ORGcon 2014
Rapid Fire talks
Some notes from the UK’s biggest digital rights conference, this year focussing on government surveillance
Saturday, 15 November, 2014: Several hundred people interested in digital rights congregate at King’s College London’s Waterloo campus, for the Open Rights Group’s 2014 conference. I am proud to have been elected to the board of ORG in 2013, having been a founding member of the Advisory Council, so I figured I should share some of my notes from the conference.
I’ve already written about Cory Doctorow’s opening keynote, but there were many other sessions across the day. To avoid these pieces becoming too unwieldy, I’m covering individual sessions in each piece.
One of the sessions was a series of rapid-fire talks, by four different speakers, followed by a Q&A session. My notes here are of variable quality and I’ve had notes from the speakers at different times, so I’ve split these into separate write-ups with an index.
Electronic surveillance in America
What on Earth is going on over there?
Cathy Gellis, US attorney
Cathy started off with a disclaimer: while she is a lawyer, she’s not our lawyer and she’s not giving us legal advice. And she’s not the EFF, though she is friends with lots of their lawyers too.
She told us that it would be optimistic to explain everything the US government is doing with respect to intercepting people’s electronic communications in 10 minutes — indeed Cathy’s talk was cut short as she ran past her timeslot.
Some (very) historical background
Cathy started with a reminder that the US was founded in reaction to what the 13 colonies considered the tyrannical government of Great Britain. The revolutionary colonies drew up a constitution, but there was concern that their new government could also descend into tyranny, so the Bill of Rights was passed in order to guarantee some specific personal freedoms by limiting the federal government’s powers.
Some of these constitutional amendments bear highlighting:
- The First Amendment guarantees (amongst other things) freedom of religion, speech and association.
- The Fifth Amendment has quite a lot in it, but the key part is that, in the US, no person has to give testimony against themselves. If you’ve watched American TV you’ve seen this principle play out in the Miranda warnings as “you have the right to remain silent…”
- The Sixth Amendment provides the other half to the Miranda warning: “you have the right to an attorney…”
Jumping back, though, the Fourth Amendment is the most germane to our discussion:
The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no warrants shall issue, but upon probable cause, supported by oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.
In Great Britain, the case Entick v Carrington had ruled that the King’s Messengers did not have unlimited powers to enter private property. In Colonial America, however, the Revenue Act 1767 (one of the Townshend Acts, which were particularly controversial in the descent to revolution) empowered officers of HM Customs “to enter and go into any house, warehouse, shop, cellar, or other place, in the British colonies or plantations in America, to search for and seize prohibited and uncustomed goods”.
These “general warrants” meant that royal officials could invade colonists’ privacy to search for any evidence to use against the colonists, in the guise of searching for contraband. As a result, the Virginia Declaration of Rights — the first such declaration in the American colonies — included a prohibition of general warrants in its tenth section.
That said, protection for free speech can be fickle. While over here, during World War I, DORA gave wide-ranging abitrary powers to the government, introduced our alcohol licensing laws and restricted things like flying kites, starting bonfires, buying binoculars and feeding wild animals, the US passed the Espionage Act of 1917, amending it with the Sedition Act the following year. It’s worth noting that the Espionage Act is the statute under which charges were brought against Chelsea Manning and Edward Snowden, as well as people like Pentagon Papers whistleblower Daniel Ellsberg before them.
Then, how can the government can spy?
So the Fourth Amendment says that the government can only invade people’s privacy when they are looking in a specific place for a specific thing and there is probable cause justifying the search. Given that it creates this limitation, how can the government still be surveilling all these communications?
Well, those of us who care about civil liberties believe that it can’t. But even though the US Constitution has all sorts of provisions in it limiting government power, they don’t work automatically — the government can still wield its power and do what it wants to do; it takes a legal challenge to stop it.
The slide at the start of this section lists some of the authority the federal government is using to try to justify all this electronic communications surveillance. While Cathy could have spoken for hours about the minutiæ of each of these programmes, what each was intended for, what privacy protections they are each supposed to contain, whether each of these is consistent with what the NSA is actually doing and the relative merits and demerits of each, they all raise broadly the same constitutional issues, so that it where she continued.
The hard thing with bringing a constitutional challenge against surveillance is that it’s hard to challenge what we don’t know about and information about what the NSA is doing has been slow to come by.
Thanks to Edward Snowden we know a lot more than we did. We also are indebted to other whistleblowers, including Mark Klein, a technician at AT&T who noticed a secret room at its facilities that seemed to exist for no other reason than to divert a copy of all the communications AT&T’s internet customers sent through their systems.
The revelations regarding Room 641A led to a few court cases, including Hepting v AT&T, filed in January 2006 and which sought to challenge AT&T’s diversion of its customers’ Internet traffic to the NSA. This case was dismissed in 2009 after Congress provided retroactive immunity to AT&T in the FISA Amendments Act.
So Hepting is a dead case. But the EFF also filed another lawsuit on behalf of the AT&T customers whose communications have been intercepted: Jewel v NSA, which was filed in September 2008; this case is still going, focussing on how the warrant-less, wholesale diversion of Internet communications violates the Fourth Amendment.
[Please note: A Jewel ruling on 10 February 2015 changed some details here; I’ve added an update from Cathy at the end of this write-up.]
The US government argues that their actions are legal because they don’t look at all the information. The EFF contests, that traffic splitters constitute an unconstitutional seizure, entirely separate from any search (which might also be unconstitutional, of course) when the content is subjected to keyword selection.
To see why the constitutional injury occurs at data acquisition, Cathy spoke about some of the lawsuits challenging metadata collection and why metadata matters — including Kurt Opsahl’s great slide from his presentation to the 30th Chaos Communication Congress: Through a PRISM, Darkly.
The whole point of the Fourth Amendment is that it’s chilling if the government is looking over our shoulders at the private details of our lives. What’s the point of saying that we have privacy in our persons, houses, papers and effects but not in aspects of our communications that give an equally rich picture of our lives?
We know that when people’s privacy is invaded it also violates other constitutional rights. As we saw earlier, the Fifth Amendment says that people cannot be required to give testimony against themselves. But if the government is helping itself to their communications, then the government is learning all sorts of things about people that they reveal about themselves in those communications.
Photograph: PA & AFP, used without permission for illustrative purposes.
Again, the Sixth Amendment provides a right to legal counsel, but for that right to be meaningful we need to know that our conversations with our lawyers are private. But when the government can know about these communications, even just by capturing the metadata evidencing them, that sphere of privacy so important for the lawyer–client relationship to be effective has just evaporated. We even know that this surveillance occurs over here too — in the Belhaj case, Reprieve caused it to be revealed that our intelligence services have routinely been spying even on legally-privileged communications. And The Law Society won’t even make a statement on the matter.
Finally, there’s the First Amendment. It is intended to help ensure that the US has a free and effective press — something a democracy needs in order to be able to hold the government in check. But the press cannot be free and effective if journalists cannot deliver on promises of secrecy with their sources.
We already know that the British media are already spied upon for political convenience, in order to deter whistleblowers — the Met ok’d its own seizure of journalists records in the Plebgate scandal but this occurs in a more-local scale too, with Derby City Council using the RIP Act to self-authorise spying on a journalist during an investigation into wrongdoing within their environmental services department, for example. Indeed in her consultation on RIP powers, Theresa May insists that it’s ok to spy on journalists’ sources.
The First Amendment also guarantees a right of free association. But when the government can know who is talking to whom, that undermines that right, providing another chilling effect. One of the EFF’s cases, First Unitarian Church of Los Angeles v NSA, was specifically brought to challenge the metadata collection on First Amendment grounds because it has that effect: 22 organisations including church groups, gun-ownership advocates and a broad coalition of membership and political advocacy groups filed suit against the NSA for violating their First Amendment right of association by illegally collecting their call records. Some of these other constitutional issues have also been raised in amicus briefs in other cases, including by Cathy.
So what does this all mean for us?
Well the bad news is that all these arguments apply to Americans. It’s not clear which — if any — of the constitutional arguments would apply to non-Americans. Certainly, as Caspar Bowden has been saying to a largely uninterested audience within the EU, the 1990 Supreme Court decision in United States v Verdugo-Urquidez held that Fourth Amendment protections do not apply to searches and seizures by United States agents of property owned by a non-resident alien in a foreign country.
But while we’re screwed, Cathy wants to point out that, the NSA is not supposed to spy on Americans. Yet they obviously are doing just that, while they are busy trying to spy on us non-Americans. “And that absolutely, positively needs to stop”, as Cathy’s notes put it.
- There is no way for the NSA to keep using these programmes to collect all this information without it inherently violating Americans’ constitutional rights.
- So, since they can’t effect these programmes without violating Americans’ rights, they need to stop these programmes.
- And if they have to stop the programmes then they won’t be able to use them to keep spying on non-Americans either.
Further reading
Update
A note from Cathy: Ironically, a ruling in the Jewel case earlier this week has brought to the forefront many of the difficulties people face in trying to vindicate their civil liberties in court, particularly those involving the NSA’s spying. On February 10th the district court issued a frustrating ruling against the plaintiffs, in large part deciding that because it would, as the U.S. Government insisted, undermine national security if the court were to consider the evidence needed to properly evaluate the plaintiffs’ Fourth Amendment claims, it therefore had no choice but to find the plaintiffs’ Fourth Amendment rights had not been violated.
This decision epitomizes the difficulty in bringing these challenges, which Owen summarized above. Courts need evidence to find wrongdoing, but if the government can shield all the evidence of its wrongdoing through a veil of secrecy simply by playing the “National Security!” card, then it can violate all the civil liberties it wants with impunity.
As the EFF noted, this is a troubling ruling (and one that may not itself be consistent with current “state secret” law). In any case, however, it is certainly not the last word on any of the issues raised by this lawsuit or by any of the other lawsuits brought before the courts challenging the NSA’s surveillance programs.
ORGcon 2014 was generously sponsored by F-Secure and Andrews & Arnold Ltd. The Open Rights Group exists to preserve and promote your rights in the digital age; we are funded by hundreds of people like you.
