Thread by @LizaGoitein

Anyone who is concerned about government surveillance practices should stop whatever they’re doing and read this statement by Travis LeBlanc, a member of the Privacy and Civil Liberties Oversight Board (@PCLOB_GOV). 1/19 washingtonpost.com/context/statem…

His statement, released with redactions after the gov’t performed a declassification review, is a devastating takedown of the PCLOB's classified 2020 report on “XKEYSCORE,” a tool the NSA uses to process communications obtained without a warrant under Executive Order 12333. 2/19

The NSA doesn’t need a warrant to conduct surveillance under EO 12333 because the data is collected overseas and Americans can't be targeted. But no one denies that EO 12333 surveillance “incidentally” sweeps up Americans’ communications and data, likely in massive amounts. 3/19

The privacy implications for Americans are huge, as EO 12333 surveillance accounts for most of the NSA’s collection activity. LeBlanc’s statement reveals some alarming facts both about EO 12333 surveillance and about the PCLOB’s failures as an oversight body. 4/19

Regarding EO 12333 surveillance: on multiple occasions, NSA analysts failed to comply with the rules that relate to EO 12333 data, and a number of those incidents involved potentially illegal surveillance or improper review of Americans’ communications. 5/19

How widespread is this noncompliance? We don’t know, because the government redacted the numbers that LeBlanc cited. (The size of the black squares suggests that there was a LOT of improper collection and/or processing.) 6/19

The redaction of these numbers is appalling. There is zero chance that releasing the numbers could harm national security. They were redacted to prevent bad PR, in blatant violation of the executive order governing classification. 7/19

LeBlanc’s statement also reveals stark problems with the NSA’s legal analysis of its XKEYSCORE activities. As a threshold matter, the NSA has not complied with the PCLOB’s request to provide all of its legal analyses. 8/19

The NSA released only one legal memo. Prepared in response to PCLOB’s request, it presumably represents NSA’s most careful analysis. Yet as LeBlanc points out, it relies on old case law and entirely omits several more recent (and directly relevant) Supreme Court decisions. 9/29

Consistent with this false “nothing to see here” legal approach, the NSA, according to LeBlanc, requires no training for its analysts on privacy and civil liberties protections that should be observed when using XKEYSCORE. 10/19

Equally alarming, in some respects, is the failure of the PCLOB (in its 2020 incarnation) to fulfill its statutory obligations and provide meaningful oversight. LeBlanc cites numerous examples. Here are some of the lowlights: 11/19

PCLOB decided to restrict its review to how the data in XKEYSCORE is handled—not how it got there. As LeBlanc points out, that’s an artificially narrow lens that skews any analysis of XKEYSCORE’s civil liberties implications. 12/19

PCLOB also did not attempt any analysis of the costs (including the costs to Americans’ privacy) and benefits of XKEYSCORE. It should go without saying, but there can be no meaningful oversight of XKEYSCORE without such an analysis. 13/19

PCLOB did not even *ask* the gov’t to perform a declassification review of its report. As LeBlanc succinctly puts it, that’s “inexcusable.” PCLOB’s authorizing statute requires it to make its reports public to the greatest extent possible. 14/19

When presented with information that NSA analysts had failed to comply with rules for using XKEYSCORE and had possibly violated the law, PCLOB apparently conducted no follow-up on these incidents. 15/19

Finally, the majority of PCLOB declined to adopt two members’ recommendations to NSA to add extremely basic privacy protections for Americans whose “incidentally” collected data is caught up in XKEYSCORE. 16/19

I have two main takeaways. First, Congress needs to stop pretending that EO 12333 affects only foreigners overseas, or that NSA’s internal rules are sufficient to protect Americans. It needs to enact protections for our data, regardless of where or how the NSA scoops it up. 17/19

Second, there are currently two vacant seats on PCLOB, including the chair position. President Biden should move quickly to fill them. And he should nominate civil liberties experts whose backgrounds show that they will bring rigor to their oversight responsibilities. 18/19

Travis LeBlanc’s statement is truly a model for the questions an oversight body should ask and the approach it should take. President Biden should nominate members in LeBlanc’s mold. In the meantime, we all owe him thanks for his exemplary service. 19/19