COU CIL OF THE EUROPEA U IO

Brussels, 27 ovember 2013

16 !7"13

#AI 107! U$A 61 %ATAPROTECT 1!& COTER 1'1 E FOPOL 3 & OTE from: to: S#$%ect:

Presidency and Commission Services C !"P"! !eport on t&e findin's $y t&e "( Co)c&airs of t&e ad &oc "()(S *or+in' Gro#p on Data Protection

De,e'ations -i,, find attac&ed t&e !eport on t&e findin's $y t&e "( Co)c&airs of t&e ad &oc "()(S *or+in' Gro#p on Data Protection.

/////////////////

16987/13 DG D 2B

GS/np

E(

Re)or* o+ *,e -.+/.+0s b1 *,e EU Co23,4.rs o- *,e 4/ ,o3 EU2U$ 5or6.+0 7rou) o+ %4*4 Pro*e3*.o+

18

AI9 A % $ETTI 7 UP OF THE 5OR:I 7 7ROUP

3n 4#ne 25136 t&e e7istence of a n#m$er of (S s#rvei,,ance pro'rammes invo,vin' t&e ,ar'e)sca,e co,,ection and processin' of persona, data -as revea,ed. 8&e pro'rammes concern in partic#,ar t&e co,,ection of persona, data from (S internet and te,ecomm#nication service providers and t&e monitorin' of data f,o-s inside and o#tside t&e (S. Given t&e centra, position of (S information and comm#nications tec&no,o'y companies in t&e "( mar+et6 t&e transat,antic ro#tin' of e,ectronic data f,o-s6 and t&e vo,#me of data f,o-s across t&e 0t,antic6 si'nificant n#m$ers of individ#a,s in t&e "( are potentia,,y affected $y t&e (S pro'rammes.

0t t&e "()(S 4#stice and 9ome 0ffairs :inisteria, :eetin' in 4#ne 25136 and in ,etters to t&eir (S co#nterparts6 ;ice)President !edin' and Commissioner :a,mstr<m e7pressed serio#s concerns re'ardin' t&e impact of t&ese pro'rammes on t&e f#ndamenta, ri'&ts of individ#a,s in t&e "(6 partic#,ar,y t&e f#ndamenta, ri'&t to protection of persona, data. C,arifications -ere re=#ested from t&e (S a#t&orities on a n#m$er of aspects6 inc,#din' t&e scope of t&e pro'rammes6 t&e vo,#me of data co,,ected6 t&e e7istence of %#dicia, and administrative oversi'&t mec&anisms and t&eir avai,a$i,ity to individ#a,s in t&e "(6 as -e,, as t&e different ,eve,s of protection and proced#ra, safe'#ards t&at app,y to (S and "( persons.

>#rt&er to a C !"P"! meetin' of 18 4#,y 25136 an ad &oc "()(S *or+in' Gro#p -as esta$,is&ed in 4#,y 2513 to e7amine t&ese matters. 8&e p#rpose -as to esta$,is& t&e facts a$o#t (S s#rvei,,ance pro'rammes and t&eir impact on f#ndamenta, ri'&ts in t&e "( and persona, data of "( citi?ens.

>#rt&er to t&at C !"P"! meetin'6 a @second trac+@ -as esta$,is&ed #nder -&ic& :em$er States may disc#ss -it& t&e (S a#t&orities6 in a $i,atera, format6 matters re,ated to t&eir nationa, sec#rity6 and t&e "( instit#tions may raise -it& t&e (S a#t&orities =#estions re,ated to t&e a,,e'ed s#rvei,,ance of "( instit#tions and dip,omatic missions.

16987/13 011"2

GS/np DG D 2B

n t&e "( side6 t&e ad &oc *or+in' Gro#p is co)c&aired $y t&e Commission and t&e Presidency of t&e Co#nci,. 3t is composed of representatives of t&e Presidency6 t&e Commission services6 t&e "#ropean "7terna, 0ction Service6 t&e incomin' Presidency6 t&e "( Co#nter)8errorism Co) ordinator6 t&e C&air of t&e 0rtic,e 29 *or+in' Party6 as -e,, as ten e7perts from :em$er States6 &avin' e7pertise in t&e area of data protection and ,a- enforcement/sec#rity. n t&e (S side6 t&e 'ro#p is composed of senior officia,s from t&e Department of 4#stice6 t&e ffice of t&e Director of 1ationa, 3nte,,i'ence6 t&e State Department and t&e Department of 9ome,and Sec#rity.

0 preparatory meetin' too+ p,ace in *as&in'ton6 D.C. on 8 4#,y 2513. :eetin's of t&e Gro#p too+ p,ace on 22 and 23 4#,y 2513 in Br#sse,s6 on 19 and 25 Septem$er 2513 in *as&in'ton6 D.C.6 and on 6 1ovem$er 2513 in Br#sse,s.

8&e findin's $y t&e "( co)c&airs of t&e ad &oc "()(S *or+in' Gro#p are presented in t&is report. 8&e report is $ased on information provided $y t&e (S d#rin' t&e meetin's of t&e ad &oc "()(S -or+in' 'ro#p6 as -e,, as on p#$,ic,y avai,a$,e doc#ments6 inc,#din' c,assified doc#ments disc,osed in t&e press $#t not confirmed $y t&e (S. Participants on t&e "( side &ad an opport#nity to s#$mit comments on t&e report. 8&e (S -as provided -it& an opport#nity to comment on possi$,e inacc#racies in t&e draft. 8&e fina, report &as $een prepared #nder t&e so,e responsi$i,ity of t&e "()co c&airs.

8&e distinction $et-een t&e "()(S *or+in' Gro#p and t&e $i,atera, second trac+6 -&ic& ref,ects t&e division of competences $et-een t&e "( and :em$er States and in partic#,ar t&e fact t&at nationa, sec#rity remains t&e so,e responsi$i,ity of eac& :em$er State6 set some ,imitations on t&e disc#ssion in t&e *or+in' Gro#p and t&e information provided t&erein. 8&e scope of t&e disc#ssions -as a,so ,imited $y operationa, necessities and t&e need to protect c,assified information6 partic#,ar,y information re,ated to so#rces and met&ods. 8&e (S a#t&orities dedicated s#$stantia, time and efforts to respondin' to t&e =#estions as+ed $y t&e "( side on t&e ,e'a, and oversi'&t frame-or+ in -&ic& t&eir Si'na, 3nte,,i'ence capa$i,ities operate.

16987/13 011"2

GS/np DG D 2B

28

THE LE7AL FRA9E5OR:

8&e (S provided information re'ardin' t&e ,e'a, $asis #pon -&ic& s#rvei,,ance pro'rammes are $ased and carried o#t. 8&e (S c,arified t&at t&e PresidentBs a#t&ority to co,,ect forei'n inte,,i'ence o#tside t&e (S derives direct,y from &is capacity as @commander in c&ief@ and from &is competences for t&e cond#ct of t&e forei'n po,icy6 as ens&rined in t&e (S constit#tion.

8&e overa,, (S constit#tiona, frame-or+6 as interpreted $y t&e (S S#preme Co#rt is a,so s#fficient,y re,evant to ma+e reference to it &ere. 8&e protection of t&e >o#rt& 0mendment of t&e (S Constit#tion6 -&ic& pro&i$its @#nreasona$,e searc&es and sei?#res@ and re=#ires t&at a -arrant m#st $e $ased #pon @pro$a$,e ca#se@1 e7tends on,y to (S nationa,s and citi?ens of any nation residin' -it&in t&e (S. 0ccordin' to t&e (S S#preme Co#rt6 forei'ners -&o &ave not previo#s,y deve,oped si'nificant vo,#ntary connections -it& t&e (S cannot invo+e t&e >o#rt& 0mendment2.

8-o ,e'a, a#t&orities t&at serve as $ases for t&e co,,ection of persona, data $y (S inte,,i'ence a'encies are: Section 752 of t&e >orei'n 3nte,,i'ence S#rvei,,ance 0ct of 1978 C>3S0D Cas amended $y t&e 2558 >3S0 0mendments 0ct6 E5 (.S.C. F 1881aDG and Section 21E of t&e (S0 P08!3 8 0ct 2551 C-&ic& a,so amended >3S06 E5 (.S.C. 1861D. 8&e >3S0 Co#rt &as a ro,e in a#t&orisin' and overseein' inte,,i'ence co,,ection #nder $ot& ,e'a, a#t&orities.

@Pro$a$,e ca#se@ m#st $e s&o-n $efore an arrest or searc& -arrant may $e iss#ed. >or pro$a$,e ca#se to e7ist t&ere m#st $e s#fficient reason $ased #pon +no-n facts to $e,ieve a crime &as $een committed or t&at certain property is connected -it& a crime. 3n most cases6 pro$a$,e ca#se &as to e7ist prior to arrest6 searc& or sei?#re6 inc,#din' in cases -&en ,aenforcement a#t&orities can ma+e an arrest or searc& -it&o#t a -arrant. 0ccordin' to t&e (S S#preme Co#rt6 forei'ners -&o are not residin' permanent,y in t&e (S can on,y re,y on t&e >o#rt& 0mendment if t&ey are part of t&e (S nationa, comm#nity or &ave ot&er-ise deve,oped s#fficient connection -it& t&e (S to $e considered part of t&at comm#nity: (S v. ;erd#'o)(r=#ide? H A9A (.S. 2E9 C1995D6 pp. A9A (.S. 26A)266. GS/np DG D 2B A

16987/13 011"2

8&e (S f#rt&er c,arified t&at not a,, inte,,i'ence co,,ection re,ies on t&ese provisions of >3S0G t&ere are ot&er provisions t&at may $e #sed for inte,,i'ence co,,ection. 8&e Gro#pBs attention -as a,so dra-n to "7ec#tive rder 123336 iss#ed $y t&e (S President in 1981 and amended most recent,y in 25586 -&ic& sets o#t certain po-ers and f#nctions of t&e inte,,i'ence a'encies6 inc,#din' t&e co,,ection of forei'n inte,,i'ence information. 1o %#dicia, oversi'&t is provided for inte,,i'ence co,,ection #nder "7ec#tive rder 123336 $#t activities commenced p#rs#ant to t&e rder m#st not vio,ate t&e (S constit#tion or app,ica$,e stat#tory ,a-.

2818 2.1.1.

$e3*.o+ 702 FI$A ;'0 U8$8C8 < 1!!14= Material scope of Section 702 FISA

Section 752 >3S0 provides a ,e'a, $asis for t&e co,,ection of @forei'n inte,,i'ence information@ re'ardin' persons -&o are @reasona$,y $e,ieved to $e ,ocated o#tside t&e (nited States.@ 0s t&e provision is directed at t&e co,,ection of information concernin' non)(S persons6 it is of partic#,ar re,evance for an assessment of t&e impact of (S s#rvei,,ance pro'rammes on t&e protection of persona, data of "( citi?ens.

(nder Section 7526 information is o$tained @from or -it& t&e assistance of an e,ectronic comm#nication service provider@. 8&is can encompass different forms of persona, information Ce.'. emai,s6 p&oto'rap&s6 a#dio and video ca,,s and messa'es6 doc#ments and internet $ro-sin' &istoryD and co,,ection met&ods6 inc,#din' -iretaps and ot&er forms of interception of e,ectronica,,y stored data and data in transmission.

8&e (S confirmed t&at it is #nder Section 752 t&at t&e 1ationa, Sec#rity 0'ency C1S0D maintains a data$ase +no-n as P!3S:. 8&is a,,o-s co,,ection of e,ectronica,,y stored data6 inc,#din' content data6 $y means of directives addressed to t&e main (S internet service providers and tec&no,o'y companies providin' on,ine services6 inc,#din'6 accordin' to c,assified doc#ments disc,osed in t&e press $#t not confirmed $y t&e (S6 :icrosoft6 Ia&oo6 Goo',e6 >ace$oo+6 Pa,8a,+6 0 J6 0pp,e6 S+ype and Io#8#$e.

16987/13 011"2

GS/np DG D 2B

8&e (S a,so confirmed t&at Section 752 provides t&e ,e'a, $asis for so)ca,,ed @#pstream co,,ection@G t&is is #nderstood to $e t&e interception of 3nternet comm#nications $y t&e 1S0 as t&ey transit t&ro#'& t&e (S 1 Ce.'. t&ro#'& ca$,es6 at transmission pointsD.

Section 752 does not re=#ire t&e 'overnment to identify partic#,ar tar'ets or 'ive t&e >orei'n 3nte,,i'ence S#rvei,,ance Co#rt C&ereafter B>3SCBD Co#rt a rationa,e for individ#a, tar'etin'. Section 752 states t&at a specific -arrant for eac& tar'et is not necessary.

8&e (S stated t&at no $,an+et or $#,+ co,,ection of data is carried o#t #nder Section 7526 $eca#se co,,ection of data ta+es p,ace on,y for a specified forei'n inte,,i'ence p#rpose. 8&e act#a, scope of t&is ,imitation remains #nc,ear as t&e concept of forei'n inte,,i'ence &as on,y $een e7p,ained in t&e a$stract terms set o#t &ereafter and it remains #nc,ear for e7act,y -&ic& p#rposes forei'n inte,,i'ence is co,,ected. 8&e "( side as+ed for f#rt&er specification of -&at is covered #nder @forei'n inte,,i'ence information6@ -it&in t&e meanin' of >3S0 E56 (.S.C. F1851CeD6 s#c& as references to ,e'a, a#t&orities or interna, '#ide,ines s#$stantiatin' t&e scope of forei'n inte,,i'ence information and any ,imitations on its interpretation6 $#t t&e (S e7p,ained t&at t&ey co#,d not provide t&is as to do so -o#,d revea, specific operationa, aspects of inte,,i'ence co,,ection pro'rammes. @>orei'n inte,,i'ence information@6 as defined $y >3S06 inc,#des specific cate'ories of information Ce.'. internationa, terrorism and internationa, pro,iferation of -eapons of mass destr#ctionD as -e,, as @information re,atin' to t&e cond#ct of t&e forei'n affairs of t&e (S.@ Priorities are identified $y t&e *&ite 9o#se and t&e Director of 1ationa, 3nte,,i'ence and a ,ist is dra-n #p on t&e $asis of t&ese priorities.

>orei'n inte,,i'ence co#,d6 on t&e face of t&e provision6 inc,#de information concernin' t&e po,itica, activities of individ#a,s or 'ro#ps6 or activities of 'overnment a'encies6 -&ere s#c& activity co#,d $e of interest to t&e (S for its forei'n po,icy2. 8&e (S noted t&at @forei'n inte,,i'ence@ inc,#des information 'at&ered -it& respect to a forei'n po-er or a forei'n territory as defined $y >3S06 E5 (SC 1851.

pinions of t&e >orei'n 3nte,,i'ence S#rvei,,ance Co#rt C>3SCD of 3 cto$er 2511 and of 35 1ovem$er 2511. E5 (.S.C. F1851CeD C2D read in con%#nction -it& F1851CaD CED and C6D. GS/np DG D 2B 6

16987/13 011"2

n t&e =#estion -&et&er @forei'n inte,,i'ence information@ can inc,#de activities t&at co#,d $e re,evant to (S economic interests6 t&e (S stated t&at it is not cond#ctin' any form of ind#stria, espiona'e and referred to statements of t&e President of t&e (nited States1 and t&e Director of 1ationa, 3nte,,i'ence2. 8&e (S e7p,ained t&at it may co,,ect economic inte,,i'ence Ce.'. t&e macroeconomic sit#ation in a partic#,ar co#ntry6 disr#ptive tec&no,o'iesD t&at &as a forei'n inte,,i'ence va,#e. 9o-ever6 t&e (S #nder,ined t&at information t&at is o$tained -&ic& may provide a competitive advanta'e to (S companies is not a#t&orised to $e passed on to t&ose companies. Section 752 provides t&at #pon iss#ance of an order $y >3SC6 t&e 0ttorney Genera, and t&e Director of 1ationa, 3nte,,i'ence may a#t&ori?e %oint,y t&e tar'etin' of persons reasona$,y $e,ieved to $e ,ocated o#tside t&e (S to ac=#ire forei'n inte,,i'ence information. Section 752 does not re=#ire t&at forei'n inte,,i'ence information $e t&e so,e p#rpose or even t&e primary p#rpose of ac=#isition6 $#t rat&er @a si'nificant p#rpose of t&e ac=#isition@. 8&ere can $e ot&er p#rposes of co,,ection in addition to forei'n inte,,i'ence. 9o-ever6 t&e dec,assified >3SC pinions indicate t&at6 d#e to t&e $road met&od of co,,ection app,ied #nder t&e #pstream pro'ramme and a,so d#e to tec&nica, reasons6 persona, data is co,,ected t&at may not $e re,evant to forei'n inte,,i'ence3.

Spea+in' at a press conference in Stoc+&o,m on A Septem$er 25136 President $ama said: @-&en it comes to inte,,i'ence 'at&erin' internationa,,y6 o#r foc#s is on co#nterterrorism6 -eapons of mass destr#ction6 cy$er sec#rity )) core nationa, sec#rity interests of t&e (nited States@. Statement $y Director of 1ationa, 3nte,,i'ence 4ames !. C,apper on 0,,e'ations of "conomic "spiona'e6 8 Septem$er 2513: @*&at -e do not do6 as -e &ave said many times6 is #se o#r forei'n inte,,i'ence capa$i,ities to stea, t&e trade secrets of forei'n companies on $e&a,f of ) or 'ive inte,,i'ence -e co,,ect to ) (S companies to en&ance t&eir internationa, competitiveness or increase t&eir $ottom ,ine@G f#,, statement avai,a$,e at: &ttp://---.dni.'ov/inde7.p&p/ne-sroom/press) re,eases/191)press)re,eases)2513/926)statement)$y)director)of)nationa,)inte,,i'ence)%ames)r)c,apper) on)a,,e'ations)of)economic)espiona'e. 0ccordin' to t&e >3SC Dec,assified pinion of 3 cto$er 25116 @1S0s B#pstream co,,ectionB of 3nternet comm#nications inc,#des t&e ac=#isition of entire BtransactionsB@6 -&ic& @may contain data t&at is -&o,,y #nre,ated to t&e tas+ed se,ector6 inc,#din' t&e f#,, content of discrete comm#nications t&at are not to6 from6 or a$o#t t&e faci,ity tas+ed for co,,ection@ Cp. ED. 8&e >3SC f#rt&er notes t&at @1S0Bs #pstream co,,ection devices &ave tec&no,o'ica, ,imitations t&at si'nificant,y affect t&e scope of co,,ection@ Cp. 35D6 and t&at @1S0Bs #pstream 3nternet co,,ection devices are 'enera,,y incapa$,e of distin'#is&in' $et-een transactions containin' on,y a sin',e discrete comm#nication to6 from6 or a$o#t a tas+ed se,ector and transactions containin' m#,tip,e discrete comm#nications6 not a,, of -&ic& may $e to6 from or a$o#t a tas+ed se,ector@ Cp. 31D. 3t is stated in t&e >3SC Dec,assified pinion t&at @t&e portions of :C8s Km#,ti comm#nication transactionsL t&at contain references to tar'eted se,ectors are ,i+e,y to contain forei'n inte,,i'ence information6 and t&at it is not feasi$,e for 1S0 to ,imit its co,,ection on,y to t&e re,evant portion or portions of eac& :C8@ Cp. E7D.

16987/13 011"2

GS/np DG D 2B

2.1.2.

Personal scope of Section 702 FISA

Section 752 >3S0 'overns t&e @tar'etin' of persons reasona$,y $e,ieved to $e ,ocated o#tside t&e (nited States to ac=#ire forei'n inte,,i'ence information@. 3t is aimed at t&e tar'etin' of non)(S persons -&o are overseas. 8&is is confirmed $y t&e ,imitations set fort& in Section 752 C$D >3S0 -&ic& e7c,#sive,y concern (S citi?ens or non)(S persons -it&in t&e (S1. :ore specifica,,y6 ac=#isition of data a#t&orised #nder Section 752 may not: CiD intentiona,,y tar'et any person +no-n at t&e time of ac=#isition to $e ,ocated in t&e (SG CiiD intentiona,,y tar'et a person $e,ieved to $e ,ocated o#tside t&e (S if t&e p#rpose of s#c& ac=#isition is to tar'et a partic#,ar6 +no-n person reasona$,y $e,ieved to $e in t&e (SG CiiiD intentiona,,y tar'et a (S person reasona$,y $e,ieved to $e ,ocated o#tside t&e (SG CivD intentiona,,y ac=#ire any comm#nication as to -&ic& t&e sender and a,, intended recipients are +no-n at t&e time of ac=#isition to $e ,ocated in t&e (S. 3n addition6 p#rs#ant to t&e same provision6 ac=#isition of data m#st $e @cond#cted in a manner consistent -it& t&e >o#rt& 0mendment to t&e Constit#tion of t&e (nited States@6 t&at pro&i$its @#nreasona$,e searc&es and sei?#res@ and re=#ires t&at a -arrant m#st $e $ased #pon @pro$a$,e ca#se@. 0s far as (S persons are concerned6 t&e definition of @forei'n inte,,i'ence information@ re=#ires t&at t&e information to $e co,,ected is necessary to t&e p#rpose p#rs#ed2. Concernin' non)(S persons6 t&e definition of @forei'n inte,,i'ence information@ on,y re=#ires t&e information to $e related to t&e p#rpose p#rs#ed3.

2 3

@(S person@ is defined in E5 (.S.C. F1851CiD as a (S citi?en6 an a,ien ,a-f#,,y admitted for permanent residence6 an #nincorporated association a s#$stantia, n#m$er of mem$ers of -&ic& are (S citi?ens or permanent residents6 or a corporation incorporated in t&e (S $#t not inc,#din' a corporation or association t&at is a forei'n po-er. E5 (.S.C. F1851CeD. 3$id. GS/np DG D 2B 8

16987/13 011"2

0s disc#ssed $e,o-6 co,,ection #nder Section 752 is s#$%ect to tar'etin' and minimisation proced#res t&at aim to red#ce t&e co,,ection of persona, data of (S persons #nder Section 7526 as -e,, as t&e f#rt&er processin' of persona, data of (S persons incidenta,,y ac=#ired #nder Section 752. *&i,e6 accordin' to t&e (S6 non (S persons may $enefit from some re=#irements set o#t in t&e minimi?ation proced#res16 t&ere are no tar'etin' or minimisation proced#res #nder Section 752 t&at specifica,,y aim to red#ce t&e co,,ection and f#rt&er processin' of persona, data of non)(S persons incidenta,,y ac=#ired.

2.1.3.

Geographical scope of Section 702 FISA

Section 752 does not contain ,imitations on t&e 'eo'rap&ica, scope of co,,ection of forei'n inte,,i'ence information.

Section 752 C&D provides t&at t&e 0ttorney Genera, and t&e Director of 1ationa, 3nte,,i'ence may direct an @e,ectronic comm#nication service provider@ to provide immediate,y a,, information6 faci,ities or assistance necessary. 8&is encompasses a -ide ran'e of e,ectronic comm#nication services and operators6 inc,#din' t&ose t&at may &ave persona, data pertainin' to individ#a,s in t&e "( in t&eir possession:

CiD any service -&ic& provides #sers -it& t&e a$i,ity to send or receive -ire or e,ectronic comm#nications Ct&is co#,d inc,#de e.'. emai,6 c&at and ; 3P providersD2G

CiiD any @remote comp#tin'@ service6 i.e. one -&ic& provides to t&e p#$,ic comp#ter stora'e or processin' services $y means of an e,ectronic comm#nications system3G CiiiD any provider of te,ecomm#nications services Ce.'. 3nternet service providersD&G and

2 3 &

Dec,assified minimi?ation proced#res C2511D #sed $y t&e 1S0 in connection -it& ac=#isitions of forei'n inte,,i'ence information p#rs#ant to Section 752 >3S0. See Section 3 CaD >3S0 s.751 C$DCADCBDG 18 (.S.C. F 2E15. >3S0 s.751 C$D CAD CCDG 18 (.S.C. F 2711. >3S0 s.751 C$D CAD C0DG A7 (.S.C. F 1E3. GS/np DG D 2B 9

16987/13 011"2

CivD any ot&er comm#nication service provider -&o &as access to -ire or e,ectronic comm#nications eit&er as t&ey are transmitted or as t&ey are stored1.

Dec,assified >3SC opinions confirm t&at (S inte,,i'ence a'encies &ave reco#rse to met&ods of co,,ection #nder Section 752 t&at &ave a -ide reac&6 s#c& as t&e P!3S: co,,ection of data from internet service providers or t&ro#'& t&e @#pstream co,,ection@ of data t&at transits t&ro#'& t&e (S2.

8&e "( as+ed for specific c,arifications on t&e iss#e of co,,ection of or access to data not ,ocated or not e7c,#sive,y ,ocated in t&e (SG data stored or ot&er-ise processed in t&e c,o#dG data processed $y s#$sidiaries of (S companies ,ocated in t&e "(G and data from 3nternet transmission ca$,es o#tside t&e (S. 8&e (S dec,ined to rep,y on t&e 'ro#nds t&at t&e =#estions pertained to met&ods of inte,,i'ence co,,ection.

2828

$e3*.o+ 21' U$ P4*r.o* A3* ;'0 U8$8C8 < 1!61=

Section 21E of t&e (S0)Patriot 0ct 2551 is t&e second ,e'a, a#t&ority for s#rvei,,ance pro'rammes t&at -as disc#ssed $y t&e ad &oc "()(S -or+in' 'ro#p. 3t permits t&e >edera, B#rea# of 3nvesti'ation C>B3D to ma+e an app,ication for a co#rt order re=#irin' a $#siness or anot&er entity to prod#ce @tan'i$,e t&in's@6 s#c& as $oo+s6 records or doc#ments6 -&ere t&e information so#'&t is re,evant for an investi'ation to o$tain forei'n inte,,i'ence information not concernin' a (nited States person or to protect a'ainst internationa, terrorism or c,andestine inte,,i'ence activities3. 8&e order is secret and may not $e disc,osed. 9o-ever6 t&e (S ffice of t&e Director of 1ationa, 3nte,,i'ence dec,assified and made p#$,ic some doc#ments re,ated to Section 21E6 inc,#din' doc#ments revea,in' t&e ,e'a, reasonin' of t&e >3SC on Section 21E.

1 2

>3S0 s.751 C$D CAD CDD. See dec,assified ,etters of A :ay 2552 from D 4 and D13 to t&e C&airman of t&e (S senate and 9o#se of !epresentativesB Se,ect Committee on 3nte,,i'ence6 p. 3)A of anne7ed doc#ment. Section 21E f#rt&er specifies t&at prod#ction of information can re,ate to an investi'ation on internationa, terrorism or c,andestine inte,,i'ence activities concernin' a (S person6 provided t&at s#c& investi'ation of a (S person is not cond#cted so,e,y #pon t&e $asis of activities protected $y t&e first amendment to t&e Constit#tion. GS/np DG D 2B 15

16987/13 011"2

8&e (S confirmed t&at t&is provision serves as t&e $asis for a pro'ramme of inte,,i'ence co,,ection via orders o$tained $y t&e >B3 from t&e >3SC directin' certain te,ecomm#nications service providers to provide specified non)content te,ep&ony @meta)data@. >or t&at pro'ramme6 t&e information is stored $y t&e 1S0 and =#eried on,y for co#nter)terrorism p#rposes.

8&at pro'ramme is ,imited to t&e co,,ection of ca,, detai, records6 or te,ep&ony @meta)data@ maintained $y specified te,ecomm#nications service providers. 8&ese records cover information s#c& as te,ep&one n#m$ers dia,,ed and t&e n#m$ers from -&ic& ca,,s are made6 as -e,, as t&e date6 time and d#ration of ca,,s6 $#t do not inc,#de t&e content of t&e ca,,s6 t&e names6 address or financia, information of any s#$scri$er or c#stomer6 or any ce,, site ,ocation information. 0ccordin' to t&e e7p,anations provided $y t&e (S6 t&is means t&at t&e inte,,i'ence a'encies cannot6 t&ro#'& t&is pro'ramme6 ,isten to or record te,ep&one conversations.

8&e (S e7p,ained t&at Section 21E a,,o-s for @$#,+@ co,,ection of te,ep&ony meta)data maintained $y t&e company to -&om t&e order is addressed. 8&e (S a,so e7p,ained t&at6 a,t&o#'& t&e co,,ection is $road in scope6 t&e f#rt&er processin' of t&e meta)data ac=#ired #nder t&is pro'ramme is ,imited to t&e p#rpose of investi'ation of internationa, terrorism. 3t -as stated t&at t&e $#,+ records may not $e accessed or =#eried $y inte,,i'ence a'encies for any ot&er p#rpose.

0n order for data #nder Section 21E can concern not on,y t&e data of (S persons6 $#t a,so of non) (S persons. Bot& (S and "( data s#$%ects6 -&erever ,ocated6 fa,, -it&in t&e scope of t&e te,ep&ony meta)data pro'ramme6 -&enever t&ey are party to a te,ep&one ca,, made to6 from or -it&in t&e (S and -&ose meta)data is maintained and prod#ced $y a company to -&om t&e order is addressed.

8&ere are ,imitations on t&e scope of Section 21E 'enera,,y: -&en app,yin' for an order6 t&e >B3 m#st specify reasona$,e 'ro#nds to $e,ieve t&at t&e records so#'&t are re,evant to an a#t&orised investi'ation to o$tain forei'n inte,,i'ence information not concernin' a (S person6 or to protect a'ainst internationa, terrorism or c,andestine inte,,i'ence activities. 3n addition6 (S persons $enefit #nder Section 21E from a f#rt&er protection #navai,a$,e to non)(S persons6 as Section 21E specifica,,y e7c,#des from its scope @investi'ation of a (nited States person KML cond#cted so,e,y #pon t&e $asis of activities protected $y t&e first amendment to t&e Constit#tion@6 i.e. activities protected $y t&e freedom of re,i'ion6 t&e freedom of speec& or of t&e press6 as -e,, as t&e freedom of assem$,y and to petition t&e Government for redress for 'rievances.

16987/13 011"2

GS/np DG D 2B

11

2838

E>e3u*.ve Or/er 12333

8&e (S indicated t&at "7ec#tive rder 12333 serves as t&e $asis for ot&er s#rvei,,ance pro'rammes6 t&e scope of -&ic& is at t&e discretion of t&e President. 8&e (S confirmed t&at "7ec#tive rder 12333 is t&e 'enera, frame-or+ on inte,,i'ence 'at&erin' inside and o#tside t&e (S. 0,t&o#'& t&e "7ec#tive rder re=#ires t&at a'encies operate #nder '#ide,ines approved $y t&e &ead of t&e a'ency and t&e 0ttorney Genera,6 t&e rder itse,f does not set any restriction to $#,+ co,,ection of data ,ocated o#tside t&e (S e7cept to reiterate t&at a,, inte,,i'ence co,,ection m#st comp,y -it& t&e (S Constit#tion and app,ica$,e ,a-. "7ec#tive rder 12333 a,so provides a ,e'a, $asis to disseminate to forei'n 'overnments information ac=#ired p#rs#ant to Section 7521. 8&e "( re=#ested f#rt&er information re'ardin' t&e scope and f#nctionin' of "7ec#tive rder 12333 and t&e '#ide,ines and s#pp,ementa, proced#res -&ose adoption is provided for #nder t&e "7ec#tive rder. 8&e "( re=#ested information in partic#,ar -it& re'ard to t&e app,ication of "7ec#tive rder 12333 to $#,+ data co,,ection6 its impact on individ#a,s in t&e "( and any app,ica$,e safe'#ards. 8&e (S e7p,ained t&at t&e part t&at covers si'na,s inte,,i'ence anne7ed to t&e re,evant re'#,ation settin' fort& proced#res #nder 12333 is c,assified6 as are t&e s#pp,ementary proced#res on data ana,ysis6 $#t t&at t&e foc#s of t&ese proced#res is on protectin' information of (S persons. 8&e (S indicated t&at t&e ,imitations on inte,,i'ence co,,ection #nder "7ec#tive rder 12333 are not desi'ned to ,imit t&e co,,ection of persona, data of non)(S persons. >or e7amp,e6 on t&e =#estion -&et&er co,,ection of in$o7 disp,ays from emai, acco#nts and/or co,,ection of contact ,ists are a#t&orised6 t&e (S representatives rep,ied t&at t&ey -ere not a-are of a pro&i$ition of s#c& practices. 8&e (S confirmed t&at %#dicia, approva, is not re=#ired #nder "7ec#tive rder 12333 and t&at t&ere is no %#dicia, oversi'&t of its #se6 e7cept in ,imited circ#mstances s#c& as -&en information is #sed in a ,e'a, proceedin'. "7ec#tive oversi'&t is e7ercised #nder "7ec#tive rder 12333 $y t&e 3nspector)Genera,s of eac& a'ency6 -&o re'#,ar,y report to t&e &eads of t&eir a'encies and to Con'ress on t&e #se as -e,, as on $reac&es of "7ec#tive rder 12333. 8&e (S -as #na$,e to provide any =#antitative information -it& re'ard to t&e #se or impact on "( citi?ens of "7ec#tive rder 12333. 8&e (S did e7p,ain6 &o-ever6 t&at t&e "7ec#tive rder states t&at inte,,i'ence a'encies s&o#,d 'ive @specia, emp&asis@ to detectin' and co#nterin' t&e t&reats posed $y terrorism6 espiona'e6 and t&e pro,iferation of -eapons of mass destr#ction2.

1 2

See Dec,assified minimi?ation proced#res6 at p. 11. See "7ec#tive rder 123336 Part 1.1 CcD. GS/np DG D 2B 12

16987/13 011"2

8&e (S f#rt&er confirmed t&at in t&e (S t&ere are ot&er ,e'a, $ases for inte,,i'ence co,,ection -&ere t&e data of non)(S persons may $e ac=#ired $#t did not 'o into detai,s as to t&e ,e'a, a#t&orities and proced#res app,ica$,e.

38

COLLECTIO A % FURTHER PROCE$$I 7 OF %ATA

3n response to =#estions from t&e "( re'ardin' &o- data is co,,ected and #sed #nder t&e s#rvei,,ance pro'rammes6 t&e (S stated t&at t&e co,,ection of persona, information $ased on Section 752 >3S0 and Section 21E Patriot 0ct is s#$%ect to a n#m$er of proced#ra, safe'#ards and ,imitative conditions. (nder $ot& ,e'a, a#t&orities6 accordin' to t&e (S6 privacy is protected $y a m#,ti) ,ayered system of contro,s on -&at is co,,ected and on t&e #se of -&at is co,,ected6 and t&ese contro,s are $ased on t&e nat#re and intr#siveness of t&e co,,ection.

3t appeared from t&e disc#ssions t&at t&ere is a si'nificant difference in interpretation $et-een t&e "( and t&e (S of a f#ndamenta, concept re,atin' to t&e processin' of persona, data $y sec#rity a'encies. >or t&e "(6 data ac=#isition is synonymo#s -it& data co,,ection and is a form of processin' of persona, data. Data protection ri'&ts and o$,i'ations are a,ready app,ica$,e at t&at sta'e. 0ny s#$se=#ent operation carried o#t on t&e data co,,ected6 s#c& as stora'e or cons#,tation $y &#man eyes6 constit#tes f#rt&er processin'. 0s t&e (S e7p,ained6 #nder (S ,a-6 t&e initia, ac=#isition of persona, data does not a,-ays constit#te processin' of persona, dataG data is @processed@ on,y -&en it is ana,ysed $y means of &#man intervention. 8&is means t&at -&i,e certain safe'#ards arise at t&at moment of ac=#isition6 additiona, data protection safe'#ards arise at t&e time of processin'.

16987/13 011"2

GS/np DG D 2B

13

3818 3.1.1.

$e3*.o+ 702 FI$A Certification and a thori!ation proced re

Section 752 does not re=#ire individ#a, %#dicia, orders or -arrants a#t&ori?in' co,,ection a'ainst eac& tar'et. 3nstead6 t&e >3SC approves ann#a, certifications s#$mitted in -ritin' $y t&e 0ttorney Genera, and t&e Director of 1ationa, 3nte,,i'ence. Bot& t&e certifications and t&e >3SCBs orders are secret6 #n,ess dec,assified #nder (S ,a-. 8&e certifications6 -&ic& are rene-a$,e6 identify cate'ories of forei'n inte,,i'ence information so#'&t to $e ac=#ired. 8&ey are t&erefore critica, doc#ments for a correct #nderstandin' of t&e scope and reac& of co,,ection p#rs#ant to Section 752. 8&e "( re=#ested6 $#t did not receive6 f#rt&er information re'ardin' &o- t&e certifications or cate'ories of forei'n inte,,i'ence p#rposes are defined and is t&erefore not in a position to assess t&eir scope. 8&e (S e7p,ained t&at t&e specific p#rpose of ac=#isition is set o#t in t&e certification6 $#t -as not in a position to provide mem$ers of t&e Gro#p -it& e7amp,es $eca#se t&e certifications are c,assified. 8&e >3SC &as %#risdiction to revie- certifications as -e,, as tar'etin' and minimi?ation proced#res. 3t revie-s Section 752 certification to ens#re t&at t&ey contain a,, re=#ired e,ements and tar'etin' and minimi?ation proced#res to ens#re t&at t&ey are consistent -it& >3S0 and t&e >o#rt& 0mendment to t&e (S Constit#tion. 8&e certification s#$mitted to >3SC $y t&e 0ttorney Genera, and t&e Director of 1ationa, 3nte,,i'ence m#st contain a,, t&e re=#ired e,ements #nder Section 752 CiD6 inc,#din' an attestation t&at a si'nificant p#rpose of t&e ac=#isition is to o$tained forei'n inte,,i'ence information. 8&e >3SC does not scr#tinise t&e s#$stance of t&e attestation or t&e need to ac=#ire data a'ainst t&e p#rpose of t&e ac=#isition6 e.'. -&et&er it is consistent -it& t&e p#rpose or proportionate6 and in t&is re'ard cannot s#$stit#te t&e determination made $y t&e 0ttorney Genera, and t&e Director of 1ationa, 3nte,,i'ence. Section 752 e7press,y specifies t&at certifications are not re=#ired to identify t&e specific faci,ities6 p,aces6 premises6 or property to -&ic& an ac=#isition of data -i,, $e directed or in -&ic& it -i,, $e cond#cted. n t&e $asis of >3SC)approved certifications6 data is co,,ected $y means of directives addressed to e,ectronic comm#nications services providers to provide any and a,, assistance necessary. n t&e =#estion of -&et&er data is @p#s&ed@ $y t&e companies or @p#,,ed@ $y t&e 1S0 direct,y from t&eir infrastr#ct#re6 t&e (S e7p,ained t&at t&e tec&nica, moda,ities depend on t&e provider and t&e system t&ey &ave in p,aceG providers are s#pp,ied -it& a -ritten directive6 respond to it and are t&erefore informed of a re=#est for data. 8&ere is no co#rt approva, or revie- of t&e ac=#isition of data in eac& specific case.

16987/13 011"2

GS/np DG D 2B

1A

0ccordin' to t&e (S61 #nder Section 7526 once comm#nications from specific tar'ets t&at are assessed to possess6 or t&at are ,i+e,y to comm#nicate6 forei'n inte,,i'ence information &ave $een ac=#ired6 t&e comm#nications may $e =#eried. 8&is is ac&ieved $y tas+in' se,ectors t&at are #sed $y t&e tar'eted individ#a,6 s#c& as a te,ep&one n#m$er or an emai, address. 8&e (S e7p,ained t&at t&ere are no random searc&es of data co,,ected #nder Section 7526 $#t on,y tar'eted =#eries. N#ery terms inc,#de names6 emai, addresses6 te,ep&one n#m$ers6 or +ey-ords. *&en =#ery terms are #sed to searc& data$ases6 t&ere is no re=#irement of reasona$,e s#spicion neit&er of #n,a-f#, activity nor of a specific investi'ation. 8&e app,ica$,e criterion is t&at t&e =#ery terms s&o#,d $e reasona$,y $e,ieved to $e #sed to ret#rn forei'n inte,,i'ence information. 8&e (S confirmed t&at it is possi$,e to perform f#,,)te7t searc&es of comm#nications co,,ected6 and access $ot& content information and metadata -it& respect to comm#nications co,,ected.

8&e tar'etin' decisions made $y 1S0 in order to first ac=#ire comm#nications are revie-ed after) t&e)fact $y t&e Department of 4#stice and t&e ffice of t&e Director of 1ationa, 3nte,,i'enceG ot&er instances of oversi'&t e7ist -it&in t&e e7ec#tive $ranc&. 8&ere is no %#dicia, scr#tiny of t&e se,ectors tas+ed6 e.'. t&eir reasona$,eness or t&eir #se. 8&e "( re=#ested f#rt&er information on t&e criteria on t&e $asis of -&ic& se,ectors are defined and c&osen6 as -e,, as e7amp,es of se,ectors6 $#t no f#rt&er c,arifications -ere provided.

See a,so Semi)0nn#a, 0ssessment of Comp,iance -it& t&e Proced#res and G#ide,ines 3ss#ed P#rs#ant to Section 752 of t&e >orei'n 3nte,,i'ence S#rvei,,ance 0ct6 S#$mitted $y t&e 0ttorney Genera, and t&e Director of 1ationa, 3nte,,i'ence6 dec,assified $y t&e Director of 1ationa, 3nte,,i'ence on 21 0#'#st 2513 C&ttp://---.dni.'ov/fi,es/doc#ments/Semiann#a,O250ssessmentO25ofO25Comp,ianceO25 -it&O25proced#resO25andO25'#ide,inesO25iss#edO25p#rs#antO25toO25SectO25752O2 5ofO25>3S0.pdfD6 0nne7 06 p. 02. GS/np DG D 2B 1E

16987/13 011"2

8&e co,,ection of data is s#$%ect to specific @minimisation@ proced#res approved $y t&e >3SC. 8&ese proced#res e7p,icit,y app,y to information incidenta,,y co,,ected of6 or concernin'6 (S persons. 8&ey primari,y aim to protect t&e privacy ri'&ts of (S persons6 $y ,imitin' t&e co,,ection6 retention6 and dissemination of incidenta,,y ac=#ired information to6 from or a$o#t (S persons. 8&ere is no o$,i'ation to minimi?e impact on non)(S persons o#tside t&e (S. 9o-ever6 accordin' to t&e (S6 t&e minimisation proced#res a,so $enefit non)(S persons6 since t&ey are aimed at ,imitin' t&e co,,ection to data reasona$,y re,evant to a forei'n inte,,i'ence p#rpose1. 0n e7amp,e provided $y t&e (S in Section A of t&e :inimisation Proced#res6 -&ic& contains attorney)c,ient protections for anyone #nder indictment in t&e (nited States6 re'ard,ess of citi?ens&ip stat#s.

8&e co,,ection of data is a,so s#$%ect to specific @tar'etin'@ proced#res t&at are approved $y t&e >3SC. 8&ese @tar'etin'@ proced#res primari,y aim to protect t&e privacy ri'&ts of (S persons6 $y ens#rin' t&at6 in princip,e6 on,y non)(S persons ,ocated a$road are tar'eted. 9o-ever6 t&e (S refers to t&e fact t&at t&e tar'etin' proced#res contain factors for t&e p#rpose of assessin' -&et&er a tar'et possesses and/or is ,i+e,y to comm#nicate forei'n inte,,i'ence information2.

8&e (S did not c,arify -&et&er and &o- ot&er e,ements of t&e minimisation and tar'etin' proced#res app,y in practice to non)(S persons6 and did not state -&ic& r#,es app,y in practice to t&e co,,ection or processin' of non)(S persona, data -&en it is not necessary or re,evant to forei'n inte,,i'ence. >or e7amp,e6 t&e "( as+ed -&et&er information t&at is not re,evant $#t incidenta,,y ac=#ired $y t&e (S is de,eted and -&et&er t&ere are '#ide,ines to t&is end. 8&e (S -as #na$,e to provide a rep,y coverin' a,, possi$,e scenarios and stated t&at t&e retention period -o#,d depend on t&e app,ica$,e ,e'a, $asis and certification approved $y >3SC.

>ina,,y6 t&e >3SC revie- does not inc,#de revie- of potentia, meas#res to protect t&e persona, information of non)(S persons o#tside t&e (S.

3$id6 at p. A6 Section 3 C$D CADG $#t see a,so t&e dec,assified 1ovem$er 2511 >3SC pinion -&ic& fo#nd t&at meas#res previo#s,y proposed $y t&e 'overnment to comp,y -it& t&is re=#irement &ad $een fo#nd to $e #nsatisfactory in re,ation to @#pstream@ co,,ection and processin'G and t&at ne- meas#res -ere on,y fo#nd to $e satisfactory for t&e protection of (S persons. See dec,assified 1S0 tar'etin' proced#res6 p A. GS/np DG D 2B 16

16987/13 011"2

3.1.2.

" antitati#e indicators

3n order to assess t&e reac& of t&e s#rvei,,ance pro'rammes #nder Section 752 and in partic#,ar t&eir impact on individ#a,s in t&e "(6 t&e "( side re=#ested fi'#res6 e.'. &o- many certifications and se,ectors are c#rrent,y #sed6 &o- many of t&em concern individ#a,s in t&e "(6 or re'ardin' t&e stora'e capacities of t&e s#rvei,,ance pro'rammes. 8&e (S did not disc#ss t&e specific n#m$er of certification or se,ectors. 0dditiona,,y6 t&e (S -as #na$,e to =#antify t&e n#m$er of individ#a,s in t&e "( affected $y t&e pro'rammes.

8&e (S confirmed t&at 1.6O of a,, ',o$a, internet traffic is @ac=#ired@ and 5.52EO of it is se,ected for revie-G &ence 5.555AO of a,, ',o$a, internet traffic is ,oo+ed at $y 1S0 ana,ysts. 8&e vast ma%ority of ',o$a, internet traffic consists of &i'&)vo,#me streamin' and do-n,oads s#c& as te,evision series6 fi,ms and sports1. Comm#nications data ma+es #p a very sma,, part of ',o$a, internet traffic. 8&e (S did not confirm -&et&er t&ese fi'#res inc,#ded @#pstream@ data co,,ection.

3.1.3.

$etention Periods

8&e (S side e7p,ained t&at @#nrevie-ed data@ co,,ected #nder Section 752 is 'enera,,y retained for five years6 a,t&o#'& data co,,ected via #pstream co,,ection is retained for t-o years. 8&e minimisation proced#res on,y state t&ese time ,imits in re,ation to (S)persons data2. 9o-ever6 t&e (S e7p,ained t&at t&ese retention periods app,y to a,, #nrevie-ed data6 so t&ey app,y to $ot& (S and non)(S person information.

See Cisco ;is#a, 1et-or+in' 3nde76 2512 Cavai,a$,e at: &ttp://---.cisco.com/en/(S/so,#tions/co,,atera,/ns3A1/nsE2E/nsE37/ns75E/ns827/-&ite/pape r/c11)A81365.pdfD See Dec,assified minimisation proced#res6 at p.116 Section 7G and t&e dec,assified 1ovem$er 2511 >3SC pinion6 at pa'e 13)1A: @8&e t-o)year period 'ives 1S0 s#$stantia, time to revie- its #pstream ac=#isitions for forei'n inte,,i'ence information $#t ens#res t&at non) tar'et information t&at is s#$%ect to protection #nder >3S0 or t&e >o#rt& 0mendment Ki.e. information pertainin' to (S personsL is not retained any ,on'er t&an is reasona$,y necessary... t&e Co#rt conc,#des t&at t&e amended 1S0 minimi?ation proced#res6 as 1S0 is app,yin' t&em to K@#pstream co,,ection@ of 3nternet transactions containin' m#,tip,e comm#nicationsL6 are @reasona$,y desi'ned ... to minimi?e t&e ... retentionKL ... of non) p#$,ic,y avai,a$,e information concernin' #nconsentin' (nited States persons consistent -it& t&e need of t&e (nited States to o$tain6 prod#ce6 and disseminate forei'n inte,,i'ence information.@ GS/np DG D 2B 17

16987/13 011"2

3f t&e data is deemed to $e of forei'n inte,,i'ence interest6 t&ere is no ,imitation on t&e ,en't& of retention. 8&e (S did not specify t&e retention period of data co,,ected #nder "7ec#tive rder 12333.

8&e "( as+ed -&at &appens to @non)responsive@ information Ci.e. data co,,ected t&at does not respond to =#ery on t&e $asis of a =#ery termD. 8&e (S responded t&at it is not @co,,ectin'@ non) responsive information. 0ccordin' to t&e (S6 information t&at is not revie-ed p#rs#ant to a =#ery made to t&at data$ase norma,,y -i,, @a'e off of t&e system@. 3t remains #nc,ear -&et&er and -&en s#c& data is de,eted.

3.1.%.

&n'ard transfers and sharing of infor(ation

8&e (S indicated t&at t&e co,,ected data are stored in a sec#re data$ase -it& ,imited access for a#t&orised staff on,y. 8&e (S &o-ever a,so confirmed t&at in case data co,,ected #nder Section 752 revea, indications of crimina, cond#ct6 t&ey can $e transferred to or s&ared -it& ot&er a'encies o#tside t&e inte,,i'ence comm#nity6 e.'. ,a- enforcement a'encies6 for p#rposes ot&er t&an forei'n inte,,i'ence and -it& t&ird co#ntries. 8&e minimisation proced#res of t&e recipient a'ency are app,ica$,e. @3ncidenta,,y o$tained@ information Cinformation not re,evant to forei'n inte,,i'enceD may a,so $e s&ared if s#c& information meets t&e standard #nder t&e app,ica$,e proced#res. n t&e #se of private contractors6 t&e (S insisted t&at a,, contractors are vetted and s#$%ect to t&e same r#,es as emp,oyees.

3.1.).

*ffecti#eness and added #al e

8&e (S stated t&at in EA instances6 co,,ection #nder Sections 752 and 21E contri$#ted to t&e prevention and com$atin' of terrorismG 2E of t&ese invo,ved "( :em$er States. 8&e (S -as #na$,e to provide fi'#res re'ardin' "7ec#tive rder 12333. 8&e (S confirmed t&at o#t of t&e tota, of EA cases6 A2 cases concerned p,ots t&at -ere foi,ed or disr#pted and 12 cases concerned materia, s#pport for terrorism cases.

16987/13 011"2

GS/np DG D 2B

18

3.1.+.

,ransparency and re(edies e-.post

8&e "( as+ed -&et&er peop,e -&o are s#$%ect to s#rvei,,ance are informed after-ards6 -&ere s#c& s#rvei,,ance t#rns o#t to $e #n%#stified. 8&e (S stated t&at s#c& a ri'&t does not e7ist #nder (S ,a-. 9o-ever6 if information o$tained t&ro#'& s#rvei,,ance pro'rammes is s#$se=#ent,y #sed for t&e p#rposes of crimina, proceedin's6 t&e protections avai,a$,e #nder (S crimina, proced#ra, ,a- app,y.

3.1.7.

&#erarching li(its on strategic s r#eillance of data flo's

8&e "( as+ed -&et&er s#rvei,,ance of comm#nications of peop,e -it& no identified ,in+ to serio#s crime or matters of state sec#rity is ,imited6 for e7amp,e in terms of =#antitative ,imits on t&e percenta'e of comm#nications t&at can $e s#$%ect to s#rvei,,ance. 8&e (S stated t&at no s#c& ,imits e7ist #nder (S ,a-.

3828 3.2.1.

$e3*.o+ 21' U$ P4*r.o* A3* A thori!ation proced re

(nder t&e Section 21E pro'ramme disc#ssed &erein6 t&e >B3 o$tains orders from t&e >3SC directin' te,ecomm#nications service providers to provide te,ep&ony meta)data. 8&e (S e7p,ained t&at6 'enera,,y6 t&e app,ication for an order from t&e >3SC p#rs#ant to Section 21E m#st specify reasona$,e 'ro#nds to $e,ieve t&at t&e records are re,evant to an a#t&orised investi'ation to o$tain forei'n inte,,i'ence information not concernin' a (S person or to protect a'ainst internationa, terrorism or c,andestine inte,,i'ence activities. (nder t&e te,ep&ony metadata co,,ection pro'ramme6 t&e 1S06 in t#rn6 stores and ana,yses t&ese $#,+ records -&ic& can $e =#eried on,y for co#nterterrorism p#rposes. 8&e (S e7p,ained t&at t&e information so#'&t m#st $e @re,evant@ to an investi'ation and t&at t&is is #nderstood $road,y6 since a piece of information t&at mi'&t not $e re,evant at t&e time of ac=#isition co#,d s#$se=#ent,y prove to $e re,evant for an investi'ation. 8&e standard app,ied is ,ess strin'ent t&an @pro$a$,e ca#se@ #nder crimina, ,a- and permits $road co,,ection of data in order to a,,o- t&e inte,,i'ence a#t&orities to e7tract re,evant information.

16987/13 011"2

GS/np DG D 2B

19

8&e ,e'a, standard of re,evance #nder Section 21E is interpreted as not re=#irin' a separate s&o-in' t&at every individ#a, record in t&e data$ase is re,evant to t&e investi'ation. 3t appears t&at t&e standard of re,evance is met if t&e entire data$ase is considered re,evant for t&e p#rposes so#'&t.1 *&i,e >3SC a#t&ori?ation is not re=#ired prior to t&e searc&in' of t&e data $y t&e 1S06 t&e (S stated t&at Co#rt &as approved t&e proced#res 'overnin' access to t&e meta)data ac=#ired and stored #nder t&e te,ep&ony meta)data pro'ramme a#t&orised #nder Section 21E. 0 sma,, n#m$er of senior 1S0 officia,s &ave $een a#t&orised to determine -&et&er t&e searc& of t&e data$ase meets t&e app,ica$,e ,e'a, standard. Specifica,,y6 t&ere m#st $e a @reasona$,e6 artic#,a$,e s#spicion@ t&at an identifier Ce.'. a te,ep&one n#m$erD #sed to =#ery t&e meta)data is associated -it& a specific forei'n terrorist or'anisation. 3t -as e7p,ained $y t&e (S t&at t&e @reasona$,e6 artic#,a$,e s#spicion@ standard constit#tes a safe'#ard a'ainst t&e indiscriminate =#eryin' of t&e co,,ected data and 'reat,y ,imits t&e vo,#me of data act#a,,y =#eried.

8&e (S a,so stressed t&at t&ey consider t&at constit#tiona, privacy protections do not app,y to t&e type of data co,,ected #nder t&e te,ep&ony meta)data pro'ramme. 8&e (S referred to case),a- of t&e (S S#preme Co#rt2 accordin' to -&ic& parties to te,ep&one ca,,s &ave no reasona$,e e7pectation of privacy for p#rposes of t&e >o#rt& 0mendment re'ardin' t&e te,ep&one n#m$ers #sed to ma+e and receive ca,,sG t&erefore6 t&e co,,ection of meta)data #nder Section 21E does not affect t&e constit#tiona, protection of privacy of (S persons #nder t&e >o#rt& 0mendment.

3.2.2.

" antitati#e indicators

8&e (S e7p,ained t&at on,y a very sma,, fraction of t&e te,ep&ony meta)data co,,ected and retained #nder t&e Section 21E)a#t&orised pro'ramme is f#rt&er revie-ed6 $eca#se t&e vast ma%ority of t&e data -i,, never $e responsive to a terrorism)re,ated =#ery. 3t -as f#rt&er e7p,ained t&at in 2512 ,ess t&an 355 #ni=#e identifiers -ere approved as meetin' t&e @reasona$,e6 artic#,a$,e s#spicion@ standard and -ere =#eried. 0ccordin' to t&e (S6 t&e same identifier can $e =#eried more t&an once6 can 'enerate m#,tip,e responsive records6 and can $e #sed to o$tain second and t&ird)tier contacts of t&e identifier C+no-n as @&ops@D. 8&e act#a, n#m$er of =#eries can $e &i'&er t&an 355 $eca#se m#,tip,e =#eries may $e performed #sin' t&e same identifier. 8&e n#m$er of persons affected $y searc&es on t&e $asis of t&ese identifiers6 #p to t&ird)tier contacts6 remains t&erefore #nc,ear.

See ,etter from D 4 to !epresentative Sensen$renner of 16 4#,y 2513 C&ttp://$eta.con'ress.'ov/con'ressiona,)record/2513/7/2A/senate)section/artic,e/9E552)1D (.S. S#preme Co#rt6 S(ith #. Maryland6 AA2 (.S. 73E C1979D: GS/np DG D 2B 25

16987/13 011"2

3n response to t&e =#estion of t&e =#antitative impact of t&e Section 21E te,ep&ony meta)data pro'ramme in t&e "(6 for e7amp,e &o- many "( te,ep&one n#m$ers ca,,in' into t&e (S or &avin' $een ca,,ed from t&e (S &ave $een stored #nder Section 21E)a#t&orised pro'rammes6 t&e (S e7p,ained t&at it -as not a$,e to provide s#c& c,arifications $eca#se it does not +eep t&is type of statistica, information for eit&er (S or non)(S persons.

3.2.3.

$etention periods

8&e (S e7p,ained t&at6 in princip,e6 data co,,ected #nder Section 21E is retained for five years6 -it& t&e e7ception for data t&at are responsive to a#t&ori?ed =#eries. 3n re'ard to data t&at are responsive to a#t&ori?ed =#eries6 t&e data may $e retained p#rs#ant to t&e proced#res of t&e a'ency &o,din' t&e information6 e.'. t&e 1S0 or anot&er a'ency s#c& as t&e >B3 -it& -&om 1S0 s&ared t&e data. 8&e (S referred t&e Gro#p to t&e @0ttorney Genera,Bs G#ide,ines for Domestic >B3 perations@1 -&ic& app,y to data t&at is f#rt&er processed in a specific investi'ation. 8&ese G#ide,ines do not specify retention periods $#t provide t&at information o$tained -i,, $e +ept in accordance -it& a records retention p,an approved $y t&e 1ationa, 0rc&ives and !ecords 0dministration. 8&e 1ationa, 0rc&ives and !ecords 0dministrationBs Genera, !ecords Sc&ed#,es do not esta$,is& specific retention periods t&at -o#,d $e appropriate to a,, app,ications. 3nstead6 it is provided t&at e,ectronic records s&o#,d $e de,eted or destroyed -&en @t&e a'ency determines t&ey are no ,on'er needed for administrative6 ,e'a,6 a#dit or ot&er operationa, p#rposes@.2 3t fo,,o-s t&at t&e retention period for data processed in a specific investi'ation is determined $y t&e a'ency &o,din' t&e information or cond#ctin' t&e investi'ation.

1 2

0vai,a$,e at: &ttp://---.%#stice.'ov/a'/readin'room/'#ide,ines.pdf6 p. 3E. 0vai,a$,e at: &ttp://---.arc&ives.'ov/records)m'mt/'rs/'rs25.&tm,: @8&e records covered $y severa, items in t&is sc&ed#,e are a#t&ori?ed for eras#re or de,etion -&en t&e a'ency determines t&at t&ey are no ,on'er needed for administrative6 ,e'a,6 a#dit6 or ot&er operationa, p#rposes. 10!0 cannot esta$,is& a more specific retention t&at -o#,d $e appropriate in a,, app,ications. "ac& a'ency s&o#,d6 -&en appropriate6 determine a more specific disposition instr#ction6 s#c& as @De,ete after 2 #pdate cyc,es@ or @De,ete -&en 2 years o,d6@ for inc,#sion in its records disposition directives or man#a,. 10!0 approva, is not needed to set retention periods for records in t&e G!S t&at are a#t&ori?ed for destr#ction -&en no ,on'er needed.@ GS/np DG D 2B 21

16987/13 011"2

3.2.%.

&n'ard transfers and sharing of infor(ation

8&e "( as+ed for detai,s -it& re'ards to s&arin' of data co,,ected #nder Section 21E $et-een different a'encies and for different p#rposes. 0ccordin' to t&e (S6 t&e orders for t&e prod#ction of te,ep&ony meta)data6 amon' ot&er re=#irements6 pro&i$it t&e s&arin' of t&e ra- data and permit 1S0 to s&are -it& ot&er a'encies on,y data t&at are responsive to a#t&ori?ed =#eries for co#nterterrorism =#eries. 3n re'ard to t&e >B3Bs &and,in' of data t&at it may receive from t&e 1S06 t&e (S referred to t&e @0ttorney Genera,Bs G#ide,ines for Domestic >B3 perations@1. (nder t&ese '#ide,ines6 t&e >B3 may disseminate co,,ected persona, information to ot&er (S inte,,i'ence a'encies as -e,, as to ,a- enforcement a#t&orities of t&e e7ec#tive $ranc& Ce.'. Department of 4#sticeD for a n#m$er of reasons or on t&e $asis of ot&er stat#tes and ,e'a, a#t&orities2.

&8

O?ER$I7HT A % RE%RE$$ 9ECHA I$9$

8&e (S e7p,ained t&at activities a#t&orised $y Section 752 >3S0 and Section 21E Patriot 0ct are s#$%ect to oversi'&t $y t&e e7ec#tive6 ,e'is,ative and %#dicia, $ranc&es.

8&e oversi'&t re'ime and t&e $a,ance $et-een t&e ro,es of eac& of t&e $ranc&es in overseein' t&e s#rvei,,ance pro'rammes differ accordin' to t&e ,e'a, $asis of co,,ection. >or instance6 $eca#se %#dicia, oversi'&t is ,imited in re,ation to Section 752 and co,,ection #nder "7ec#tive rder 12333 is not s#$%ect to %#dicia, oversi'&t6 a 'reater ro,e is p,ayed $y t&e e7ec#tive $ranc& in t&ese cases. versi'&t re'ardin' -&et&er co,,ection on a forei'n tar'et is in +eepin' -it& Section 752 -o#,d appear to ta+e p,ace ,ar'e,y -it& t&e Department of 4#stice and t&e ffice of t&e Director of 1ationa, 3nte,,i'ence as t&e responsi$,e departments of t&e e7ec#tive $ranc&.

1 2

0vai,a$,e at: &ttp://---.%#stice.'ov/a'/readin'room/'#ide,ines.pdf. 0ttorney Genera,Bs G#ide,ines for Domestic >B3 perations6 p. 3E)366 provide t&at @KtL&e >B3 s&a,, s&are and disseminate information as re=#ired $y stat#tes6 treaties6 "7ec#tive rders6 Presidentia, directives6 1ationa, Sec#rity Co#nci, directives6 9ome,and Sec#rity Co#nci, directives6 and 0ttorney Genera,)approved po,icies6 memoranda of #nderstandin'6 or a'reements@. GS/np DG D 2B 22

16987/13 011"2

&818

E>e3u*.ve overs.0,*

"7ec#tive Branc& oversi'&t p,ays a ro,e $ot& prior to t&e co,,ection of inte,,i'ence and fo,,o-in' t&e co,,ection6 -it& re'ard to t&e processin' of t&e inte,,i'ence. 8&e 1ationa, Sec#rity Division of t&e Department of 4#stice oversees t&e imp,ementation of its decisions on $e&a,f of t&e (S inte,,i'ence comm#nity. 8&ese attorneys6 to'et&er -it& personne, from t&e ffice of t&e Director of 1ationa, 3nte,,i'ence6 revie- eac& tas+in' #nder >3S0 752 Cc&ec+in' %#stification for a va,id forei'n inte,,i'ence p#rposeG addressin' over)co,,ection iss#es6 ens#rin' t&at incidents are reported to t&e >3SCD and t&e re=#est for prod#ction #nder Section 21E Patriot 0ct. 8&e Department of 4#stice and t&e ffice of t&e Director of 1ationa, 3nte,,i'ence a,so s#$mit reports to Con'ress on a t-ice)year,y $asis and participates in re'#,ar $riefin's to t&e inte,,i'ence committees of $ot& t&e 9o#se of !epresentatives and t&e Senate to disc#ss >3S0)re,ated matters.

nce t&e data is co,,ected6 a n#m$er of e7ec#tive oversi'&t mec&anisms and reportin' proced#res app,y. 8&ere are interna, a#dits and oversi'&t contro,s Ce.'. t&e 1S0 emp,oys more t&an 355 personne, -&o s#pport comp,iance effortsD. "ac& of t&e 17 a'encies t&at form t&e inte,,i'ence comm#nity6 inc,#din' t&e ffice of t&e Director of 1ationa, 3nte,,i'ence &as a Genera, Co#nse, and an 3nspector Genera,. 8&e independence of certain 3nspectors Genera, is protected $y a stat#te and -&o can revie- t&e operation of t&e pro'rammes6 compe, t&e prod#ction of doc#ments6 carry o#t on)site inspections and address Con'ress -&en needed. !e'#,ar reportin' is done $y t&e e7ec#tive $ranc& and s#$mitted to t&e >3SC and Con'ress.

0s an e7amp,e6 t&e 1S0 3nspector)Genera, in a ,etter of Septem$er 2513 to Con'ress referred to t-e,ve comp,iance incidents re,ated to s#rvei,,ance #nder "7ec#tive rder 12333.3n t&is conte7t6 t&e (S dre- t&e Gro#pBs attention to t&e fact t&at since 1 4an#ary 2553 nine individ#a,s &ave $een investi'ated in re,ation to t&e ac=#isition of data re,ated to non)(S persons for persona, interests. 8&e (S e7p,ained t&at t&ese emp,oyees eit&er retired6 resi'ned or -ere discip,ined.

8&ere are a,so ,ayers of e7terna, oversi'&t -it&in t&e "7ec#tive Branc& $y t&e Department of 4#stice6 t&e Director of 1ationa, 3nte,,i'ence and t&e Privacy and Civi, Ji$erties versi'&t Board.

8&e Director of 1ationa, 3nte,,i'ence p,ays an important ro,e in t&e definition of t&e priorities -&ic& t&e inte,,i'ence a'encies m#st comp,y -it&. 8&e Director of 1ationa, 3nte,,i'ence a,so &as a Civi, Ji$erties Protection fficer -&o reports direct,y to t&e Director.

16987/13 011"2

GS/np DG D 2B

23

8&e Privacy and Civi, Ji$erties versi'&t Board -as esta$,is&ed after 9/11. 3t is comprised of fo#r part)time mem$ers and a f#,,)time c&airman. 3t &as a mandate to revie- t&e action of t&e e7ec#tive $ranc& in matters of co#nterterrorism and to ens#re t&at civi, ,i$erties are proper,y $a,anced. 3t &as investi'ation po-ers6 inc,#din' t&e a$i,ity to access c,assified information. *&i,e t&e (S side provided a detai,ed description of t&e oversi'&t arc&itect#re61 t&e (S did not provide =#a,itative information on t&e dept& and intensity of oversi'&t or ans-ers to a,, =#estions a$o#t &o- s#c& mec&anisms app,y to non)(S persons.

&828

Co+0ress.o+4l overs.0,*

Con'ressiona, oversi'&t of inte,,i'ence activities is cond#cted t&ro#'& t&e 3nte,,i'ence Committee and t&e 4#diciary Committee of $ot& Senate and t&e 9o#se6 -&ic& emp,oy appro7imate,y 35 to A5 staff. 8&e (S emp&asised t&at $ot& Committees are $riefed on a re'#,ar $asis6 inc,#din' on si'nificant >3SC opinions a#t&orisin' inte,,i'ence co,,ection pro'rammes6 and t&at t&ere -as specific re)a#t&orisation of t&e app,ica$,e ,a-s $y Con'ress6 inc,#din' t&e $#,+ co,,ection #nder Section 21E Patriot 0ct 2.

&838

#u/.3.4l overs.0,*@ FI$C role 4+/ l.m.*4*.o+s

8&e >3SC6 comprised of e,even >edera, %#d'es6 oversees inte,,i'ence activities t&at ta+e p,ace on t&e $asis of Section 752 >3S0 and Section 21E Patriot 0ct. 3ts proceedin's are in ca(era and its orders and opinions are c,assified6 #n,ess t&ey are dec,assified. 8&e >3SC is presented -it& 'overnment re=#ests for s#rvei,,ance in t&e form of a#t&orisations for co,,ection or certifications6 -&ic& can $e approved6 sent $ac+ for improvement6 e.'. to $e modified or narro-ed do-n6 or ref#sed. 8&e n#m$er of forma, ref#sa,s is very sma,,. 8&e (S e7p,ained t&at t&e reason for t&is is t&e amo#nt of scr#tiny of t&ese re=#ests $y different ,ayers of administrative contro, $efore reac&in' t&e >3SC6 as -e,, as t&e iterative process $et-een t&e >3SC and t&e administration prior to a >3SC decision. 0ccordin' to t&e (S6 >3SC &as estimated t&at at times appro7imate,y 2EO of app,ications s#$mitted are ret#rned for s#pp,ementation or modification.

1 2

See Semi)0nn#a, 0ssessment of Comp,iance. 3n addition6 t&e Con'ressiona, committees are provided -it& information from t&e >3SC re'ardin' its proced#res and -or+in' met&odsG see6 for e7amp,e6 t&e ,etters of >3S0 Co#rt Presidin' 4#d'e !e''ie *a,ton to Senator Jea&y of 29 4#,y 2513 and 11 cto$er 2513. GS/np DG D 2B 2A

16987/13 011"2

*&at e7act,y is s#$%ect to %#dicia, oversi'&t depends on t&e ,e'a, $asis of co,,ection. (nder Section 21E6 t&e Co#rt is as+ed to approve co,,ection in t&e form of an order to a specified company for prod#ction of records. (nder Section 7526 it is t&e 0ttorney Genera, and t&e Director of 1ationa, 3nte,,i'ence t&at a#t&orise co,,ection6 and t&e Co#rtBs ro,e consists of confirmation t&at t&e certifications s#$mitted contain a,, t&e e,ements re=#ired and t&at t&e proced#res are consistent -it& t&e stat#te. 8&ere is no %#dicia, oversi'&t of pro'rammes cond#cted #nder "7ec#tive rder 12333.

8&e ,imited information avai,a$,e to t&e *or+in' Gro#p did not a,,o- it to assess t&e scope and dept& of oversi'&t re'ardin' t&e impact on individ#a,s in t&e "(. 0s t&e ,imitations on co,,ection and processin' app,y primari,y to (S persons as re=#ired $y t&e (S Constit#tion6 it appears t&at %#dicia, oversi'&t is ,imited as far as t&e co,,ection and f#rt&er processin' of t&e persona, data of non)(S persons are concerned.

(nder Section 7526 t&e >3SC does not approve 'overnment)iss#ed directives addressed to companies to assist t&e 'overnment in data co,,ection6 $#t t&e companies can nevert&e,ess $rin' a c&a,,en'e to a directive in t&e >3SC. 0 decision of t&e >3SC to modify6 set aside or enforce a directive can $e appea,ed $efore t&e >3S0 Co#rt of !evie-. Companies may contest directives on 'ro#nds of proced#re or practica, effects Ce.'. disproportionate $#rden or depart#re from previo#s ordersD. 3t is not possi$,e for a company to mo#nt a c&a,,en'e on t&e s#$stance as t&e reasonin' of t&e re=#est is not provided.

>3SC proceedin's are non)adversaria, and t&ere is no representation $efore t&e Co#rt of t&e interests of t&e data s#$%ect d#rin' t&e consideration of an app,ication for an order. 3n addition6 t&e (S S#preme Co#rt &as esta$,is&ed t&at individ#a,s or or'anisations do not &ave standin' to $rin' a ,a-s#it #nder Section 7526 $eca#se t&ey cannot +no- -&et&er t&ey &ave $een s#$%ect to s#rvei,,ance or not1. 8&is reasonin' -o#,d app,y to $ot& (S and "( data s#$%ects. 3n ,i'&t of t&e a$ove6 it appears t&at individ#a,s &ave no aven#es for %#dicia, redress #nder Section 752 of >3S0.

Clapper # A(nesty International6 4#d'ment of 26 >e$r#ary 25136 E68 (. S. C2513D GS/np DG D 2B 2E

16987/13 011"2

'8 C1D

$U99ARA OF 9AI FI %I 7$ (nder (S ,a-6 a n#m$er of ,e'a, $ases a,,o- ,ar'e)sca,e co,,ection and processin'6 for forei'n inte,,i'ence p#rposes6 inc,#din' co#nter)terrorism6 of persona, data t&at &as $een transferred to t&e (S or is processed $y (S companies. 8&e (S &as confirmed t&e e7istence and t&e main e,ements of certain aspects of t&ese pro'rammes6 #nder -&ic& data co,,ection and processin' is done -it& a $asis in (S ,a- t&at ,ays do-n specific conditions and safe'#ards. t&er e,ements remain #nc,ear6 inc,#din' t&e n#m$er of "( citi?ens affected $y t&ese s#rvei,,ance pro'rammes and t&e 'eo'rap&ica, scope of s#rvei,,ance pro'rammes #nder Section 752.

C2D

8&ere are differences in t&e safe'#ards app,ica$,e to "( data s#$%ects compared to (S data s#$%ects6 name,y: i. Co,,ection of data pertainin' to (S persons is6 in princip,e6 not a#t&orised #nder Section 752. *&ere it is a#t&orised6 data of (S persons is considered to $e @forei'n inte,,i'ence@ on,y if necessary to t&e specified p#rpose. 8&is necessity re=#irement does not app,y to data of "( citi?ens -&ic& is considered to $e @forei'n inte,,i'ence@ if it relates to t&e p#rposes p#rs#ed. 8&is res#,ts in ,o-er t&res&o,d $ein' app,ied for t&e co,,ection of persona, data of "( citi?ens. ii. 8&e tar'etin' and minimisation proced#res approved $y >3SC #nder Section 752 are aimed at red#cin' t&e co,,ection6 retention and dissemination of persona, data of or concernin' (S persons. 8&ese proced#res do not impose specific re=#irements or restrictions -it& re'ard to t&e co,,ection6 processin' or retention of persona, data of individ#a,s in t&e "(6 even -&en t&ey &ave no connection -it& terrorism6 crime or any ot&er #n,a-f#, or dan'ero#s activity. versi'&t of t&e s#rvei,,ance pro'rammes aims primari,y at protectin' (S persons. iii. (nder $ot& Section 21E and Section 7526 (S persons $enefit from constit#tiona, protections Crespective,y6 >irst and >o#rt& 0mendmentsD t&at do not app,y to "( citi?ens not residin' in t&e (S.

16987/13 011"2

GS/np DG D 2B

26

C3D

:oreover6 #nder (S s#rvei,,ance pro'rammes6 different ,eve,s of data protection safe'#ards app,y to different types of data Cmeta)data vs. content dataD and different sta'es of data processin' Cinitia, ac=#isition vs. f#rt&er processin'/ana,ysisD.

CAD

0 ,ac+ of c,arity remains as to t&e #se of ot&er avai,a$,e ,e'a, $ases6 t&e e7istence of ot&er s#rvei,,ance pro'rammes as -e,, as ,imitative conditions app,ica$,e to t&ese pro'rammes. 8&is is especia,,y re,evant re'ardin' "7ec#tive rder 12333.

CED

Since t&e orders of t&e >3SC are c,assified and companies are re=#ired to maintain secrecy -it& re'ard to t&e assistance t&ey are re=#ired to provide6 t&ere are no aven#es6 %#dicia, or administrative6 for eit&er "( or (S data s#$%ects to $e informed of -&et&er t&eir persona, data is $ein' co,,ected or f#rt&er processed. 8&ere are no opport#nities for individ#a,s to o$tain access6 rectification or eras#re of data6 or administrative or %#dicia, redress.

C6D

;ario#s ,ayers of oversi'&t $y t&e t&ree $ranc&es of Government app,y to activities on t&e $ase of Section 21E and Section 752. 8&ere is %#dicia, oversi'&t for activities t&at imp,y a capacity to compe, information6 inc,#din' >3SC orders for t&e co,,ection #nder Section 21E and ann#a, certifications t&at provide t&e $asis for co,,ection #nder Section 752. 8&ere is no %#dicia, approva, of individ#a, se,ectors to =#ery t&e data co,,ected #nder Section 21E or tas+ed for co,,ection #nder Section 752. 8&e >3SC operates e- parte and in ca(era. 3ts orders and opinions are c,assified6 #n,ess t&ey are dec,assified. 8&ere is no %#dicia, oversi'&t of t&e co,,ection of forei'n inte,,i'ence o#tside t&e (S #nder "7ec#tive rder 123336 -&ic& are cond#cted #nder t&e so,e competence of t&e "7ec#tive Branc&.

0nne7es: Jetters of ;ice)President ;iviane !edin'6 Commissioner for 4#stice6 >#ndamenta, !i'&ts and Citi?ens&ip and Commissioner Ceci,ia :a,mstr<m6 Commissioner for 9ome 0ffairs6 to (S co#nterparts

16987/13 011"2

GS/np DG D 2B

27

16987/13 011"2

GS/np DG D 2B

28

16987/13 011"2

GS/np DG D 2B

29

16987/13 011"2

GS/np DG D 2B

35

16987/13 011"2

GS/np DG D 2B

31

////////////////

16987/13 011"2

GS/np DG D 2B

32