The House Intelligence Committee recently held an open hearing on commercial cyber surveillance, also known as “mercenary spyware.”
 
The hearing focused on new threats posed specifically by privately made, foreign-developed spyware that are bringing capabilities long associated with top-tier nation states to smaller countries and the private sector. PPSA has previously reported on one such foreign spyware, in particular the spreading “zero-click” Israeli-developed Pegasus.
 
Pegasus can transmit itself seamlessly into a smartphone without a single click or action from the victim. From there, it can watch you through your camera, listen to you through your microphone, copy your messages, record your calls, extract all your images, and follow your movements. In just a few years, Pegasus has been acquired by dozens of countries and entities, from Saudi Arabia to Mexican cartels, and has already been used to deadly effect against dissidents and journalists. It represents the most sophisticated and widely available form of spyware yet developed.
 
Among the hearing’s testimonials was John Scott-Railton, a senior researcher at The Citizen Lab of the University of Toronto's Munk School of Global Affairs & Public Policy. His testimony provided a stark picture to Congress:

• Mercenary spyware is a growing sector doing a robust global business.
  
  
• As a result, the number of states capable of sophisticated cyber warfare has expanded into the dozens.
  ​
• The United States is not immune from this threat. Dozens of U.S. officials have been compromised. Mercenary spyware has also been found in critical offices of major allies, including the office of the UK Prime Minister.

 
Railton testified (see the 18:50 mark), “Your phone can be on your bedside table at two in the morning. One minute, your phone is clean. The next minute, the data is silently streaming to an adversary a continent away. You see nothing.” He added it was “capabilities available only to a handful of nation-states … It is too late,” he said, “to put the tech back into the bottle, and so we must take strong action now…”
 
Another witness was Carine Kanimba, an American citizen born in Rwanda. Her testimony (29:05) details the story of her stepfather, Paul Rusesabagina, portrayed by Don Cheadle in Hotel Rwanda. Rusesabagina was the manager of the Hôtel des Mille Collines in Kigali during the Rwandan genocide. He used the hotel to save more than a thousand refugees. Later, he and his family fled to the United States. Rusesabagina became a public speaker and was critical of the human rights violations of the Rwandan government and of the Rwandan President Paul Kagame. In August 2020, Kanimba’s stepfather was surveilled in the United States by the Rwandan government and lured from the family home in Texas. Rusesabagina was kidnapped in Dubai, transferred to Kigali, tortured, tried, and sentenced to 25 years in prison. Kanimba became a vocal and effective activist about the abduction of her stepfather.
 
In February 2021, Carine Kanimba was notified (33:11) by forensics experts that her smartphone had been infected by Pegasus.
 
“I was mortified, and I am terrified,” she said. The forensics report showed “the spyware was triggered as I walked in with my mom into a meeting with the Belgian Minister of Foreign Affairs. It was active during the calls with the U.S. Presidential Envoy for Hostage Affairs team and the U.S. State department, as well as U.S. human rights groups.”
 
Not only was Kanimba’s phone infected, but so was the phone of her cousin with whom she lives.
 
“I am frightened by what the Rwandan government will do to me and my family next,” she said. “It keeps me awake that they knew everything I was doing. Where I was, who I was speaking with, my private thoughts and actions, at any moment they wanted. Unless there are consequences for countries and their enablers which abuse this technology, none of us are safe.”
 
The threat by mercenary spyware companies and malware is too serious to ignore.
 
“It has taken us too long to have this conversation,” concluded Railton. His testimony included several suggestions for Congress (22:15):

• Add all unaccountable players within the spyware industry to a U.S. Department of Commerce blacklist.

 

• Expand the ability to hold problem companies accountable and direct the intelligence community to counter and disrupt them if necessary.

 

• Finally, the US should apply diplomatic pressure to countries that foster these companies and enable spyware operations.

Video starts at Sen. Mike Lee's questioning of FBI Director Wray (1:02:00 mark).

​At a Senate Judiciary Committee hearing yesterday, Sen. Mike Lee (R-UT) neatly summarized the FBI’s spotty observance of Section 702 of the Foreign Intelligence Surveillance Act (FISA), up for reauthorization next year, in his questioning of FBI Director Christopher Wray. Sen. Lee’s questions follow up on the revelation that the FBI used U.S. person information in FISA queries some 3.4 million times in a recent one-year period.
 
Sen. Lee said:
 
“As you know, Director Wray, Section 702 authorizes the collection of electronic communications. Not just the metadata but the content of the communications themselves, including communications of non-U.S. persons outside the United States. But, as you know, this inevitably leads to the incidental collection of communications that involve or include U.S. persons, including U.S. citizens.”
 
The Utah senator reminded Director Wray that the 2018 reauthorization of Section 702 required the FBI to obtain an order from the Foreign Intelligence Surveillance Court to authorize querying the database for communications involving U.S. persons and citizens in criminal investigations not involving national security. Why then, Sen. Lee asked, did a recently released transparency report estimate that the FBI did not obtain a single order under section 702 from the Foreign Intelligence Surveillance Court in 2021?
 
The FBI itself, after all, identified at least four instances in which the electronic communications of U.S. persons “were unlawfully searched without the required order from the Court?” Sen. Lee asked: “Can you tell me how you found those four instances and how you can be certain that there are not more than four instances in which someone did a backdoor search of U.S. persons’ communications?”
 
The FBI Director said he could not recall the “various oversight mechanisms we have.” He noted that the FBI set up a new office of internal audit focused on FISA compliance.
 
Sen. Mike Lee replied that he understood these authorities are needed to protect the American people.
 
“But when it comes to American citizens, they have a reasonable expectation of privacy. When you have that much ability to collect that much information, record that many conversations of unsuspecting, law-abiding American citizens, there really do have to be procedures in place to make sure that there is probable cause and a probable cause-based warrant in order to search those, because that really is just a backdoor search and a potential end run around the Fourth Amendment.”
 
Senator Lee expressed skepticism that the four known surveillances of Americans did not require a FISC order. And said he would hold Director Wray to his promise to provide more information.

If you are ever a witness before a Congressional committee, the trick to surviving a contentious hearing is to run out the clock with smooth talking. Each committee member only has five minutes to ask questions. An expert witness will often respond to a precise and penetrating question by taking up minutes with a Wikipedia-level recitation of a law or process, wrapped within pleasing-sounding banalities and blandishments.
 
Even within time constrictions in facing a polished witness, Rep. Zoe Lofgren (D-CA), long-time watcher of the watchers, managed to challenge the Department of Justice on Section 702 of the Foreign Intelligence Surveillance Act (FISA) in the recent House Judiciary Committee hearing. Rep. Lofgren refused to be brushed off (29 minutes mark) by the Department of Justice’s top national security official, Assistant Attorney General Matthew G. Olsen, concerning the FBI’s use of Section 702 information – collected to catch foreign terrorists and spies – against Americans.
 
Rep. Lofgren began by noting that FISA Court Judge James E. Boasberg had found that the FBI improperly searched Americans’ personal information collected without a warrant. Some of these were run-of-the-mill criminal investigations involving healthcare fraud, bribery, and other purported crimes unrelated to national security.
 
Rep. Lofgren added that in Dec. 2020 to Nov. 2021, the FBI searched the personal identifiers of known Americans in 702 data some 3.4 million times. This was triple the number from the previous year. As PPSA has reported, that amounts to more than 9,300 searches by the personal identifiers of Americans every day.
 
Rep. Lofgren noted that when Olsen went before the Senate Intelligence Committee for his confirmation, he pledged that “restoring and maintaining trust in the FISA process was a critical priority.” She asked him what he has done since to prevent warrantless, improper, backdoor searches of Americans’ data conducted under Section 702?
 
After taking time to give a topline description of the law, Olsen admitted that the “issues you cite are ones of concern” and promised to improve FBI compliance with training and by upgrading FBI computer systems. “We are looking forward to improving the compliance record of the Department of Justice and the FBI in regard to Section 702,” Olsen said, “and I can assure you it is a priority.”
 
Rep. Lofgren had a sharp reply.
 
“We have had reassurances over the years and yet the performance continues to be poor, and it has been poor under both Republican and Democratic Administrations,” she said. “We have considered imposing a warrant requirement for queries of known Americans … probably a necessity unless we can get some further, definitive control of the warrantless search of Americans in the 702 database.”
 
Rep. Lofgren added that using Section 702 to conduct warrantless searches on Americans is “improper and yet it continues.” Olsen replied that Section 702 permits the creation of a database of non-U.S. persons overseas, and that when the FBI searches, it does so to simply find “connections,” not to target Americans.
 
Rep. Lofgren’s retort was sharp: “That is contrary to the report that we got from ODNI and from the FISA Court.”
 
As Section 702 faces reauthorization next year, civil libertarians should continue to press Rep. Lofgren’s questions and urge Congress to consider an explicit warrant requirement when queries target Americans.

​In response to a Freedom of Information Act request from PPSA about classification procedures, the State Department reported that based on a representative sampling, only a tiny number of documents were improperly or overly classified. This seemed to us a mind-boggling response given the mountains of documents stamped classified every day at Foggy Bottom. Now, PPSA has obtained data from across the government to show the State Department’s response was misleading.
 
At a 2015 open house presentation by the National Archives and Records Administration, a graphic produced by the Information Security Oversight Office showed that nearly 100 million items are classified each year by the federal government. An Obama-era law and executive order provide the means for people within the agencies to challenge a classification decision without fear of retribution.
 
So how is that working out?
 
Of these 100 million decisions, only a minuscule fraction is challenged — in one year, much less than 1% of 1%. The graph demonstrates the extent to which the government continues to hide much of its operations from the American people.

Being called out by the People’s Republic of China for illicit surveillance is a bit like being accused of swindling by Charles Ponzi.
 
Chinese state media seized on a recent report based on a two-year exhaustive study by the Center on Privacy and Technology at Georgetown Law that revealed the U.S. Immigration and Customs Enforcement (ICE) is the latest federal agency to buy vast quantities of Americans’ personal data from utilities and state motor vehicle departments.
 
As PPSA has previously reported, the Center on Privacy and Technology found that ICE has used facial recognition technology to search the driver’s license photographs of 1 in 3 adults in the United States. ICE has access to the driver’s license data of 3 in 4 American adults and tracks the movements of cars in cities that are home to nearly 3 in 4 adults. And when adults in our country connect to gas, electricity, phone or internet service, ICE will automatically pick up the new addresses of 3 out of 4 Americans.
 
“The U.S. is the No. 1 empire in hacking, eavesdropping and stealing secrets,” said Zhao Lijian, spokesman for China’s Ministry of Foreign Affairs, on Monday. “This is an irrefutable fact and a brilliant satire of the U.S. boasting about human rights, the rule of law and rules.”
 
That is rich. China has installed a pervasive national system that uses artificial intelligence to weave together cameras in public and private spaces, facial recognition, sound recorders with voice recognition, and Orwellian “social credit scores” to create what scholars call the Chinese Panopticon.
 
It is galling to be attacked for abuses by a regime that keeps its citizens under such pervasive surveillance. But the hypocrisy of China’s bee sting does not quite pull out the stinger.
 
In the United States, at least 16 U.S. federal agencies and 75 local and state agencies employ “stingray” devices that mimic cell towers to compromise the information in cellphones within wide areas. As many as 3,000 local and state agencies rely on facial recognition technology. Federal agencies routinely sidestep the Fourth Amendment requirement to obtain a probable cause warrant to scan our personal information by purchasing it from shadowy, private data brokers.
 
And when all else fails, U.S. intelligence agencies claim to be able to perform any surveillance they deem necessary for national security not under any law, but under a presidential directive, Executive Order 12333.
 
Much of this information is used by the government to catch illegal aliens, predatory criminals, terrorists, and spies (most of them, by the way, from China). None of it will be used to put ethnic minorities in concentration camps, imprison men and women of conscience for challenging the regime’s lack of democracy, or grade us on our willingness to scroll through the Dear Leader’s turgid thoughts.
 
But we should take stock – the state of surveillance in the United States is a lot more like China’s than we’d like to admit. Absent reasonable legal reforms and guidelines, we could well be on our way to a Chinese Panopticon-light.

New Jersey law enforcement has reportedly on at least one occasion accessed a bank of blood samples drawn from newborns to conduct DNA tracing to charge a father with a crime. The law that governs the program was designed to test infants for 60 health disorders within 48 hours of birth, not to serve law enforcement.
 
“Parents, when this happens, trust the state to protect this sensitive information and not make it easily available to law enforcement agencies or other agencies,” Jeanne LoCicero, legal director of the American Civil Liberties Union of New Jersey, told The New Jersey Monitor.
 
These dried blood tests can be kept for up to 23 years. In the one case that has been publicly revealed, the blood samples were nine years old. An Open Public Records Acts request filed by the Office of the Public Defender and The New Jersey Monitor sought a list of subpoenas on the state-run lab. That request was denied in court and the state has declined to release information on the numbers of subpoenas served against the state’s Newborn Screening Laboratory.
 
It is easy to see why these blood samples represent a tempting target for law enforcement. The DNA trace in the nine-year-old case enabled a probable cause warrant for the father’s DNA, who was later charged with sexual assault.
 
This story illustrates the tension in American surveillance. It is a certainty that a large enough body of bulk information – whether DNA or digital – will reveal suspects of dastardly crimes. But it can only do so at the cost of everyone else’s privacy and Fourth Amendment rights. The future privacy of these babies is also being compromised. The state database will give the government knowledge of these babies’ congenital diseases and conditions, as well as a storehouse of their own profiles as they grow up.
 
Similar issues can be found in most every state. The Legal Aid Society recently filed a federal lawsuit against the New York Police Department for lifting drinks and cigarettes used by suspects to add their DNA profile to an immense and secret DNA database.
 
The unwillingness of the state to provide further information on its uses of newborn screening data is reason enough for legislators in Trenton to use their authority to bring the scale and scope of this program to light.

​Vice Motherboard, through a Freedom of Information Act request, obtained a spreadsheet from the FBI that shows that the agency over a recent six-month period lost more than 200 desktop computers.
 
How does one lose a desktop?
 
The reasons listed in the spreadsheet for the FBI’s losses of computers and other items include “inadequate security,” “inattention to details,” “gross negligence” and “willful intent.”
 
Vice notes that “a law enforcement computer going missing can present a cybersecurity risk in that it may contain sensitive information such as documents or files, or it may include passwords or other authentication mechanisms for accessing law enforcement systems.”
 
The FBI responds that in the chaotic post-COVID-19 inventory management, it marked items sent to storage or for disposal as “lost.” Let us hope that is true for all the missing computers. Remember, the federal government has been buying up Americans’ personal digital information from private data brokers. A security breach for the FBI is a matter of national security and your personal security.

​The U.S. Supreme Court held in Riley v. California in 2014 that cellphones are not like other objects. The texts, emails, instant messages, online searches, and apps inside a phone can reveal just about everything about us, what the Court called “the privacies of life.”
 
The Court ruled that the police need to obtain a probable cause warrant to investigate a suspect’s cellphone. But what are the rules if the cellphone is abandoned or thrown away? Courts are currently applying the law governing ordinary abandoned objects to cellphones.
 
This question arises from the case of a Virginia man, Antonio Daren Futrell, who realized that he had left his cellphone inside a restaurant. He tried to retrieve it, but it was past closing time, and the employees wouldn’t let him back in. There was an altercation and, long story short, Futrell was later convicted of firing a gun at a security guard before fleeing the scene. When the police found Futrell’s phone inside the restaurant – which was now considered abandoned after Futrell fled – they were able to access it because Futrell had not protected it with a passcode.
 
Now lawyers for Futrell have filed a petition asking the U.S. Supreme Court to clarify the question of whether a police officer who finds a discarded phone has free access to anything inside it.
 
“If you throw your phone away or discard it or trade it in, police can do whatever they want,” said Brandon Boxler, one of Futrell’s attorneys, told The Daily Press of Newport News. “They can access your emails, your bank records, your phone calls, text messages, photos – everything is fair game that’s on the phone.”
 
Futrell’s petition challenges Hester v. United States, a 1924 case in which the Supreme Court allowed the warrantless search of a moonshine bottle a suspect threw away. The Court later applied that doctrine to objects as disparate as a pencil and drug paraphernalia thrown in the trash.
 
“Cellphones are different,” Boxler wrote in the Daily Press in 2021. “They have massive storage capabilities. A search of a cellphone involves a much deeper invasion of privacy. The depth and breadth of personal and private information they contain was unimaginable in 1924.
 
“We use cellphones as cameras, personal assistants, navigation devices, web browsers, and everything in between,” Boxler wrote. “And with advances in cloud computing, cellphones can access years – if not decades – of bank records, medical records, emails, location data, and other sensitive information. Can anyone really ‘abandon’ this information, even if they discard a cellphone?”
 
While the chances the Supreme Court will take up this petition are remote, Futrell’s attorneys were heartened last Thursday when the Court asked the Virginia Attorney General’s office to respond to the petition.

​Last week, the media was astir that videos from Amazon’s Ring doorbell cameras were shared with police without their owners’ permission. The company insists that it did so in eleven extreme cases this year in response to situations in which life and limb endangered.
 
This may fly in the face of company policy stating that police can’t view recordings unless the footage is posted publicly or intentionally shared. But the low number of such incidents, revealed in a letter by an Amazon VP of public policy to Sen. Edward Markey (D-MA), suggests the company is being upfront. To be fair, the media would be ablaze if Amazon had stood by and allowed someone to be beaten to death.
 
The biggest issue with Amazon Ring is not that it ignores the need to seek the permission of its customers to share videos with police. The bigger problem is that this network of more than three million online cameras across the United States encourages its customers to voluntarily provide for the surveillance of entire neighborhoods. One message from the company to its customers reads: “If you would like to take direct action to make your neighborhood safer, this is a great opportunity.”
 
The company has agreements with 2,161 law enforcement agencies to access an app called Neighbors, a social media platform in which owners can post Ring camera footage and leave comments. The transformation of home security into a venue for social media encourages users to post videos online – all of it available to law enforcement “partners.”
 
Even more worrying, Amazon’s agreements with law enforcement allow officers to solicit Ring doorbell footage from customers for entire neighborhoods. Such video and audio surveillance may be fine for the customer, but what about passersby? And while the number of incidents in which footage was shared without permission currently remains low, what about the capacity for future abuse by Amazon and law enforcement?
 
It is concerning that all it would take for Ring cameras to become a form of constant mass surveillance would be a change of one company’s policy.

​The Project for Privacy and Surveillance Accountability today filed a Freedom of Information Act (FOIA) lawsuit against the Office of the Director of National Intelligence (ODNI) over the refusal of the government to turn over records concerning U.S. intelligence community purchases of the private digital data of American citizens.
 
The government’s stonewalling continues well past its failure to meet any of the deadlines required by the FOIA statute. It also flies in the face of a pledge made by Director of National Intelligence Avril Haines (1:17:05 mark) in her Senate confirmation hearings on Jan. 19, 2021. When Sen. Ron Wyden, (D-OR) asked about informing the American people about purchases of their data, Haines responded:
 
“I would seek to try to publicize, essentially, a framework that helps people understand the circumstances under which we do that and the legal basis that we do that under.”
 
Haines further promised to provide transparency “so people have an understanding of the guidelines under which the intelligence community operates.”
 
In response, PPSA requested “all agency records created, altered, sent, or received in preparation for any public disclosure, as contemplated by Director Haines,” including:

• The intelligence community’s purchases of Americans’ private data

 

• The legal basis for doing so

 

• The guidelines under which the intelligence community operates in making those purchases.

 
The government acknowledged receiving PPSA’s initial FOIA request on June 2, 2021. PPSA inquired about the lack of a substantive response more than one year later. On June 23, 2022, ODNI responded: “we cannot speculat[e] on a specific response date.”

More than thirty business days later, after the ODNI failed to indicate whether it will fully comply with the FOIA request, PPSA decided to file suit.
 
“This is a golden opportunity for Director Haines to demonstrate that the intelligence community will live up to her promise to provide at least some transparency,” said Gene Schaerr, PPSA general counsel. “As Avril Haines herself stated, the American people deserve to know the circumstances in which the intelligence community purchases our personal data and the legal basis for doing so.
 
“Director Haines promises to ‘publicize’ that legal basis. I hope she does, instead of allowing her office to continue to stonewall.”