DHS is using obscure law to snoop on journalists, non-profits, unions
theguardian.com237 points by firefax 4 hours ago
237 points by firefax 4 hours ago
> In several cases, the DHS has withdrawn a 1509 summons after it was challenged in court and before a judge could rule on its legality. That may be a deliberate strategy to avoid having a judge rule on the legality of the summons.
They have a toy, they’re increasingly abusing it, then trying to dodge from it being taken away.
The thing is nobody has to comply with 1509 summons, DHS has to go to court to enforce it. A lot of the fault is on a company that complies without just ignoring it.
> The thing is nobody has to comply with 1509 summons, DHS has to go to court to enforce it.
You're not wrong, but companies such as Google make business decisions, not moral decisions. It's far easier and cheaper for them to comply, while there is basically no incentive for them to fight the summons. Especially given the current administration's proven record of taking retaliation against anyone who stands in their way.
If you want companies to behave in the interest of the general public, you need to create an incentive structure that supports that.
Wouldn't the affected individual be able to sue the provider at least in some cases? From what I understand e.g. Stored Communications Act might allow suing T-Mobile in this case, at least if the individual isn't covered by binding arbitration. And possibly even government under 18 U.S.C. §2712.
Of course then it's up to judge to determine if the request was valid or not.
>Wouldn't the affected individual be able to sue the provider at least in some cases?
And lose time and money, which they also likely don't have?
The OP contradicts your theory:
"In Fort’s case, Google did not comply with the summons for any of the accounts. The company responded to the DHS by saying it had not offered evidence of how it was related to a customs investigation."
> companies such as Google make business decisions, not moral decisions
The world is more complicated than that; they make both kinds of decisions and many decisions aren't clearly in one basket or the other. Humans don't biologically change to amoral creatures when they pull into the office parking lot (despite theories to the contrary or attempts to encourage it), nor are they absolved of human responsibility when doing things for which they are paid.
> there is basically no incentive for them to fight the summons
Ehhh, seems to me a cloud provider that wants to back up my documents, communications, photos, passkeys etc has a very strong business case for ensuring the data is as safe with them as they would be in my own home.
> They have a toy, they’re increasingly abusing it, then trying to dodge from it being taken away.
This isn't uncommon - this is how NY deals with any compelling case involving their infringing gun control statutes. If a defendant has money and no other meaningful charges, they tend to just dismiss and moot the issue rather than risk a finding of unconstitutionality.
Perfect thread to drop tmailplus. It's for journalists who can't rely on centralized systems.
Become your own tiny infra
Apparently in this case, T-Mobile caved and Google didn't:
> The DHS also sought and obtained six months of phone records for Fort from T-Mobile, which included records for more than 10,000 calls and text messages. Fort was not notified the government was seeking the records until mid-July, when government lawyers produced them to her lawyers. Fort’s lawyers wrote in a filing this week they were “stunned” to see the government had unilaterally been able to obtain a log of her communications after a judge had warned them about obtaining records about a journalist.
...
> In Fort’s case, Google did not comply with the summons for any of the accounts. The company responded to the DHS by saying it had not offered evidence of how it was related to a customs investigation.
> A Google spokesperson said the company reviews each request for data it gets to ensure it is legal and pushes back when it is too broad or doesn’t follow the correct process.
Since when were private companies part of the Judicial Branch? I don’t remember that part of the Constitution.
>Since when were private companies part of the Judicial Branch?
What part of GP's quote from the article gets you to "private companies are part of the judicial branch"? The judicial branch wasn't involved there, only the executive. All of us, private individuals or organizations, have the right to challenge any requests by the executive branch (and by the same token, unless forbidden by law we can also just voluntarily go along with its requests). The judicial branch can then rule on who is right. If the executive wants to force it then it can go to the judicial branch up front and get an actual for real warrant. If it wants to bypass judicial review, then it doesn't have the same legal force either.
Here, it asked T-Mobile and Google for a bunch of stuff on a journalist. T-Mobile said sure. Google said no, come back with a warrant.
>I don’t remember that part of the Constitution.
Might want to reread if it's been awhile for you.
I get what you're saying, but "the company reviews each request for data it gets to ensure it is legal" just sounds like something a judge should do, no?
>but "the company reviews each request for data it gets to ensure it is legal" just sounds like something a judge should do, no?
No, unless you're arguing that the government should be barred from even making voluntary requests at all? I'm not sure I'd agree with that either though, there's plenty of times where a government request really is just an honest "request" for pure info, like a poll or survey or something on how a program is working and any feedback participants want to give. Though of course it's also easy to see how things like 3rd party doctrine have expanded in effect over time and gotten badly abused, particularly in combination with other levers government has. Perhaps that doctrine should be abolished and the government shouldn't be able to make "voluntary requests" for anything that'd touch on a criminal or civil investigation (so they'd still be able to ask for surveys and the like), but that'd require some careful consideration. Or maybe there are some reasonable limits in terms of data automatically and unavoidably collected (like cellular location) vs data voluntarily shared.
Regardless however, if the government wants to compel somebody to comply, well that's literally what a warrant (or court order) is for right? If the government chooses not to involve a judge in a request for data that'd require a warrant to force, then yeah of course the private party they're asking gets to decide whether to voluntarily go along with that or not. That's the trade.
> No, unless you're arguing that the government should be barred from even making voluntary requests at all?
IMHO the third-party doctrine is an area where legislators ought to be passing laws to broaden constitutional protections, in suitably nuanced way, to keep up with the times. In the modern age, people reveal a great deal of information about themselves to third parties in the course of carrying out mundane tasks.
The idea that fourth amendment protections apply to physical mail, but not to e-mail [1] doesn't really make much sense.
Unfortunately this is the sort of thing change that really needs to come from legislators, and the legislative process isn't very effective at the moment.
[1] except for the 0.1% of people who self-host their own e-mail server in their own home
> ...but "the company reviews each request for data it gets to ensure it is legal" just sounds like something a judge should do, no?
This is assuming the first pass is before a judge. They're circumventing this by going straight to the companies, as noted by the following blurbs:
> This time, DHS utilized a different method that didn’t require approval from a judge, only a sign-off from a DHS official.
and
> It also instructed the recipients of the summons to keep it secret.
In most cases, a company's legal team will attempt to validate the legality of a request because, if they just acquiesce, it becomes a legal problem for them to turn over data without that validation of legality - which can have financial repercussions.
In those cases, the government most often will not (and cannot) step in to save them from the financial blowback (i.e.: the government got what it wanted; it's not their problem, now).
Company legal departments should absolutely review requests and make sure they're legal before handing over data.
If they suspect the request isn't legal, they can refuse it, and then it can be escalated to a judge.
Are you suggesting that every request should go through a judge before it gets sent to a company? That would be great, but even then, different judges interpret laws differently, so a company will still do a legal review before deciding whether or not to comply.
An extremely cosy relationship between large corporations and a government.
I've seen this somewhere before and I can't quite put my finger on where I saw it.
ah, but the boot is off of a16z’s neck, so it’s all worth it!
Note that the DHS budget ($100bn) is sufficient to provide healthcare to every uninsured child, and about half of what it would cost to provide universal healthcare to every American under 18 at the CMS average rate.
At the end of the day this sort of wastefulness eventually attracts attention.
Medicare alone costs $1.21 Trillion, I find that extremely hard to believe.
> Medicare alone costs $1.21 Trillion
To cover 70.5 million seniors [1]. $17k per senior.
“Per person personal health care spending for the 65 and older population was $22,356 in 2020, over 5 times higher than spending per child ($4,217) and almost 2.5 times the spending per working-age person ($9,154)” [2].
80 million under 19 [3] at that rate comes to about $400bn. And most efficiency estimates would take at least a third off that when we eliminate redundant billing processes.
Given 6% of children lack health insurance, we could cover them for about $24bn. Less than Trump’s war in Iran has cost [4].
[1] https://data.cms.gov/summary-statistics-on-beneficiary-enrol...
[2] https://www.cms.gov/data-research/statistics-trends-and-repo...
[3] https://www.cms.gov/data-research/statistics-trends-and-repo...
Use small platforms where possible. Oh wait, small platforms get sanctioned as terrorist organisations. I've been thinking I need to get my own IP range, but that requires exposing a lot of personal information.
19 USC 1509 – dealing with customs imports
I like 2D, that one's nice. So in total it reads (ellipses for brevity):
"In any investigation or inquiry conducted for the purpose of ascertaining the correctness of any entry, for determining the liability of any person for duty, fees and taxes due or duties, fees and taxes which may be due the United States, for determining liability for fines and penalties, or for insuring compliance with the laws of the United States administered by the United States Customs Service, the Secretary (but no delegate of the Secretary below the rank of district director or special agent in charge) may ... summon, upon reasonable notice ... any other person he may deem proper".
And of course, one could argue that it's important to just double check and determine (note it doesn't say suspect, just determine) if someone has entered the country legally, ever, and paid all import taxes, ever. In order to do that, you'd need to see a lot of records. And of course the result can be "nope, they're all good". You don't need to have a good-faith suspicion of these things, just that you have a need to determine these things.
How many laws like this are on the books? In the same way that LLMs are fantastic at finding bugs, what other bugs are in the U.S. Code or similar that LLMs could find? We've been living in a world for a long time where things like this wouldn't be exploited, or maybe even noticed, but now it feels like these vulns are being hoarded and used like software exploits.
It also requires a judge who is willing to interpret the rule the way you want. Law doesn’t execute deterministically like code does.
No that’s the whole point of this article. In this case, the private companies being summonsed are acting as both judges and data holders being summonsed. This doesn’t go to a judge to approve. So in this case, the point they’re making is most private companies just roll over at the sight of a summons, so the law absolutely executes deterministically (ok, not truly deterministic, but you’re relying on the judgement of private companies and their legal teams who don’t want that heat from the government, so, close enough).
“About a month after the judge’s ruling in late February, the government said it was withdrawing the request.
But officials hadn’t given up on getting the data.
Less than a month later, the DHS served Google with a different request for the YouTube information. This time, DHS utilized a different method that didn’t require approval from a judge, only a sign-off from a DHS official. It served Google an administrative summons citing an arcane provision of federal law – 19 USC 1509 – dealing with customs imports. The provision gives the DHS broad power to inspect records in order to determine whether duties and taxes are being correctly levied on imported items. It also instructed the recipients of the summons to keep it secret.”
With a gag order as a bonus! No judge required!
Keeping it secret isn't part of that law. And they don't have to turn over anything not relevant to the payment of duties and taxes.
So that also requires all judges who a case could be brought to about this, declaring that they don’t have jurisdiction. It’s still a choice made by the judges.
Granted someone does have to actually file a suit
edited title for length
Welcome to the dictatorship.
One has to wonder whether all Trump voters wanted this. I don't think so.
[dead]
I'm surprised they still need a law.
Friends don't let friends use SMS/MMS