The American Civil Liberties Union in concerned the CIA is hoovering up mass amounts of data on Americans as it conducts foreign surveillance operations.
For more than two years, Americans have been reeling from revelations about the National Security Agency's mass surveillance programs. Now, newly released documents have raised questions about whether even more of Americans' data could be in the CIA’s hands, too.
Over the past two months, the American Civil Liberties Union has published 68 documents related to the CIA’s activities under Executive Order 12333, which governs foreign intelligence collection. The documents are part of a long-running Freedom of Information Act lawsuit brought by the ACLU and Yale Law School for information about government surveillance under EO 12333.
The widely discussed domestic surveillance programs – those permitted through the Patriot Act and the Foreign Intelligence Surveillance Act Amendments Act – both are operated under the supervision of Congress and the Foreign Intelligence Surveillance Court. EO 12333 is run purely under the auspices of the executive branch.
President Reagan issued the order in 1981 and subsequent presidents have amended it several times since. It came to widespread public attention when former State Department official John Napier Tye penned a Washington Post Op-Ed that accused the NSA of using a loophole in the order to scoop up millions of Americans’ data and search it without a warrant.
The NSA uses authority granted to it under that order to collect millions of Americans’ wholly domestic communications overseas, Tye said.
While many of the NSA's mass surveillance programs are technically "foreign," those programs predictably ingest large amounts of US data. That’s easy in a world where an e-mail between Boston and Atlanta is likely stored at data centers in Europe and Asia by tech companies that span the globe. A provision in the executive order lets the NSA store and search that "incidentally collected" American data.
Get Monitor cybersecurity news and analysis delivered straight to your inbox.
Under 12333, the CIA can also collect intelligence on people and organizations in the US as long as it is "incidentally acquired information." That has the ACLU and other privacy advocates worried.
Indeed, The Wall Street Journal reported in January 2014 that the CIA maintains a database of information on Americans’ international money transfers under Section 215 of the Patriot Act. Three months later, it also revealed that the CIA provided technical support for a US Marshals program that tracked suspects by mounting devices that simulate cellphone towers onto low-flying airplanes – scanning thousands of Americans’ cellphones in the process.
One document – a memorandum of understanding between the CIA and the FBI – contains a section regulating how the CIA can target US persons that is almost entirely redacted – as is a section detailing when and how the FBI can share information with the CIA and all of a one-page document titled "Collection Rules."
What isn’t redacted in the new documents show that EO 12333 bars the CIA from carrying out electronic surveillance within the US. However, the agency can ask the FBI or another intelligence agency to carry out electronic surveillance inside American borders on its behalf. It can also use a "monitoring device" inside the US "under circumstances in which a warrant would not be required for law enforcement purposes."
It’s unclear what a "monitoring device" is and how using it differs from "electronic surveillance" – the definition is redacted.
The newly released documents also suggest that the CIA might not be following its own internal guidelines for handling data on Americans. According to a 2002 report from the CIA Inspector General, agency components aren’t properly applying rules about the retention and dissemination of data about US persons
The CIA did not responded to questions concerning the documents it released to the ACLU.
The independent Privacy and Civil Liberties Oversight Board is currently completing a report about CIA and NSA surveillance involving US persons under EO 12333. It plans to issue the report by the end of the year, according to a statement.