Breaking News: I Was (Probably) the Subject of Incidental Collection

Paging Devin Nunes: You'd better get yourself over to the White House to brief the President. Get this: The FBI is engaged in a pattern of incidental collection of information on US persons in the course of routine cybersecurity investigations. What's more, when agents do this collection, they are actually calling the US persons with threatening warnings.

Sound scary? Disturbing? Scandalous?

Hardly.

In fact, given all the public hoohah recently over incidental collection, I'd actually like to take a moment to thank the FBI for a recent incident of what appears to be incidental collection of communications about, well, me.

Several weeks ago, a few days after President Trump accidentally tweeted a Lawfare article I had written (I'm honestly not sure if the timing was a coincidence or not), I received a call from the FBI warning me that I was now the target of a spear-phishing operation and that I should take whatever steps I hadn't already taken to secure my accounts. The agent who called me was vague. He couldn't tell me much. And so I don't know for sure that the bad actor is abroad or that the information about this bad actor came as a result of surveillance. So yes, it's possible that this was some domestic identity theft ring, one of whose members had flipped and had delivered a list of targets that for some reason included me. Possible, I suppose, but not very likely. The vagueness and secrecy was much more consistent, at least in my judgment, with the news that I was on someone's target list having come from some kind of surveillance against some kind of target, probably but not certainly abroad.

Assuming that's the case—that the FBI was surveilling some cyber bad actor whose list of intended targets just happened to include me right after President Trump just happened to have tweeted a Lawfare post—then I would be an example of "incidental" collection, an example that is actually very similar to the collection about which Devin Nunes is reaching for the smelling salts with respect to the Trump transition. That is, people under presumably lawful surveillance had talked about me or written my name down, and the FBI had collected this information and was not using to take appropriate action: to wit, reporting it to me so that I could protect myself.

This surveillance might have been simple Title III surveillance under domestic criminal authorities. It might have been intelligence surveillance under either FISA or Executive Order 12333. Either way, information about me appears to have gotten swept up in collection targeted against others. Sound familiar?

It should. Compare it to the New York Times's account of the material that has so upset Nunes: "The intelligence reports consisted primarily of ambassadors and other foreign officials talking about how they were trying to develop contacts within Mr. Trump’s family and inner circle before his inauguration, officials said."

Exactly what has upset Nunes about this material is a bit of a moving target. Sometimes, it seems to be the fact of the unmasking of officials. Sometimes, it seems to be the fact of the incidental collection itself, with the implication being that the collection was some kind of reverse-targeted surveillance of the Trump transition itself. That's certainly the suggestion in Trump's own comments, the most recent of which was this tweet today: