PCLOB Dissenter Raises Questions About NSA’s XKEYSCORE Program

Illustration: Blue Delliquanti and David Axe for The Intercept

Media and civil liberties organizations all had the same reaction to the Privacy and Civil Liberties Oversight Board’s (PCLOB) nearly six years-long, “deep dive” into the legal and policy implications of Executive Order 12333 and NSA’s XKEYSCORE program.
 
Some said that the public version of the report, released in the spring, reads like a Wikipedia article. Others called it a high-school book report. We suggested that next time PCLOB produce a graphic on “How a Bill Is Made.”
 
Now Travis LeBlanc, a Democrat appointed by President Trump to serve on PCLOB, is going public with his dissatisfaction with his colleagues on the PCLOB board. Central to these concerns is XKEYSCORE, an NSA search engine that lets our government extract a person’s social media activity, browsing history and emails, almost at a click, from global datasets.
 
First revealed by Edward Snowden in 2013, XKEYSCORE operates without any Congressional or judicial oversight. Sen. Richard Burr said on the Senate floor that EO 12333 gives the government the power to do whatever it wants, without oversight and “without guardrails.” At least one program in this category, XKEYSCORE, is exempt from oversight by the Foreign Intelligence Surveillance Court or any other body. Here are some choice quotes from LeBlanc’s 10-page memo, which refers to the board members who approved the report in December.
 

• The board “had the opportunity to engage in evidence-based policy-making; however, it concluded a report lacking analysis of the efficacy, costs, and benefits of XKEYSCORE.”

 

• “I voted against the XKEYSCORE report because the former board majority failed to use its investigation into Executive Order (EO) 12333 activities to delve into important technological and modern electronic surveillance issues dominating the public discourse, like the use of algorithmic decision-making.”

 

• The former board majority “failed to adequately investigate or evaluate the National Security Agency’s (NSA) EO 12333 collection activities. Obviously, NSA can process and query communications through XKEYSCORE only once it has access to those communications. While collection and querying are separate activities, they are intertwined and both are worthy of review for separate legal analysis, training, compliance and audit process.”

 
Le Blanc also referred to the longer classified report compiled by PCLOB.
 

• The board majority “has also failed in its mission to inform the public about our work. Our authorization statute directs us to make our reports, including our reports to Congress, ‘available to the public to the greatest extent that is consistent with the protection of classified information and applicable law.’ Here, the former board majority has made no effort to seek declassification of the report, any portions thereof, or any materials that the Board Reviewed. This is inexcusable.”

 
LeBlanc took PCLOB to task for ignoring the most challenging questions in 21st century surveillance policy, including how to govern artificial intelligence and machine learning that guides autonomous collection of massive datasets. With the rise of artificial intelligence, more and more decisions about policy and privacy are being made by machines. Yet PCLOB had nothing to say about that, or about recent Supreme Court rulings on surveillance of geolocation and cellphone data.
 
He raised other issues avoided by PCLOB, such as the “extent to which a machine analysis of U.S. person information triggers Fourth Amendment scrutiny (as opposed to “human-eyes” review).”
 
Most concerning of all, Le Blanc – the only member of the five-member board to vote against approving the report – said the board majority “failed to adequately investigate or evaluate NSA’s collection activities.”
 
The fact remains that years after the Snowden revelations, what might be the world’s most robust surveillance system (at least outside of China) operates without judicial or Congressional oversight, with scant legal analysis.
 
Sen. Ron Wyden told The Washington Post: “I continue to be concerned that Americans still know far too little about the government’s surveillance activities under EO 12333 and how it threatens their privacy.”