman trial did not turn on the Florida stand your ground law, even though a stand your ground instruction was given. Rather, it is a case of the self-defense law of Florida, which is shared by all states in the nation except Ohio. Under Florida law if a defendant asserts a prima facie case of self-defense the State must prove beyond a reasonable doubt that the defendant did not act in self-defense. Note, the defendant doesn't need to prove anything. The state must prove that the defendant did not act in self-defense. As we saw in the Zimmerman case that is an almost impossible burden on the state in a case where the victim is dead and there are no eyewitnesses.

Before getting to this self-defense issue, a few words on stand your ground. Essentially the stand your ground laws eliminate the duty to retreat that is otherwise required in cases of a confrontation outside of one's home. In the case of Florida's law, if a defendant seeks to invoke stand your ground for having injured or killed someone, the person can request a pretrial hearing at which a determination of the applicability of the law is made. If the person succeeds, there will be no trial. It is noteworthy that the general lack of a duty to retreat is not present if it is determined that the defendant was the instigator of the conflict.

There is some question as to why the Zimmerman defense did not seek a stand your ground hearing. If they were convinced they could win it is hard to see why they would not have done so since it certainly could have saved much of the expense of trial. One is left with the thought that maybe they were concerned about whether Zimmerman would be ruled to have been the aggressor, the one who instigated this conflict. Nevertheless, while stand your ground instructions were given in this case which made clear that Zimmerman did not have a duty to retreat, given the defense's presentation it is doubtful that it had much impact. The defense argued that he was attacked, fell to the ground, and therefore had no ability to retreat. Even if stand your ground were not applicable, the state did not appear capable of presenting any evidence indicating that Zimmerman did not try to retreat.

A recent Florida case, Falwell v Florida sets out the current state of Florida self defense law,

When self-defense is asserted, the defendant has the burden of producing
enough evidence to establish a prima facie case demonstrating the justifiable use of
force. Montijo v. State, 61 So. 3d 424, 427 (Fla. 5th DCA 2011); Fields v. State, 988
So. 2d 1185, 1188 (Fla. 5th DCA 2008); see Murray v. State, 937 So. 2d 277, 282 (Fla.
4th DCA 2006) (holding that law does not require defendant to prove self-defense to
any standard measuring assurance of truth, exigency, near certainty, or even mere probability
; defendant’s only burden is to offer facts from which his resort to force could have been reasonable). Once the defendant makes a prima facie showing of self defense, the State has the burden of proving beyond a reasonable doubt that the defendant did not act in self-defense. Fields, 988 So. 2d at 1188. The burden of proving guilt beyond a reasonable doubt, including the burden of proving that the defendant did not act in self-defense, never shifts from the State to the defendant. Montijo, 61 So. 3d at 427; Fields, 988 So. 2d at 1188; see Monsansky v. State, 33 So. 3d 756 (Fla. 1st DCA 2010) (explaining that defendant has burden to present sufficient evidence that he acted in self-defense in order to be entitled to jury instruction on issue, but presentation of such evidence does not change elements of offense at issue; rather, it merely requires state to present evidence that establishes beyond reasonable doubt that defendant did not act in self-defense); Murray, 937 So. 2d at 279 (explaining that defendant in trial for aggravated battery was not required to prove self-defense claim beyond reasonable doubt or by preponderance of evidence; rather, self-defense evidence needed merely leave jury with reasonable doubt about whether he was justified in using deadly force).

It is important to note that in order for this self-defense burden to shift to the prosecution the defendant only need offer a few minimal facts suggesting he acted in self-defense. As the court says the defendant is not required to "prove self-defense to any standard measuring assurance of truth, exit and see, near certainty, or even mere probability . . .."

So what did this mean in the context of the Zimmerman case? From the very beginning Zimmerman made a prima facie case for self-defense. He had injuries, however minor. And he asserted to the police initially that he had acted in self-defense. Given those bare facts, ignoring for a moment all his other statements and a few witness statements, it was the state's burden to prove "beyond a reasonable doubt" that he did not act in self-defense.

In analyzing the evidence offered at trial, virtually all of the statements made by Zimmerman after the night of the shooting could have been disregarded by the jury. It was very clear that they were self-serving statements, that he had a strong motivation to lie, and that because he was caught in numerous lies his credibility was minimal. It was also reasonable for the jury to give Rachel Jeantel's testimony considerable weight. That testimony indicated that Zimmerman initiated the incident, he followed Martin, and Martin reacted with concern, if not outright fear. But her testimony ends minutes before the shooting. The testimony covering the remaining minutes is conflicting. Without going over it all, there is testimony indicating that Martin was on top of Zimmerman and contrary testimony indicating Zimmerman was on top of Martin. There is conflicting testimony as to who was screaming. There were injuries to Zimmerman and all evidence indicates that Martin was shot at close range.

If this were a case where Zimmerman had to prove beyond a reasonable doubt or even prove with a simple preponderance of the evidence that he acted in self-defense, it is not unlikely that he would have been convicted. However he didn't have to show anything. The state had to prove beyond a reasonable doubt that he did not act in self defense.

This case is about race because there is every indication that George Zimmerman would not have followed Martin that night but for his race. There is also every indication that Zimmerman was, at best, a totally irresponsible gun owner Who had dreams of police glory and was prone to vigilantism. It also appears that the Sanford Police Department did not initially give this case the type of scrutiny it deserved. It may also be possible that some of the jurors were unable to exclude race from their consideration. Having said all those things however the outcome of this case was a result of the law. Moving forward, it is time for a serious examination of the state of the law of self-defense in this country. The killing of Trayvon Martin has made that abundantly clear.

Saturday, July 06, 2013

The Fourth Amendment Doesn't Cover Data Collection In the Abstract

The Fourth Amendment does not restrict the collection of things unless those things are used by the Government to deprive someone of life, liberty or property. Additionally, existing Supreme Court precedent says there is no reasonable expectation of privacy in phone call data and therefore the Government does not need a warrant to get phone company call data even if it uses that data in a criminal proceeding. Simply put, what many people perceive as an invasion of privacy is neither illegal nor Unconstitutional. Those two points and some other matters seem to get glossed over in some of the discussion about the disclosures of the NSA's data collection practices. This is an attempt to sort through a little of that and is limited to the NSA program collecting call records from phone companies.

Disclaimer. I believe there is far too much information classified by the federal government. I believe we have far too many intelligence agencies. I believe that portions of the Patriot Act are a very bad idea, particularly the authority to issue national security letters, though I suspect the current Supreme Court would find it all Constitutional. I believe we need a court like the FISA Court with Article III judges who have security clearances and who can convene and make decisions on quick notice to review intelligence agency actions and issue warrants. I believe that much of what the FISA court does must remain classified for a reasonable period of time. Having said that I think the FISA court can be considerably more transparent. I also believe the Congressional oversight committees can be considerably more transparent. Lastly if I could choose who I wanted to have my phone records, I would prefer the NSA over Verizon.

When the NSA requests telephone call records from telephone companies, records which the telephone companies already have collected and maintained, two questions arise. Is the NSA authorized by statute to collect the information and is the NSA or another agency using the information in a manner consistent with law? There is an important distinction between these two issues. Analysis of these two issues also subsumes the question of whether the law as written or applied is Constitutional.

Before getting to the NSA, let's appreciate the world we are already live in. There is a considerable amount of data that is collected and maintained by private companies on every individual in this country. For example, our banks know our names addresses, telephone numbers, Social Security numbers, credit history, credit rating, and how much we spend, what we buy, where we buy it, and how much we spend for it. Banks maintain those records and use the information for a variety of purposes including billing, credit reviews, credit decisions, marketing, and other matters. Similarly, our telephone companies maintain records on every call we make, what numbers we call, how long we are on the phone, and other matters. The same is true for stores where we shop, which maintain detailed records on what we buy, how much we spend, when we buy it, and how we pay for it. The list of private companies maintaining records on our personal lives is extensive.

These records are maintained as a matter of course by commercial enterprise and there are no federal laws prohibiting companies from collecting this data. In some instances, such as financial institutions and medical providers, there are laws governing how the data can be used, but to a large extent our privacy is subject to the whim of these companies. We rely on them to keep our data secure and to implement and enforce strict policies regarding how it is used by the company and how the company prevents its misuse by its employees.

The recent NSA disclosures shine a light on the fact that telephone company call record data is also shared with and held by the NSA. To some people, having the government hold that data presents a significantly greater concern than when that data is merely held by a private company. That fear is justifiably based on the concern that the Government, using that data, could use the power of the state to deprive people of life, liberty or property. I would share that concern if I didn't know that there are statutory and Constitutional restrictions that prevent this from happening. Furthermore, to the best of our knowledge, this data has never been used to deprive American citizens, residents or others living in the United States of life, liberty or property in violation of the laws or Constitution.

Now to the Constitution. The Fourth Amendment provides

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

While on its face it may appear otherwise, the Fourth Amendment does not, in a vacuum, restrict the government from collecting data. In fact it doesn't restrict the government from collecting anything. What the Fourth Amendment does is prohibit the government from collecting things without probable cause and without a properly executed warrant if it uses that data, information, or material to deprive someone of life, liberty or property, most often in a criminal proceeding. And if the original collection is Unconstitutional then everything that flows from that collection is Fruit Of The Poison Tree that is likewise excluded from use under the Exclusionary Rule. It may be possible to pursue a civil action under the Federal Tort Claims Act for a violation of privacy, but that would face many hurdles, not the least of which a determination of damages if the Government hasn't actually done anything with your data. (There are many good treatises on the Fourth, even this one in Wikipedia.)

And when it comes to call records, the Supreme Court has gone so far as to say they are not covered by the Fourth Amendment even if used to get a name and tap a phone and introduce the tapped calls in evidence in a criminal proceeding. That 1979 case is Smith the Maryland, which held that there was no reasonable Fourth Amendment expectation of privacy regarding the phone numbers given by a person to a phone company. In that case, the police installed a "pen register" at a telephone company without a warrant. The pen register recorded all of the phone numbers that were dialed from the defendant's home telephone. The police use those numbers to develop evidence against the defendant. At trial the defendant sought to have that evidence excluded on the grounds that it was only obtained through a warrantless search of his phone records. The lower courts and ultimately the Supreme Court ruled that there was no Fourth Amendment violation. Specifically, the Supreme Court stated:

(a) Application of the Fourth Amendment depends on whether the person invoking its protection can claim a "legitimate expectation of privacy" that has been invaded by government action. This inquiry normally embraces two questions: first, whether the individual has exhibited an actual (subjective) expectation of privacy; and second, whether his expectation is one that society is prepared to recognize as "reasonable." Katz v. United States, 389 U. S. 347. Pp. 442 U. S. 739-741.

(b) Petitioner in all probability entertained no actual expectation of privacy in the phone numbers he dialed, and even if he did, his expectation was not "legitimate." First, it is doubtful that telephone users in general have any expectation of privacy regarding the numbers they dial, since they typically know that they must convey phone numbers to the telephone company and that the company has facilities for recording this information and does, in fact, record it for various legitimate business purposes. And petitioner did not demonstrate an expectation of privacy merely by using his home phone, rather than some other phone, since his conduct, although perhaps calculated to keep the contents of his conversation private, was not calculated to preserve the privacy of the number he dialed. Second, even if petitioner did harbor some subjective expectation of privacy, this expectation was not one that society is prepared to recognize as "reasonable." When petitioner voluntarily conveyed numerical information to the phone company and "exposed" that information to its equipment in the normal course of business, he assumed the risk that the company would reveal the information to the police, cf. United States v. Miller, 425 U. S. 435. Pp. 442 U. S. 741-746.

While the Constitution does not speak to the mere collection of data there are Federal laws which do. They provide agencies the authority they need to collect the data, and place restrictions on both the collection and use of the data. Section 215 of the Patriot Act is the law the Government assets as the authority to collect call record data from telephone companies. Section 215 authorizes the collection of any tangible thing, including business records from a telephone company after obtaining a warrant from the FISA court.

There is a difference of opinion as to whether or not section 215 covers mass collections of data regarding potentially millions of telephone numbers at one time and whether the law is Constitutional. At the link you will see why the ACLU thinks it is Unconstitutional. Suffice it to say that while there is a difference of opinion on this issue, the Justice Department believes this activity is authorized, the FISA court believes this activity is authorized, and most members of the Congressional oversight committees appear to believe this activity is authorized. Ultimately a court may rule the activity is not authorized or that the law is Unconstitutional but clearly, as of now, the activity is being carried out under color of law.

Many are troubled by the Government simply having the data, regardless of how it is used. Others are not particularly concerned about the collection of the data but focus instead on how it is used. Is the Government using it in an unauthorized or Unconstitutional manner to deprive people of life, liberty or property? Given a choice some people would rather have the data held by a government agency, which is at least somewhat accountable, then being held by private companies which have virtually no accountability.

While we have very little control or recourse over how private companies use our data we have a great deal of recourse on how the federal government uses the data. We are not talking about some random government employee voyeur perusing data, an activity that would violate agency regulations. We are talking about the information being used by the agency in a way that harms us.

In order for the federal government to use the telephone numbers against a person, it has to first determine the name of the person associated with a number. Until it does that, it merely has phone numbers. Then, if it wants to hear what the person talking on that phone is saying, it has to obtain an individualized warrants to tap that telephone number. If it does not obtain an individualized warrant to tap that telephone number none of those conversations can be introduced in evidence at a judicial or administrative proceeding. And if it did not get a warrant to collect the data initially, even the data cannot be introduced in evidence, not because of the Fourth Amendment but because of the restrictions in FISA.

It is noteworthy that the government's ability to obtain the content of phone conversations is prospective in nature. It cannot obtain records of the content of prior telephone conversations because they are not kept by the telephone company. And if the government on its own had decided to tap the phone number earlier, it would have needed an individualized warrant to engage in that activity if it subsequently sought to introduce evidence of the content of the phone conversation in a judicial proceeding.

Some have suggested that the NSA call data collection program is in some way comparable to the Bush warrantless wiretap program, which was discontinued after significant outrage. I too would be outraged if this program in any way resembled the Bush program, but it does not. The Bush warrantless wiretap program, involved the collection of the content of telephone calls, emails, and other communications in the United States, of US citizens, without a warrant. The Obama program does not. It only involves phone numbers and the duration of phone calls. There is no recording of telephone calls. If, based on a review of those phone numbers the authorities wish to obtain the content of future communications between people associated with those numbers, they have to obtain a separate individualized warrant to tap the phone.

Additionally, the Bush program was not only done without any warrants it was done without any legal authority. Since Bush knew the program was not authorized under the Foreign Intelligence Surveillance Act they did not go the FISA Court to obtain a warrant. And since they couldn't rely on FISA as legal authority for the program, Bush manufactured an Executive Order which he claimed was issued under the authority of the AUMF (Authorization For Use Of Military Force). This assertion was so bogus that even Republicans on the Hill didn't buy it and the result was amendments to FISA to make the point absolutely clear

If it turns out that the Obama administration has or in the future develops a program different from the one that is currently outlined I will have a problem with it. But until then I see this as a minimal intrusion.