Thread by @normative

So, this is all maddeningly vague, but a couple of observations based on the very limited information available…. wyden.senate.gov/news/press-rel…

The bulk program referenced here was the subject of one of two PCLOB “deep dives” into EO 12333 programs, summarized (barely) in what can charitably be described as a rather disappointing public report at the culmination of a six-year investigation. documents.pclob.gov/prod/Documents…

The first “deep dive” concerned a financial records collection program, and the report notes CIA had implemented or was implementing all PCLOB’s recommendations. The second “deep dive” ended with a set of staff-produced recommendations in 2020, but nothing on CIA’s response.

Whatever the records in question are, “the system” is apparently able to make determinations about whether queries likely concern US persons, so it includes data of a type that can be at least roughly correlated with nationality or place of residence.

The Wyden/Heinrich letter says the bulk collection by CIA involves information the general public would be prone to believe was governed by legislative reforms to FISA. Presumably that means USA FREEDOM, which was a response to NSA’s bulk telephony metadata collection.

Reading between the lines a bit, the argument that the public would think this collection is covered by the reformed FISA framework suggests the collection probably involves telephony or telecommunications data.

Government acquisition of such data is generally governed by the Electronic Communications Privacy Act of 1986 (ECPA), but there are two big honking loopholes in that law of potential relevance here.

ECPA prohibits disclosure of telecommunications CONTENT with relatively narrow exceptions, but only bars disclosure of metadata by telecom providers to a “government entity.” So there’s an easy workaround: Disclose to a private entity that is not regulated by ECPA…

As long as the new custodian of the data is not a service provider to the public, they’re not covered by ECPA rules governing disclosure directly from providers to the government.

The other big loophole is the carveout found in §18 USC 2511(f)(2), which essentially says ECPA’s prohibitions don’t apply to the acquisition of foreign intelligence as long as it’s by means other than “electronic surveillance” as defined by FISA. law.cornell.edu/uscode/text/18…

Exactly what counts as “electronic surveillance” under FISA is fiendishly complicated, but the TL;DR version is that involves acquisition via a surveillance “device” and wouldn’t normally include a company producing its own records.

I wrote a little about the ECPA loophole waaaaaay back in 2013. justsecurity.org/1567/nsa-bulk-…