Is Teamwork the Answer to Data Security?

Increasingly, alliances are viewed as an important way to improve data security.  The Washington Post reports that the National Security Agency is now working with Internet service providers to thwart cyberattacks against defense firms by foreign adversaries.  We have previously noted two other initiatives:   the Advanced Cyber Security Center (to which Foley Hoag serves as legal counsel).and InfraGuard, a Federal Bureau of Investigation program.  One of the oldest and best examples of successful collaboration is PCI, the credit card industry's security program.

Incident of the Week: NSA Officer Indicted For Emailing Classified Documents to Reporter

On Wednesday, a federal grand jury in Maryland indicted Thomas A. Drake, a former employee of the National Security Agency (NSA), on charges that he emailed classified NSA documents and information to Siobhan Gorman, then a reporter for the Baltimore Sun.  Drake worked for the NSA first as a contractor and then as a high level employee in the NSA's Signals Intelligence Directorate between 1991 and 2008, when he resigned following the suspension of his security clearance. 

The 14-page indictment (.pdf) alleges that in 2005 Drake received Gorman's contact information from "Person A," an unnamed congressional staffer that had a "close, emotional friendship" with Drake.  Drake allegedly obtained an anonymous email account with Hushmail and contacted Gorman to "volunteer[ ] to disclose information about NSA." 

After Gorman obtained her own Hushmail account, Gorman allegedly emailed her hundreds of times with information about the NSA and its Signals Intelligence (SIGINT) activities.  Drake is also accused of smuggling classified documents out of the NSA, including his own handwritten notes, and doctoring documents so he could provide them to Gorman without the markings that identified the information as classified.  Based on these emails, Gorman published a series of articles between 2006 and 2007 that federal prosecutors claim contain classified information.  Drake is charged with violations of the Espionage Act, as well as lying to FBI agents, destroying evidence and obstructing the investigation of his activities. 

In its press release on Thursday, the U.S. Department of Justice stated that:

As alleged, this defendant used a secret, non-government e-mail account to transmit classified and unclassified information that he was not authorized to possess or disclose. As if those allegations are not serious enough, he also allegedly later shredded documents and lied about his conduct to federal agents in order to obstruct their investigation

The federal public defender representing Drake, James Wyda, told the New York Times that “Mr. Drake loves his country.  We look forward to addressing these matters in a public courtroom.”

Hushmail is an encrypted email service that allows users a certain level of anonymity.  Hushmail's website states:

Hushmail can protect you against eavesdropping, government surveillance, unauthorized content analysis, identity theft and email forgery. But using Hushmail does not put you above the law.

and

We are committed to the privacy of our users, and will absolutely not release user data without an order that is legally enforceable under the laws of British Columbia, Canada, which is the jurisdiction where our servers are located.

From the face of the indictment in the Drake case, it appears that the FBI and federal prosecutors managed to obtain a court order in Canada to obtain the release of Drake's email archives.

Newly released opinions on privacy shed light on past government practices

On Monday the Department of Justice released a previously classified opinion entitled “Authority for Use of Military Force To Combat Terrorist Activities Within the United States” (.pdf), which concluded, among other things, that “the Fourth Amendment [of the U.S. Constitution] does not apply to domestic military operations designed to deter and prevent further terrorist attacks.” This may come as a shock to some because the Fourth Amendment expressly prohibits the government from searching or seizing individuals or their property absent a warrant and probable cause, without any special carve out for domestic military operations. The DOJ opinion, written by Deputy Assistant Attorney General John C. Yoo and Special Counsel Robert J. Delahunty, also concluded that these constitutionally exempt counter-terrorism operations would include “making arrests, seizing documents or other property, searching persons or places or keeping them under surveillance, intercepting electronic or wireless communications, setting up roadblocks, interviewing witnesses, and searching for suspects.” The evidence recovered from these operations could then be used “for criminal investigations or prosecutions.”

Commentators have reacted with concern to the opinion as it placed the power to decide whether or not the Fourth Amendment applied to a military action in the hands of the President (“If the President concludes that it is necessary to use military force domestically to counter [terrorists], the Fourth Amendment should be no more relevant than it would be in cases of invasion or insurrection.”).  Many have also noted that have noted that because NSA is part of the military, this opinion was probably part of the justification for the past administration’s warrantless wire-tapping program, which caused great concerns among civil libritarians.

It is unlikely that this opinion will govern during the Obama presidency: the DOJ formally renounced this opinion on January 15, 2009.  However, the disclosure of this opinion does help shed light on (or confirm) the last administration's view of privacy during the war on terror.

Links:

  • Department of Justice website
  • The October 23, 2001 opinion can be found here (.pdf) or from the DOJ’s website here (.pdf)
  • Department of Justice Press Release announcing the disclosure of the opinion memorandum is available here or from the DOJ’s website here
  • Glenn Greenwald’s column “The newly released secret laws of the Bush administration” is available here
  • National Security Agency website
  • New York Times article “Memos Reveal Scope of the Power Bush Sought” is here (registration required)
  • New York Times article first reporting on the warrantless wiretapping program is here (registration required).