Periodically, we read stories criticizing the intelligence community for lacking commitment to privacy, the constitution and the rule of law. While the IC has rightly received its share of criticism about certain programs, I’d like to provide a perspective that’s not often covered. And given a recent article in The Privacy Advisor aiming to demystify the Office of the Director of National Intelligence, this seemed like an opportune time to demystify the privacy rubric built into the DNI’s National Counterterrorism Center.

I should note that until late 2015, I served as the civil liberties and privacy officer for NCTC, whose mission is to “lead and integrate the national counterterrorism (CT) effort ... providing terrorism analysis, ... and driving whole-of-government action to secure our national CT objectives.” The job of a CLPO is to ensure that civil liberties and privacy considerations are properly integrated into an IC agency’s activities, analogous to that of a chief privacy officer (frequently associated with non-IC agencies).

My first formative experience dates back to Dec. 25, 2009, two weeks after I joined the IC. It was on that day that the attempted bombing of a Detroit-bound airline by Umar Farouk Abdullamutallab (also known as the “underwear bomber”) highlighted shortcomings in our intelligence apparatus. One of those shortcomings related to NCTC’s then-current attorney general guidelines.

These guidelines are an IC agency’s implementation of Presidential Executive Order 12333, which sets forth mandatory requirements for how the agency will protect civil liberties and privacy in the data it collects, retains and disseminates. Specifically, the NCTC's attorney general guidelines in effect at the time allowed NCTC to retain data sets for up to six months.

While six months may seem like a lot of time, there were times that NCTC was barely able to make the data available for analysts to review before it was time to delete it. It was therefore determined that extending data retention periods for “up to five years unless a shorter period is required by law ... ” was the solution. This was not without its detractors, however, as the concern was that NCTC would always look to maintain the data for the full five-year period. Yet, in practice, this was not the case. Indeed, there were times when we affirmatively countered with a shorter retention period than offered by the data owner; not because a “statute, executive order, or regulation” required shorter retention, but simply because it was the right thing to do.

Aside from extending retention periods, the vast majority of our time was spent integrating civil liberty and privacy protections into these guidelines. During that time, we created “baseline safeguards” designed to provide a base level of privacy protection for all data sets and “enhanced safeguards” to address unique sensitivities of more privacy-sensitive data sets. We also placed restrictions on onward dissemination, created a number of oversight and transparency mechanisms, etcetera.

The point of this history is that privacy and civil liberties principles were integral to these guidelines from day one (called privacy by design), and my office was involved in a meaningful and substantive way throughout. Yet, when news of NCTC’s new guidelines for attorneys general was reported by The Wall Street Journal’s Julia Angwin, there was public outcry and misunderstanding, both within the U.S. as well as the European Union. 

For me, this highlighted the level of mistrust and misperception of the IC, which continues today. Unfortunately, public discourse is not necessarily intuitive to a community that lives and dies on secrecy (or the absence thereof). Likewise, there are some in the IC who believe that engaging in such stories is counterproductive because this merely extends the news cycle (a perspective not well suited to a world where stories endure forever online). 

Nonetheless, we tried changing the dynamic by undertaking a comprehensive transparency effort. For example, a common critique is that CLPOs are either rubber stamps in their agency or are ignored by the agency — either way, ineffective as privacy watchdogs. But by making NCTC’s 2015 AGG Annual Report public for the first time, everyone could see the comprehensive oversight by NCTC CLPO and the fact that every mistake, whether by human error, a “script/coding error,” or a “technical failure,” is reported, tracked and reviewed as a compliance incident. In fact, in my more than four years as NCTC’s CLPO, I never once found a compliance incident committed with intent to circumvent a law or rule. More often, what I found was simple human error and, on a couple of occasions, acts of good intention translated into poor judgment.

The same holds true for other areas of work overseen by my office, nowhere more so than in the realm of First Amendment speech. When my office first stood up in 2011, we reviewed about a dozen analyst-authored articles (“products”) that year, ensuring that they complied with civil liberty and privacy requirements and did not focus solely on First Amendment protected activity. As our office integrated into NCTC’s fabric, NCTC leadership insisted on CLPO reviewing all unclassified products, growing our work to an average of a dozen or so per week.   

Yet, there’s only one instance when we were unable to find a way forward, resulting in our pulling the unclassified piece. Even in that instance, however, the problem was not an inappropriate focus on constitutionally protected speech. Rather, the problem was that despite strong evidence of terrorist activity, the terrorism links were not clear after removal of the classified sources — a criticism many heard in late 2016, when the IC released its unclassified assessment of Russian interference with our elections.

So what does all of this mean for the privacy practitioner who may need to address concerns when negotiating with counterparts domestically and abroad?

First, when providing data to the U.S. government, the public should feel confident that the privacy restrictions placed on data at collection are recognized and honored by the IC. Likewise, people should have confidence that there are comprehensive compliance programs in place to ensure that privacy restrictions do not simply disappear when data is passed to an intelligence agency. 

Second, people should familiarize themselves with the rigorous, multilayered oversight conducted of IC activity, in order to dispel the perception of an overreaching, privacy insensitive community.

There are actually numerous oversight mechanisms to ensure the preservation of privacy, starting with Executive Order 12333 (and agency-specific attorney general guidelines, followed by internal CLPO and general counsel) offices, as well as external executive branch oversight, including IC Inspector General’s Offices, the Department of Justice, and the Privacy & Civil Liberties Oversight Board.

Then, there is also oversight by the legislative branch, including numerous congressional committees, to include the Senate and House Select Committees on Intelligence. And finally, the judicial branch, to include the FISA Courts.

In short, our layers of oversight, by all three branches of government, are second to none.

Finally, given evolving areas such as online speech and the lack of historical precedent and guidance, CLPOs would benefit greatly from private sector input. For example, IC agency advisory boards — used for gathering outside perspectives — would benefit greatly from recruiting members adept in evolving technology, such as social media, as well as people with privacy and CLPO experience.

At the end of the day, people should confidently inform their counterparts that while not as prominent as CPOs, almost every IC agency has a CLPO, a privacy office, or a civil rights/civil liberties office working to ensure that access to and use of data is accorded robust privacy protection. Indeed, people should take comfort, given the current furlough environment, in knowing that during the 2013 furlough, my position was designated as “essential” precisely because of the importance placed on the CLPO in the IC.

photo credit: deepakiqlect Artificial Intelligence - Resembling Human Brain via photopin (license)