The US Drug Enforcement Agency is still collecting phone records from a major telecom company as part of a surveillance program, but the agency hasn't sufficiently spelled out why it has the legal authority to do so, according to a report made public Thursday by the Justice Department's Office of the Inspector General.
The surveillance program, referred to as Program C in the report, appears to be Project Hemisphere, which was first reported on in 2013 by The New York Times. The Times reported that AT&T is the telecom company supplying phone records to the DEA.
The surveillance program asks the telecom provider to send it phone records for specific targets. The telecom provider maintains a bulk phone record database from which it can pull specific records to send to the DEA. To request the records, the DEA uses an administrative subpoena, which doesn't require court review.
The IG report, earlier reported by TechCrunch, determined that the DEA hadn't thoroughly examined the legality of the program.
"We found that the DEA failed to formalize a complete and adequate legal assessment regarding its use of Program C to obtain reports and other advanced analytical information to ensure such use was lawful and appropriate," the report reads.
The report shows that concerns are live and well about overreach in government surveillance programs. The IG's recommendations also echo complaints from whistleblowers and privacy experts that federal agencies often fail to provide convincing legal rationale for programs that collect broad swathes of information on people in the US and beyond. Privacy advocates say the secrecy surrounding such programs makes it hard for the public to know whether they're legal.
In a statement, the DEA said it's committed to vetting its programs thoroughly to ensure they comply with Justice Department policies and the law.
"The DEA agrees with the OIG's recommendation for further improvement of its administrative subpoenas with respect to data collection, and has already begun enhancing these processes," the agency said.
AT&T said it cooperates with the government as required by law.
"Like all companies, we are required by law to provide information to government and law enforcement entities by complying with court orders, subpoenas, lawful discovery requests and other legal requirements," AT&T said in a statement. "In all cases, we ensure that requests for assistance are valid and that we act in compliance with the law."
The IG report also looked at the DEA's use of "parallel construction," a law enforcement technique that helps prosecutors use information obtained from secret surveillance programs without revealing how they first found the data.
Typically, investigators find another way to confirm the information, never telling criminal defendants that they used a secret surveillance program as a starting point. Advocates worry that hiding the original source of information in a criminal prosecution denies defendants their constitutionally guaranteed right to review evidence that might prove their innocence.
The IG's report said parallel construction is often appropriate, but that the DEA made some "troubling statements" in some of its training materials that might prevent agents from handing over potentially exculpatory evidence to criminal defendants.
In response, the DEA said in its statement that its conduct is consistent with the Constitution.
"Law enforcement understands its obligation to disclose exculpatory evidence obtained during the course of investigations, and our responsibility to safeguard the rights of defendants," the agency said.
Originally published March 28, 1:14 p.m. PT
Update, 1:23 p.m.: Adds background material, detail on parallel construction.