CISPA IS NOT DEAD. VIOLATING OUR PRIVACY IS NOT AN OPTION.
Government spying will continue until we draw a line in the sand. Who's with us?
1,000 pages of documents reveal that the U.S. Government has
already
secretly authorized legal immunity for companies like AT&T when
they help spy on you. CISPA would give this program full legal footing.
Don't let it.
Senior
Obama administration officials have secretly authorized the
interception of communications carried on portions of networks operated
by AT&T and other Internet service providers, a practice that might
otherwise be illegal under federal wiretapping laws.
The secret
legal authorization from the Justice Department originally applied to a
cybersecurity pilot project in which the military monitored defense
contractors' Internet links. Since then, however, the program has been
expanded by President Obama to cover all critical infrastructure sectors
including energy, healthcare, and finance starting June 12.
"The
Justice Department is helping private companies evade federal wiretap
laws," said Marc Rotenberg, executive director of the Electronic Privacy
Information Center, which obtained over 1,000 pages of internal
government documents and provided them to CNET this week. "Alarm bells
should be going off."
Those documents show the National Security
Agency and the Defense Department were deeply involved in pressing for
the secret legal authorization, with NSA director Keith Alexander
participating in some of the discussions personally. Despite initial
reservations, including from industry participants, Justice Department
attorneys eventually signed off on the project.
The Justice
Department agreed to grant legal immunity to the participating network
providers in the form of what participants in the confidential
discussions refer to as "2511 letters," a reference to the Wiretap Act
codified at 18 USC 2511 in the federal statute books.
The Wiretap
Act limits the ability of Internet providers to eavesdrop on network
traffic except when monitoring is a "necessary incident" to providing
the service or it takes place with a user's "lawful consent." An
industry representative told CNET the 2511 letters provided legal
immunity to the providers by agreeing not to prosecute for criminal
violations of the Wiretap Act. It's not clear how many 2511 letters were
issued by the Justice Department.
In 2011, Deputy Secretary of
Defense William Lynn publicly disclosed the existence of the original
project, called the DIB Cyber Pilot, which used login banners to inform
network users that monitoring was taking place. In May 2012, the pilot
was turned into an ongoing program -- broader but still voluntary -- by
the name of Joint Cybersecurity Services Pilot, with the Department of
Homeland Security becoming involved for the first time. It was renamed
again to Enhanced Cybersecurity Services program in January, and is
currently being expanded to all types of companies operating critical
infrastructure.
The NSA and DOJ declined to comment. Homeland Security spokesman Sy Lee sent CNET a statement saying:
DHS
is committed to supporting the public's privacy, civil rights, and
civil liberties. Accordingly, the department has implemented strong
privacy and civil rights and civil liberties standards into all its
cybersecurity programs and initiatives from the outset, including the
Enhanced Cybersecurity Services program. In order to protect privacy
while safeguarding and securing cyberspace, DHS institutes layered
privacy responsibilities throughout the department, embeds fair practice
principles into cybersecurity programs and privacy compliance efforts,
and fosters collaboration with cybersecurity partners.
Paul
Rosenzweig, a former Homeland Security official and founder of Red
Branch Consulting, compared the NSA and DOD asking the Justice
Department for 2511 letters to the CIA asking the Justice Department for
the so-called torture memos a decade ago. (They were written by Justice
Department official John Yoo, who reached the controversial conclusion
that waterboarding was not torture.)
"If you think of it poorly,
it's a CYA function," Rosenzweig says. "If you think well of it, it's an
effort to secure advance authorization for an action that may not be
clearly legal."
A report (PDF) published last month by the
Congressional Research Service, a non-partisan arm of Congress, says the
executive branch likely does not have the legal authority to authorize
more widespread monitoring of communications unless Congress rewrites
the law. "Such an executive action would contravene current federal laws
protecting electronic communications," the report says.
Because
it overrides all federal and state privacy laws, including the Wiretap
Act, legislation called CISPA would formally authorize the program
without the government resorting to 2511 letters. In other words, if
CISPA, which the U.S. House of Representatives approved last week,
becomes law, any data-sharing program would be placed on a solid legal
footing. AT&T, Verizon, and wireless and cable providers have all
written letters endorsing CISPA.
Around the time that CISPA was
originally introduced in late 2011, NSA, DOD, and DHS officials were
actively meeting with the aides on the House Intelligence committee who
drafted the legislation, the internal documents show. The purpose of the
meeting, one e-mail shows, was to brief committee aides on "cyber
defense efforts." In addition, Ryan Gillis, a director in DHS's Office
of Legislative Affairs, sent an e-mail to Sen. Dianne Feinstein
(D-Calif.), chairman of the Senate Intelligence committee, discussing
the pilot program around the same time.
AT&T and CenturyLink
are currently the only two providers that have been publicly announced
as participating in the program. Other companies have signed a
memorandum of agreement with DHS to join, and are currently in the
process of obtaining security certification, said a government official,
who declined to name those companies or be identified by name.
Approval
of the 2511 letters came after concerns from within the Justice
Department and from industry. An internal e-mail thread among senior
Defense Department, Homeland Security, and Justice Department officials
in 2011, including associate deputy attorney general James Baker,
outlines some of the obstacles:
[The program] has two key
barriers to a start. First, the ISPs will likely request 2511 letters,
so DoJ's provision of 3 2511 letters (and the review of DIB company
banners as part of that) is one time requirement. DoJ will provide a
timeline for that. Second, all participating DIB companies would be
required to change their banners to reference government monitoring. All
have expressed serious reservations with doing so, including the three
CEOs [the deputy secretary of defense] discussed this with. The
companies have informally told us that changing the banners in this
manner could take months.
Another e-mail message from a Justice
Department attorney wondered: "Will the program cover all parts of the
company network -- including say day care centers (as mentioned as a
question in a [deputies committee meeting]) and what are the policy
implications of this?" The deputies committee includes the deputy
secretary of defense, the deputy director of national intelligence, the
deputy attorney general, and the vice chairman of the Joint Chiefs of
Staff.
"These agencies are clearly seeking authority to receive a
large amount of information, including personal information, from
private Internet networks," says EPIC staff attorney Amie Stepanovich,
who filed a lawsuit against Homeland Security in March 2012 seeking
documents relating to the program under the Freedom of Information Act.
"If this program was broadly deployed, it would raise serious questions
about government cybersecurity practices."
In January, the
Department of Homeland Security's privacy office published a privacy
analysis (PDF) of the program saying that users of the networks of
companies participating in the program will see "an electronic login
banner [saying] information and data on the network may be monitored or
disclosed to third parties, and/or that the network users'
communications on the network are not private."
An internal
Defense Department presentation cites as possible legal authority a
classified presidential directive called NSPD 54 that President Bush
signed in January 2008. Obama's own executive order, signed in February
2013, says Homeland Security must establish procedures to expand the
data-sharing program "to all critical infrastructure sectors" by
mid-June. Those are defined as any companies providing services that, if
disrupted, would harm national economic security or "national public
health or safety."
Those could be very broad categories, says
Rosenzweig, author of a new book called "Cyber War," which discusses the
legality of more widespread monitoring of Internet communications.
"I
think there's a great deal of discretion," Rosenzweig says. "I could
make a case for the criticality of several meat packing plants in
Kansas. The disruption of the meat rendering facilities in Kansas would
be very disruptive to the meat-eating habits of Americans.