U.S. to disclose estimate of Americans under surveillance by early 2017

An undated aerial handout photo shows the National Security Agency (NSA) headquarters building in Fort Meade, Maryland.

By Dustin Volz

WASHINGTON (Reuters) – The U.S. intelligence community has committed to providing as soon as next month a public estimate of the number of U.S. persons whose electronic communications are ensnared under a surveillance authority intended for foreign espionage, according to a bipartisan group of congressional lawmakers’ letter that Reuters saw.

The decision would reverse the government’s longstanding position that calculating such a number may be technically impossible and would require privacy intrusions exceeding those raised by the actual surveillance programs.

It also comes as Congress is expected to begin debate in the coming months over whether to reauthorize or reform the surveillance authority, known as Section 702, a provision that was added to the Foreign Intelligence Surveillance Act in 2008.

The letter, sent on Friday to National Intelligence Director James Clapper, said his office and National Security Agency officials had briefed congressional staff about how the intelligence community intends to comply with the lawmakers’ disclosure request.

Clapper’s office did not immediately respond to a request for comment.

The 11 lawmakers, all members of the U.S. House Judiciary Committee, termed their letter an effort to “memorialize our understanding” of the intelligence community’s plan to provide an estimate in real numbers, not percentages, as soon as January that can be shared with the public.

“The timely production of this information is incredibly important to informed debate on Section 702 in the next Congress— and, without it, even those of us inclined to support re-authorization would have reason for concern,” the letter said.

Section 702 will expire on December 31, 2017, absent congressional action. It enables two internet surveillance programs called Prism and Upstream that were revealed in a series of leaks by former NSA contractor Edward Snowden more than three years ago.

Intelligence officials have said that data about Americans is “incidentally” collected under Section 702, due to a range of technical and practical reasons. Critics have assailed such collection as back-door surveillance of Americans without a warrant.

Clapper, who is stepping down next month, suggested in April that providing an estimate of Americans surveilled under Section 702, a figure some have said could tally in the millions, might be possible, while defending the law as “a prolific producer of critical intelligence.”

Republicans James Sensenbrenner, Darrell Issa, Ted Poe and Jason Chaffetz signed the letter, in addition to Democrats John Conyers, Jerrold Nadler, Zoe Lofgren, Hank Johnson, Ted Deutch, Suzan DelBene and David Cicilline.

(Reporting by Dustin Volz; Editing by Lisa Von Ahn)

Dozens of U.S. lawmakers request briefing on Yahoo email scanning

Yahoo Mail logo

By Dustin Volz

WASHINGTON (Reuters) – A bipartisan group of 48 lawmakers in the U.S. House of Representatives on Friday asked the Obama administration to brief Congress “as soon as possible” about a 2015 Yahoo <YHOO.O> program to scan all of its users’ incoming email at the behest of the government.

The request comes amid scrutiny by privacy advocates and civil liberties groups about the legal authority and technical nature of the surveillance program, first revealed by Reuters last week. Custom software was installed to search messages to hundreds of millions of accounts under an order issued by the secretive Foreign Intelligence Surveillance Court.

“As legislators, it is our responsibility to have accurate information about the intelligence activities conducted by the federal government,” according to the letter, organized by Republican Representative Justin Amash of Michigan and Democratic Representative Ted Lieu of California.

“Accordingly, we request information and a briefing as soon as possible for all members of Congress to resolve the issues raised by these reports.”

Investigators searched for messages that contained a single piece of digital content linked to a foreign state sponsor of terrorism, sources have told Reuters, though the nature of the content remains unclear.

Intelligence officials said Yahoo modified existing systems used to stop child pornography and filter spam messages on its email service.

But three former Yahoo employees told Reuters the court-ordered search was done by a module buried deep near the core of the company’s email server operation system, far below where mail sorting was handled.

The Senate and House intelligence committees were given a copy of the order when it was issued last year, sources said, but other members of Congress have express concern at the scope of the email scanning.

Some legal experts have questioned the breadth of the court order and whether it runs afoul of the U.S. Constitution’s Fourth Amendment protections against unreasonable searches.

Half of registered U.S. voters believe the Yahoo program violated the privacy of customers, according to a poll of 1,989 people conducted last week by Morning Consult, a polling and media company.

Twenty-five percent were supportive of the program because of its potential to stop criminal acts, the survey found, while another quarter did not know or had no opinion.

The congressional letter is addressed to Attorney General Loretta Lynch and Director of National Intelligence James Clapper.

(Additional reporting by Mark Hosenball and Joseph Menn; Editing by Jeffrey Benkoe)

Exclusive: Yahoo secretly scanned customer emails for U.S. intelligence – sources

Yahoo billboard

By Joseph Menn

SAN FRANCISCO (Reuters) – Yahoo Inc last year secretly built a custom software program to search all of its customers’ incoming emails for specific information provided by U.S. intelligence officials, according to people familiar with the matter.

The company complied with a classified U.S. government demand, scanning hundreds of millions of Yahoo Mail accounts at the behest of the National Security Agency or FBI, said three former employees and a fourth person apprised of the events.

Some surveillance experts said this represents the first case to surface of a U.S. Internet company agreeing to an intelligence agency’s request by searching all arriving messages, as opposed to examining stored messages or scanning a small number of accounts in real time.

It is not known what information intelligence officials were looking for, only that they wanted Yahoo to search for a set of characters. That could mean a phrase in an email or an attachment, said the sources, who did not want to be identified.

Reuters was unable to determine what data Yahoo may have handed over, if any, and if intelligence officials had approached other email providers besides Yahoo with this kind of request.

According to two of the former employees, Yahoo Chief Executive Marissa Mayer’s decision to obey the directive roiled some senior executives and led to the June 2015 departure of Chief Information Security Officer Alex Stamos, who now holds the top security job at Facebook Inc.

“Yahoo is a law abiding company, and complies with the laws of the United States,” the company said in a brief statement in response to Reuters questions about the demand. Yahoo declined any further comment.

Through a Facebook spokesman, Stamos declined a request for an interview.

The NSA referred questions to the Office of the Director of National Intelligence, which declined to comment.

The request to search Yahoo Mail accounts came in the form of a classified edict sent to the company’s legal team, according to the three people familiar with the matter.

U.S. phone and Internet companies are known to have handed over bulk customer data to intelligence agencies. But some former government officials and private surveillance experts said they had not previously seen either such a broad demand for real-time Web collection or one that required the creation of a new computer program.

“I’ve never seen that, a wiretap in real time on a ‘selector,'” said Albert Gidari, a lawyer who represented phone and Internet companies on surveillance issues for 20 years before moving to Stanford University this year. A selector refers to a type of search term used to zero in on specific information.

“It would be really difficult for a provider to do that,” he added.

Experts said it was likely that the NSA or FBI had approached other Internet companies with the same demand, since they evidently did not know what email accounts were being used by the target. The NSA usually makes requests for domestic surveillance through the FBI, so it is hard to know which agency is seeking the information.

Alphabet Inc’s Google and Microsoft Corp, two major U.S. email service providers, separately said on Tuesday that they had not conducted such email searches.

“We’ve never received such a request, but if we did, our response would be simple: ‘No way’,” a spokesman for Google said in a statement.

A Microsoft spokesperson said in a statement, “We have never engaged in the secret scanning of email traffic like what has been reported today about Yahoo.” The company declined to comment on whether it had received such a request.

CHALLENGING THE NSA

Under laws including the 2008 amendments to the Foreign Intelligence Surveillance Act, intelligence agencies can ask U.S. phone and Internet companies to provide customer data to aid foreign intelligence-gathering efforts for a variety of reasons, including prevention of terrorist attacks.

Disclosures by former NSA contractor Edward Snowden and others have exposed the extent of electronic surveillance and led U.S. authorities to modestly scale back some of the programs, in part to protect privacy rights.

Companies including Yahoo have challenged some classified surveillance before the Foreign Intelligence Surveillance Court, a secret tribunal.

Some FISA experts said Yahoo could have tried to fight last year’s demand on at least two grounds: the breadth of the directive and the necessity of writing a special program to search all customers’ emails in transit.

Apple Inc made a similar argument earlier this year when it refused to create a special program to break into an encrypted iPhone used in the 2015 San Bernardino massacre. The FBI dropped the case after it unlocked the phone with the help of a third party, so no precedent was set.

“It is deeply disappointing that Yahoo declined to challenge this sweeping surveillance order, because customers are counting on technology companies to stand up to novel spying demands in court,” Patrick Toomey, an attorney with the American Civil Liberties Union, said in a statement.

Some FISA experts defended Yahoo’s decision to comply, saying nothing prohibited the surveillance court from ordering a search for a specific term instead of a specific account. So-called “upstream” bulk collection from phone carriers based on content was found to be legal, they said, and the same logic could apply to Web companies’ mail.

As tech companies become better at encrypting data, they are likely to face more such requests from spy agencies.

Former NSA General Counsel Stewart Baker said email providers “have the power to encrypt it all, and with that comes added responsibility to do some of the work that had been done by the intelligence agencies.”

SECRET SIPHONING PROGRAM

Mayer and other executives ultimately decided to comply with the directive last year rather than fight it, in part because they thought they would lose, said the people familiar with the matter.

Yahoo in 2007 had fought a FISA demand that it conduct searches on specific email accounts without a court-approved warrant. Details of the case remain sealed, but a partially redacted published opinion showed Yahoo’s challenge was unsuccessful.

Some Yahoo employees were upset about the decision not to contest the more recent edict and thought the company could have prevailed, the sources said.

They were also upset that Mayer and Yahoo General Counsel Ron Bell did not involve the company’s security team in the process, instead asking Yahoo’s email engineers to write a program to siphon off messages containing the character string the spies sought and store them for remote retrieval, according to the sources.

The sources said the program was discovered by Yahoo’s security team in May 2015, within weeks of its installation. The security team initially thought hackers had broken in.

When Stamos found out that Mayer had authorized the program, he resigned as chief information security officer and told his subordinates that he had been left out of a decision that hurt users’ security, the sources said. Due to a programming flaw, he told them hackers could have accessed the stored emails.

Stamos’s announcement in June 2015 that he had joined Facebook did not mention any problems with Yahoo. (http://bit.ly/2dL003k)

In a separate incident, Yahoo last month said “state-sponsored” hackers had gained access to 500 million customer accounts in 2014. The revelations have brought new scrutiny to Yahoo’s security practices as the company tries to complete a deal to sell its core business to Verizon Communications Inc for $4.8 billion.

(Reporting by Joseph Menn; Editing by Jonathan Weber and Tiffany Wu)

Swiss voters likely to back new law on surveillance: survey

Camera looking over Swiss resort

By John Miller

ZURICH (Reuters) – Voters in Switzerland on Sunday are likely to back a law extending the spy service’s authority to monitor internet traffic, deploy drones and hack foreign computer systems to combat militant attacks, a survey shows.

Switzerland’s system of direct democracy gives citizens final say on the law passed in September 2015 which will give new powers to the Federal Intelligence Service, along with rules on when the agency can use them.

In a survey last week by polling group gfs.bern on behalf of Swiss state television, 53 percent were in favor of the law, with 35 percent opposed. Twelve percent were undecided, gfs.bern said.

Though neutral Switzerland has not been targeted by the sort of militant Islamist attacks seen elsewhere in Europe, the Swiss government contends previous intelligence laws are outdated and ill-equipped to tackle threats that have intensified as militants deploy new technology in a tight-knit global network.

“The Federal Intelligence Service will get modern information-gathering tools, including for surveillance of telephone calls or internet activities,” the government said. “These can only be deployed under strict conditions.”

For instance, the agency must get the government’s go-ahead before deploying software to penetrate foreign computer networks. When gathering information, its agents must “employ methods least likely to intrude on the targeted person’s civil rights”, according to the law.

Across Europe, countries including France have expanded spy agency powers, following Islamist attacks that have shifted some governments’ priorities from privacy to security.

Switzerland has prosecuted several people it contends aided Islamic State and sought to strip citizenship from a man suspected of traveling to Syria to fight with the group.

(Reporting by John Miller; Editing by Richard Balmforth)

Document spells out FBI rules to get journalists’ phone records: article

FBI headquarters

By Dustin Volz

WASHINGTON (Reuters) – The Federal Bureau of Investigation is allowed to seek journalists’ phone records with the approval of two government officials through a secretive surveillance process that does not require a warrant, The Intercept website reported on Thursday, citing a classified document.

The document, which The Intercept published without citing sources, was described as a classified appendix of the FBI’s Domestic Investigations and Operations Guide (DIOG) and was dated Oct. 16, 2013. The related document is at http://bit.ly/295HIpY.

Reuters could not verify the authenticity of the document.

FBI spokesman Christopher Allen said in an emailed reply to a Reuters request for comment, “We post a redacted version of the DIOG on our website. I am not in a position to comment or authenticate any other version.” Allen referred to an FBI website regarding the agency’s Domestic Investigations and Operations Guide. http://1.usa.gov/1QleO9n

“Because the DIOG governs sensitive operations and investigations, not all of its contents can be released,” Allen wrote.

“As a result I am not able to comment on how, or whether, the DIOG is updated as laws, Guidelines, or technology change. However, the FBI periodically reviews and updates the DIOG as needed,” he said.

Allen said the FBI’s DIOG remained consistent with guidelines from the U.S. attorney general.

The Intercept is an online publication launched in 2014 by First Look Media, which was created and funded by eBay founder Pierre Omidyar. The editors are Glenn Greenwald, Laura Poitras and Jeremy Scahill, who were all involved in breaking the Edward Snowden story.

The Intercept reported that, according to the document, pursuing a journalist’s call data with a national security letter requires the consent of the FBI’s general counsel and the executive assistant director of its national security branch, in addition to normal chain-of-command approval.

A national security letter is a type of government order for communications data sent to service providers. It is usually issued with a gag order, meaning the target is often unaware that records are being accessed.

There are several proposals in Congress to broaden the scope of national security letters, or NSLs. Privacy advocates, however, have said the authority is used too often, circumvents judicial oversight and lacks adequate transparency safeguards.

The Intercept reported that an added layer of review by the U.S. Justice Department’s assistant attorney general for national security is necessary to use an NSL to seek a journalist’s records if they are being sought “to identify confidential news media sources.”

National security letters have been available as a law enforcement tool since the 1970s. But their frequency and breadth expanded under the USA Patriot Act enacted shortly after the Sept. 11, 2001, attacks on the United States.

The FBI made 48,642 requests for data via NSLs in 2015, according to a Justice Department memo seen by Reuters in May.

Currently, national security letters can only compel sharing of phone billing records, according to a 2008 legal memo written by the U.S. Justice Department. Still, the FBI has used the letters since then to request internet records during national security investigations.

The U.S. Senate last week fell two votes short of advancing legislation that would broaden the type of records the FBI can compel a company to hand over under an NSL to include email metadata and some browsing history.

(Reporting by Dustin Volz; Editing by Dan Grebler, Toni Reinhold)

Senate votes down proposal to expand FBI surveillance powers

FBI at the Pulse

By Dustin Volz

WASHINGTON (Reuters) – The U.S. Senate on Wednesday voted down a Republican-backed proposal to expand the Federal Bureau of Investigation’s secretive surveillance powers after the mass shooting at an Orlando gay nightclub last week.

The measure followed the Senate’s rejection on Monday of four measures that would have restricted gun sales.

During Wednesday’s vote, Senate Republican leader Mitch McConnell switched his vote to ‘no,’ giving himself the opportunity to bring the measure up for consideration again as soon as later this week.

The legislation would broaden the type of telephone and internet records the FBI could request from companies such as the Google unit of Alphabet Inc and Verizon Communications Inc without a warrant. Opponents, including some major technology companies, have said it would threaten civil liberties and do little to improve national security.

The legislation before the Senate on Wednesday, filed as an amendment to a criminal justice funding bill, would widen the FBI’s authority to use so-called National Security Letters, which do not require a warrant and whose very existence is usually a secret.

Such letters can compel a company to hand over a user’s phone billing records. Under the Senate’s change, the FBI would be able to demand electronic communications transaction records such as time stamps of emails and the emails’ senders and recipients, in addition to some information about websites a person visits and social media log-in data.

It would not enable the FBI to use national security letters to obtain the actual content of electronic communications.

The legislation would also make permanent a provision of the USA Patriot Act that lets the intelligence community conduct surveillance on “lone wolf” suspects who do not have confirmed ties to a foreign terrorist group. That provision, which the Justice Department said last year had never been used, expires in December 2019.

The bill had been expected to narrowly pass but it fell two votes short of the required 60.

The future of the Senate proposal in the House of Representatives was also uncertain, given its alliance between libertarian-leaning Republicans and tech-friendly Democrats that has blocked past efforts to expand surveillance.

Privacy groups and civil liberties advocates accused Republicans this week of exploiting the Orlando shooting to build support for unrelated legislation.

Senator Ron Wyden, an Oregon Democrat, criticized Senate Republicans for “pushing fake, knee-jerk solutions that will do nothing to prevent mass shootings or terrorist attacks.”

Though Republicans invoked the Orlando shooting in support of the bill, FBI Director James Comey has said Omar Mateen’s transactional records were fully reviewed by authorities who investigated him twice for possible extremist ties.

Comey said there was “no indication” Mateen belonged to any extremist group and that it was unlikely authorities could have done anything differently to prevent the attack.

(Reporting by Dustin Volz; Editing by Steve Orlofsky and Bernard Orr)

Senate likely to pass FBI spying bill after Orlando shooting

Man paying respect to the dead at Pulse memorial

By Dustin Volz

WASHINGTON (Reuters) – The U.S. Senate on Wednesday is likely to pass a Republican-backed proposal to expand the Federal Bureau of Investigation’s secretive surveillance powers after the mass shooting at an Orlando gay nightclub last week.

The spying bill is the Republican response to the massacre after a push for gun-control measures sponsored by both major U.S. parties failed earlier this week.

The legislation would broaden the type of telephone and internet records the FBI could request from companies like Alphabet Inc and Verizon without a warrant. The proposal met opposition from critics who said it threatened civil liberties and did little to improve national security.

The bill, which the Obama administration has sought for years, “will allow the FBI to collect the dots so they can connect the dots, and that’s been the biggest problem that they’ve had in identifying these homegrown, radicalized terrorists,’” Senator John Cornyn, the chamber’s No. 2 Republican, said Tuesday.

The vote also represents a bi-partisan drift away from policy positions that favored digital privacy, which had taken hold in the three years since former National Security Agency contractor Edward Snowden revealed the breadth of government surveillance programs.

The post-Snowden moves included the most substantial reforms to the U.S. intelligence community since the Sept. 11, 2001, attacks, and a refusal to heed the FBI’s call for laws that would undermine encryption.

It is unclear if the House would pass the Senate proposal, given its alliance between libertarian-leaning Republicans and tech-friendly Democrats that has blocked past efforts to expand surveillance.

The legislation before the Senate Wednesday, filed as an amendment to a criminal justice funding bill, would widen the FBI’s authority to use so-called National Security Letters, which do not require a warrant and whose very existence is usually a secret.

Such letters can currently compel a company to hand over a user’s phone billing records. Under the Senate’s change they could demand electronic communications transaction records such as time stamps of emails and the emails’ senders and recipients, in addition to some information about websites a person visits.

The legislation would also make permanent a provision of the USA Patriot Act that allows the intelligence community to conduct surveillance on “lone wolf” suspects who do not have confirmed ties to a foreign terrorist group. That provision, which the Justice Department said last year had never been used, is currently set to expire in December 2019.

‘KNEE-JERK SOLUTIONS’

Privacy groups and civil liberties advocates accused Republicans this week of exploiting the Orlando shooting to build support for unrelated legislation.

Senator Ron Wyden, an Oregon Democrat, criticized Senate Republicans for “pushing fake, knee-jerk solutions that will do nothing to prevent mass shootings or terrorist attacks.”

Though Republicans invoked the Orlando shooting in support of the bill, FBI Director James Comey has said Mateen’s transactional records were fully reviewed by authorities who investigated him twice for possible extremist ties.

Comey said there was “no indication” Mateen belonged to any extremist group and that it was unlikely authorities could have done anything differently to prevent the attack.

(Reporting by Dustin Volz; Editing by Jonathan Weber and Andrew Hay)