Yahoo email scan shows U.S. spy push to recast constitutional privacy

(Reuters) — Yahoo Inc’s secret scanning of customer emails at the behest of a U.S. spy agency is part of a growing push by officials to loosen constitutional protections Americans have against arbitrary governmental searches, according to legal documents and people briefed on closed court hearings.

The order on Yahoo from the secret Foreign Intelligence Surveillance Court (FISC) last year resulted from the government’s drive to change decades of interpretation of the U.S. Constitution’s Fourth Amendment right of people to be secure against “unreasonable searches and seizures,” intelligence officials and others familiar with the strategy told Reuters.

[aditude-amp id="flyingcarpet" targeting='{"env":"staging","page_type":"article","post_id":2136632,"post_type":"story","post_chan":"none","tags":null,"ai":false,"category":"none","all_categories":"bots,business,mobile,security,","session":"A"}']

The unifying idea, they said, is to move the focus of U.S. courts away from what makes something a distinct search and toward what is “reasonable” overall.

The basis of the argument for change is that people are making much more digital data available about themselves to businesses, and that data can contain clues that would lead to authorities disrupting attacks in the United States or on U.S. interests abroad.

While it might technically count as a search if an automated program trawls through all the data, the thinking goes, there is no unreasonable harm unless a human being looks at the result of that search and orders more intrusive measures or an arrest, which even then could be reasonable.

Civil liberties groups and some other legal experts said the attempt to expand the ability of law enforcement agencies and intelligence services to sift through vast amounts of online data, in some cases without a court order, was in conflict with the Fourth Amendment because many innocent messages are included in the initial sweep.

“A lot of it is unrecognizable from a Fourth Amendment perspective,” said Orin Kerr, a former federal prosecutor and George Washington University Law School expert on surveillance. “It’s not where the traditional Fourth Amendment law is.”

But the general counsel of the Office of the Director of National Intelligence (ODNI), Robert Litt, said in an interview with Reuters on Tuesday that the legal interpretation needed to be adjusted because of technological changes.

“Computerized scanning of communications in the same way that your email service provider scans looking for viruses – that should not be considered a search requiring a warrant for Fourth Amendment purposes,” said Litt. He said he is leaving his post on Dec. 31 as the end of President Barack Obama’s administration nears.

Digital signature

Reuters was unable to determine what data, if any, was handed over by Yahoo after its live email search. The search was first reported by Reuters on Oct. 4. [nL2N1CA1OW] Yahoo and the National Security Agency (NSA) declined to explain the basis for the order.

[aditude-amp id="medium1" targeting='{"env":"staging","page_type":"article","post_id":2136632,"post_type":"story","post_chan":"none","tags":null,"ai":false,"category":"none","all_categories":"bots,business,mobile,security,","session":"A"}']

The surveillance court, whose members are appointed by U.S. Supreme Court Chief Justice John Roberts, oversees and approves the domestic pursuit of intelligence about foreign powers. While details of the Yahoo search are classified, people familiar with the matter have told Reuters it was aimed at isolating a digital signature for a single person or small team working for a foreign government frequently at odds with America.

The ODNI is expected to disclose as soon as next month an estimated number of Americans whose electronic communications have been caught up in online surveillance programs intended for foreigners, U.S. lawmakers said.

The ODNI’s expected disclosure is unlikely to cover such orders as the one to Yahoo but would encompass those under a different surveillance authority called section 702. That section allows the operation of two internet search programs, Prism and “upstream” collection, that were revealed by former NSA contractor Edward Snowden more than three years ago. Prism gathers the messaging data of targets from Alphabet Inc’s Google, Facebook, Microsoft, Apple among others.

Upstream surveillance allows the NSA to copy web traffic to search data for certain terms called “selectors,” such as email addresses, that are contained in the body of messages. ODNI’s Litt said ordinary words are not used as selectors.

[aditude-amp id="medium2" targeting='{"env":"staging","page_type":"article","post_id":2136632,"post_type":"story","post_chan":"none","tags":null,"ai":false,"category":"none","all_categories":"bots,business,mobile,security,","session":"A"}']

The Fourth Amendment applies to the search and seizure of electronic devices as much as ordinary papers. Wiretaps and other surveillance in the internet age are now subject to litigation across the United States. But in the FISC, with rare exceptions, the judges hear only from the executive branch.

Their rulings have been appealed only three times, each time going to a review board. Only the government is permitted to appeal from there, and so far it has never felt the need.

Public legal challenges

The FISC’s reasoning, though, is heading into public courts. The 9th U.S. Circuit Court of Appeals on Dec. 5 cited FISC precedents in rejecting an appeal of an Oregon man who was convicted of plotting to bomb a Christmas tree lighting ceremony after his emails were collected in another investigation.

Groups such as the American Civil Liberties Union and the Electronic Frontier Foundation are fighting the expansion of legalized surveillance in Congress and in courts.

[aditude-amp id="medium3" targeting='{"env":"staging","page_type":"article","post_id":2136632,"post_type":"story","post_chan":"none","tags":null,"ai":false,"category":"none","all_categories":"bots,business,mobile,security,","session":"A"}']

On Dec. 8, the ACLU argued in the 4th U.S. Circuit Court of Appeals that a lawsuit by Wikipedia’s parent group against the NSA should not have been dismissed by a lower court, which ruled that the nonprofit could not show it had been snooped on and that the government could keep details of the program secret.

The concerns of civil libertarians and others have been heightened by President-elect Donald Trump’s nomination of conservative Representative Mike Pompeo of Kansas to be director of the CIA. Pompeo, writing in the Wall Street Journal in January, advocated expanding bulk collection of telephone calling records in pursuit of Islamic State and its sympathizers who could plan attacks on Americans. Pompeo said the records could be combined with “publicly available financial and lifestyle information into a comprehensive, searchable database.”

Yahoo’s search went far beyond what would be required to monitor a single email account. The company agreed to create and then conceal a special program on its email servers that would check all correspondence for a specific string of bits.

Trawling for selectors is known as “about” searching, when content is collected because it is about something of interest rather than because it was sent or received by an established target. It is frequently used by the NSA in its bulk upstream collection of international telecom traffic.

[aditude-amp id="medium4" targeting='{"env":"staging","page_type":"article","post_id":2136632,"post_type":"story","post_chan":"none","tags":null,"ai":false,"category":"none","all_categories":"bots,business,mobile,security,","session":"A"}']

The Privacy and Civil Liberties Oversight Board, an appointed panel established by Congress as part of its post-9/11 expansion of intelligence authority, reported in 2014 that “about” searches “push the program close to the line of constitutional reasonableness.”

A glimpse of the new legal arguments came in a FISC proceeding last year held to review NSA and FBI annual surveillance targets and four sets of procedures for limiting the spread of information about Americans.

Judge Thomas Hogan appointed Amy Jeffress, an attorney at Arnold and Porter and a former national security prosecutor, to weigh in, the first time that court had asked an outside privacy expert for advice before making a decision.

Jeffress argued each search aimed at an American should be tested against the Fourth Amendment, while prosecutors said that only overall searching practice had to be evaluated for “reasonableness.” Hogan agreed with the government, ruling that even though the Fourth Amendment was all but waived in the initial data gathering because foreigners were the targets, the voluminous data incidentally gathered on Americans could also be used to investigate drug deals or robberies.

[aditude-amp id="medium5" targeting='{"env":"staging","page_type":"article","post_id":2136632,"post_type":"story","post_chan":"none","tags":null,"ai":false,"category":"none","all_categories":"bots,business,mobile,security,","session":"A"}']

“While they are targeting foreign intelligence information, they are collecting broader information, and there needs to be strong protections for how that information is used apart from national security,” Jeffress told Reuters.

ODNI’s Litt wrote in a February Yale Law Review article that the new approach was appropriate, in part because so much personal data is willingly shared by consumers with technology companies. Litt advocated for courts to evaluate “reasonableness” by looking at the entirety of the government’s activity, including the degree of transparency.

Litt told Reuters that he did not mean, however, that the same techniques in “about” searches should be pushed toward the more targeted searches at email providers such as Yahoo.

Although speaking generally, he said: “My own personal approach to this is you should trade off broader collection authority for stricter use authority,” so that more is taken in but less is acted upon.

This position strikes some academics and participants in the process as a remarkable departure from what the highest legal authority in the land was thinking just two years ago.

That was when the Supreme Court’s Roberts wrote for a majority in declaring that mobile phones usually could not be searched without warrants.

After prosecutors said they had protocols in place to protect phone privacy, Roberts wrote: “Probably a good idea, but the Founders did not fight a revolution to gain the right to government agency protocols.”

With little evidence that the Supreme Court agrees with the surveillance court, it remains possible it would reverse the trend. But a case would first need to make its way up there.

(Reporting by Joseph Menn in San Francisco; additional reporting by Dustin Volz, Mark Hosenball and John Walcott in Washington; Editing by Jonathan Weber and Grant McCool)