Something is changing in our country, and most
people feel it before they can explain it. Good
evening, I'm Peter Mina, a civil rights and federal
employment law attorney, as well as a former
Department of Homeland Security official who
worked to integrate civil rights and civil liberties
protections in the department's national security
programs, and you are listening to the Steady
State Sentinel from the Steady State. We are
facing an existential threat. Growing autocracy
in the United States. The steady state sentinel
is a place where we and our distinguished guests
use our national security expertise to discuss
and analyze the decisions and acts of this administration
that feed that autocratic slide and threaten
to supplant the pillars of our constitutional
democracy. Today, we're talking with Alex Joel,
the senior project director and resident adjunct
professor at the American University Washington
College of Law. Professor Joel leads the Privacy
Across Borders Research Initiative, which is
part of the law school's Tech, Law, and Security
program. He is conducting research, developing
programming, and teaching courses focused on
the intersection between the law, national security,
technology, and privacy. Prior to coming to American,
Professor Joel spent nearly two decades in the
intelligence community. In 2002, he joined the
Central Intelligence Agency's Office of General
Counsel. Subsequently, in 2005, he moved to the
Office of the Director of National Intelligence,
or ODNI, where he served as a civil liberties
protection officer for 14 years, reporting directly
to five different directors of national intelligence.
And starting in 2015, he simultaneously served
as the ODNI's chief transparency officer. And
with that, welcome to the show, Alec. Thank you,
Peter. Thank you for having me. Thanks so much
for coming. So why don't we start off by having
you talk to our audience a little bit about what
your current work is at American University,
and in particular, what the Privacy Across Borders
initiative is. Yes, thanks. I've been teaching
at American universities at the law school for
the last five years or so. I teach national security,
surveillance, and secrecy, as well as issues
relating to technology and privacy around the
world. And with the Privacy Cross Borders Research
Initiative, we're looking at data flows and technology
as it's required for our society and our economies
around the world, focusing on cross -border data
flows and issues of trust relating to how governments
access personal data held by companies for national
security or law enforcement purposes, as well
as how AI is governed and used in ways that implicate
national security and privacy at the same time.
Well, those issues couldn't be more salient than
right now. And so I want to kind of start a little
bit at your beginnings. What led you to the,
you know, ultimately very distinguished career
you had in intelligence and national security?
And then, you know, within that, what led you
to a particular focus on privacy, tech, and then
certainly civil liberties, particularly at your
role at ODI? Okay, well, we're going to go back
in time a little bit since you asked for my beginnings.
So I graduated from law school and I served four
years as an Army JAG. And after I got out of
the Army, I joined a law firm and I did technology
outsourcing work, sort of technology transactional
work. And then I joined Marriott International
in -house and I was their privacy. and e -commerce
and new business ventures lawyer for seven years.
And I was super happy in that job. That was a
great place to work. And then 9 -11 happened.
So that changed everything for me. So with 9
-11, I decided I needed to reenter public service.
And I was asking around, trying to figure out
how I could best contribute. And I was very interested
already at the time in terms of the intersection
of privacy and technology. And now what could
we do with national security? I was also concerned
about civil liberties. and about making sure
that our Muslim American friends weren't being
stigmatized and those kinds of issues. And a
friend of mine who had been at the FBI for a
few years strongly recommended that I apply to
the CIA. So I did in October 2002, 2001. And
I started at the CIA in 2002. And I spent three
years there. And a lot of the issues that I was
dealing with at the agency. How do we apply the
rules and constraints that grew out of the church
committee hearings in the 1970s that are embodied
in an executive order, Executive Order 12333?
How do we apply those rules as well as deal with
conflicting laws around the world that might
impact the ability to obtain information to prevent
another terrorist attack? And when they stood
up the Office of the Director of National Intelligence,
as your audience may know, that was in the Intelligence
Reform and Terrorism Prevention Act of 2004,
they stood it up. Director Negroponte was the
first DNI. He was sworn in in April 2005. And
I was detailed over from the CIA to the DNI,
sort of in that first wave of lawyers to help
stand it up. And I was there in June of 2005.
And I was named the Civil Liberties Protection
Officer pretty immediately as the interim to
fulfill that role while we were looking for a
permanent person. And Director Negroponte decided
to make me the full -time Civil Liberties Protection
Officer by the end of 2005. And so that's sort
of the... the the story there and i was i did
it for 14 years i i had you know occasion to
think about doing something different in the
intelligence community but i didn't have an interest
in that i i've always been both intellectually
fascinated and sort of emotionally motivated
and committed to this idea that we can do both
we must be able to do both we must be able to
protect the nation's security and at the same
time protect people's privacy and civil liberties
and i still believe that to be true that Yes,
there are tensions between the two goals, obviously,
but there are ways to enable our agencies to
carry out their national security mission and
at the same time constrain them from going too
far to make sure that they don't become themselves
a threat to our freedoms and our democracy. Well,
I actually want to ask you a little bit more
about that because I think that's at the core
of... you know, trying to make sense of what's
happening right now. How do you I mean, use the
word tension. And I've certainly heard that from
others over the years. You know, do you see it
as sort of this push and pull? Or do you think
as I think I, you know, sort of pick up from
your answer, that these, you know, really important
foundational concepts can actually coexist? I
think they have to coexist. I mean, there's,
there's clearly potential trade offs. Obviously,
if I read if I get an order to read somebody's
emails, that person has lost privacy to to the
government. But that's where you have the internal
and external checks and balances. So the way
I think about it, and I've done a lot of work
with other countries as well and spoken to different
oversight entities from around the world and
how they think about. This balance that has to
be achieved between national security and protecting
people's privacy. The way I think of it is that
a legal framework in a democracy has to do two
things simultaneously and equally well. The legal
framework has to authorize the intelligence agencies
to do things to protect national security. What
kinds of things? It typically is intrusive things.
And it also are intrusive measures that are taken
in secret, because if it's fully transparent,
then the. targets the bad guys will know what
you're doing and we'll try to avoid it right
so um the way i put it is that a fully in effect
a fully transparent intelligence service would
be fully ineffective um so you're doing secret
intrusive things and at the same time that legal
framework has to constrain the agencies from
going too far it has to do both and so it's really
it's really finding that way to do both and and
the other thing i would say is i remember early
on in my tenure we there were a lot of arguments
about the balance metaphor like is this Is this
the balance? Which one outweighs the other? And
I was always a proponent of saying that the balance,
the goal is to keep the scale balanced, right?
You want to do things on the national security
side of the scale, but you have to counterbalance
it with things on the civil liberties protection
side of the scale, including, you know, cutting
back on some national security measures that
aren't really necessary. So that's been my...
The metaphor that I've always felt comfortable
with, but now with so many changes in the way
technology moves so quickly and world events
change and policies change and people change,
I've really come to feel like it's always going
to be dynamic. It's not static. You never achieve
a balance and say, we're done. As the world changes,
as things change, you have to adjust, and it's
always going to be shifting in a constant dynamic
motion, and that's okay. So there will be periods
where things seem to be out of balance, but as
long as the system is trying to correct it, it's
always correcting and trying to find that balance.
That's the key. Makes complete sense. And actually,
as we continue this conversation, I want to talk
a little more with you about the civil liberties
component of that. We'll talk a lot about privacy.
But again, given the moment that we're in, there
have been lots of discussion and questions and
ultimately litigation over the intersection of
national security and civil liberties. But for
folks that don't really understand sort of the
legal framework around these issues, one of the
obviously foundational statutes in this area
is the Privacy Act. And so I was wondering if
you could kind of give our listeners just a basic
description of, you know, what is the Privacy
Act and what is it designed, what and who is
it designed to protect? Yeah, the Privacy Act
is an amazing statute. I think a lot of people
feel like it's outdated and needs to be amended.
And I certainly would agree that it could use
a refresher, a refresher. But it was enacted
in 1974. So sort of we were in the middle of
press disclosures about, you know, Watergate
and about, you know. Press reporting was already
coming out about some of the intelligence abuses
in the early 70s and the 60s. And so in response
to that, Congress and then on top of that, there
was a landmark report by the Department of Health,
Education and Welfare of all departments that
was very concerned about the centralization of
data of Americans in these large, big mainframe
computers that governments were operating to
process people's information. And so out of that
report, that was sort of raising the alarm about
the power of these 1970s era mainframe computers.
And the notion that you have all of this centralized
data that is being accessed and processed by
government technocratic experts who may be separated
from the people that the data pertains to and
aren't focused on the rights of those individuals,
but are focused on the... whatever the modality
was at that time to process computer information,
the report came out and recommended a series
of what we, of course, as you well know, Peter,
called the fair information practice principles.
This idea that people should know what the government
has on them and should be able to access that
information and correct it if necessary or ask
that it be removed if it wasn't collected in
an appropriate way. And the idea that the information
should be used in general for the purpose that
the agency had when it collected the information.
So if it goes, if I interact with an agency and
it says fill out this form because we need it
to process for Social Security benefits, well,
then my expectation is that that's exactly what
the agency will do. So those concepts were embodied
in a messy way, like it's in a very technical
way in the Privacy Act of 1974. And the Privacy
Act applies. government -wide. There are exemptions
from certain of the provisions to deal with classified
information and with national security and law
enforcement. So that's clear. Like, you can't
have a terrorist submit a request to the CIA
and say, give me access to my file, right? So
the CIA is going to say, we can neither confirm
nor deny that we have anything on you. Properly
so. So there are exceptions to the Privacy Act,
but I think, and it's a complicated statute,
but I would say at its core, it does A few things.
One is it requires agencies to publish the systems
of records, the databases that they have about
Americans. And so that comes out in what is called
a system of records notice. And it requires them
to receive and process requests for access to
agency records from the individuals who are covered
by those records. So if I go to the Social Security
Administration, I want to see my... the information
they have on me i'm entitled to do that under
the privacy act and they are obligated to respond
so once you have these records on americans you
have to publish a notice and you have to have
a process by which they can access the information
and the other main thing it does is that it requires
in a in this same public notice that they explain
what they're using the information for and who
has access to it so you know as you know peter
Those are called routine uses, like what is the
routine use for this data? And that's important
because in those routine uses, there will be
either, you know, they will explain to what extent
they are disclosing the data. They are sharing
the data with other agencies. And it also limits
the ability of agency employees to access the
data. That same agency, those employees must
have. a need to know to access the data so it's
not like once the agency has the data it's freely
available to everybody it's still tightly controlled
and regulated and documented and audited but
i think the privacy act continues to serve an
important purpose it's comprehensive you know
we we often criticize including myself the united
states for not having a comprehensive privacy
law and uh we all should should should modify
that we don't have a comprehensive privacy law
that applies to the private sector to the commercial
sector we do have a comprehensive privacy law
that applies to the federal government and we
were way ahead of the rest of the world in that
going back to 1974 so it's interesting because
i think there's a lot of um parallels between
1974 and the health education and welfare you
know commission or committee that was established
that looked at you know sort of this aggregation
of data and here we are more than 50 years later
and we're again talking about you know the issues
surrounding aggregation of data you know dating
back to the beginning of this administration
with doge and you know collecting social security
data and sharing it with other agencies and then
questions about whether that data was also going
to private entities whether that be basex or
companies like palantir um and so i guess you
know you alluded to it a little bit in your previous
response but You know, for the, you know, again,
the person that might not be as familiar with
these issues, what's the problem with agency
sharing information? Why in a world, you know,
for example, post, you know, 9 -11, where, you
know, some of the criticism was, you know, siloing
of information between agencies and how that
created vulnerabilities. You know, why should
we be so concerned with that now? Yeah, I'm glad
you brought up the 9 -11. example, just as a
matter of history there in terms of what we did
in that post -9 -11 period. So you're right that
a huge issue was the need to share information.
And the concern was that the 9 -11 Commission's
concern and what the report said was that the
federal government had failed to connect the
dots. So this idea that there are pieces of information
in different databases that if combined would
show the picture. Like, you know, you would see
what the terrorist plot is if you were able to
connect all the disparate pieces of data in different
databases. It's very powerful, and it's still
a concern. Like, you want to be able to make
sure that the relevant information is accessible
by the people who are charged with the mission
of protecting national security. So DHS was always
a big part of that because of the information
that DHS had, and DHS was created after 9 -11.
But at the same time, the concern in the United
States has always been with the creation of a
huge centralized database of Americans. And part
of the concern is that that would give people
with access to the database enormous power, like
the potential for abuse and misuse would have
a huge impact on how people carried out their
daily activities. That's coming at it from one
end is like, do we want a huge database where
everybody's records are all centralized and accessible
to some cadre of analysts? And this is exactly
the concern that HEW, that that report was raising,
came up with the fair information practice principles
to deal with it. So coming at it from a different
direction, it's this idea that if you interact
with a government agency and they tell you to
fill out a form for a particular purpose. Your
expectation is that your information will be
used for that purpose. If you had known something
different, you may not have applied. You may
not have provided your information. So it's this
idea that people expect certain things when dealing
with an agency to be able to go to that agency
for benefits. They don't expect that agency to
then make their information public, to provide
it to all kinds of agencies that may have different
equities and a different approach. And that's
where this idea of the requirement that if you
share it with another agency, it be for a compatible
purpose, that the purpose be compatible with
the purpose that you told the individual about
when you were originally collecting that information.
And I think that's a key protection. Now, it's
true that people talk about the Privacy Act as
being old fashioned. And what it did was it operates
in silos. Each department or agency is in its
own silo. Right. And naturally, that's going
to create information sharing issues. And is
that really the way technology works? And aren't
there other better ways of protecting privacy
than sort of having an agency keep their information
in the silo? and then go through a laborious
process under the Privacy Act to share information
with other agencies. And there probably are more
modern ways of thinking about how to do that
more effectively, but you would still need to
protect people's privacy and respect some of
the original expectations. I'll just say one
last thing is that so post 9 -11, we were really
focused on connecting dots. We were really focused
on making sure the agencies operated. more cohesively
not only inside the intelligence community but
also with other departments and agencies in the
federal government with state and local law enforcement
with foreign partners with the private sector
the idea was we we wanted to connect dots but
we went through enormous trouble to make sure
we complied with the privacy act to make sure
that the agency's routine uses supported the
sharing or if they needed a new routine use if
they needed to explain how they were now going
to be sharing terrorism -related information
with the intelligence community, that they went
through an analysis to make sure that that was
lawful under the Privacy Act. So there was no
effort by the president or by any department
or agency that I'm aware of to simply ignore,
override, or supersede those protections. It
was really a matter of how do we work within
the Privacy Act and with other laws. There's
a lot of other rules and restrictions that are
intended to protect privacy. How do we act within
those constraints? to share information better
so that we can prevent another terrorist attack.
So with that as a backdrop, and again, comparing
it to the present moment, it seems almost as
though the aggregation of data is almost being
used as a threat to American citizens. It's almost
like a cudgel to say, hey, be careful. You shouldn't
make... statements that are contrary to the mission
of an agency like dhs for example or you know
we're gonna you know track that activity you
know there's been talk of you know a database
of first amendment protesters you know people
protesting against ice for example um and so
i'm kind of wondering if i could get your you
know reaction to you know that use of information
collection and then you know sort of on the opposite
end of the spectrum you know one of the things
that i think is always uh you know attention
or requiring a balancing and you've alluded to
it in this conversation is that balance between
national security and transparency and so you
know Given that kind of maelstrom of a moment
that we're in, how do you kind of unpack those
issues in a way that makes sense to someone,
you know, unlike us, that doesn't live this every
day? Right. And you sent me links to a couple
of the articles that you're alluding to. And
I'm not I haven't studied those specific issues,
but I will say that generally speaking, what
those articles are talking about is whether.
So there's two sets of issues. Let me just sort
of unpack it a little bit. So one is one is the
right of people to peacefully protest. Right.
And so, as you well know, the First Amendment
is one of the most fiercely protected rights
in our democracy in terms of the right of speech,
petition for grievances, freedom of assembly,
freedom of religion, freedom of the press. So
those are extremely important fundamental rights.
In the 1970s, during the Church Committee hearings,
as you know, with Senator Frank Church, one of
the main concerns that came out of that was that
given all the turmoil in the 60s and 70s, we
had, you know, the Vietnam War protests going
on. We had there were domestic terrorist incidents
back in the 1970s with the weather underground
and things like that. There were it was a time
of enormous turmoil and civil rights movement
and marchers getting attacked, you know. by protesters,
counter -protesters. And so it was a time of
great turmoil. And even in that time of turmoil,
coming out of that was a reinforced concern for
protecting the First Amendment rights of Americans.
And one of the big issues that came out of those
hearings was that intelligence agencies seem
to have been turning their focus inward toward
those protesters in ways that would chill and
restrict their abilities to exercise their First
Amendment rights. And so the court spoke up about
that. There's a famous case called the Keith
case that is exactly about those concerns. Coming
out of the church committee hearings, President
Ford issued an executive order, which was then
reissued, superseded by one that President Carter
issued. And then President Reagan superseded
Carter's with what we now know as Executive Order
12333. And then we also mentioned the Privacy
Act previously. Those were designed in part to
constrain the government from essentially conducting
domestic surveillance on its own people in a
way that would constrain their freedoms and their
rights. And as you know, the Privacy Act has
a provision that says that you cannot maintain
a record of an American based solely on their
exercise of First Amendment rights. And so the
idea that. that the government would be looking
at everybody who goes to a protest is, I think,
a huge issue given that history and given the
intent of those rules. The other thing I'll say,
you know, obviously, if there is violence, if
there is unlawful conduct, if there's criminality,
be it in a protest or anything else, then yes,
that would be a legitimate reason for looking
at somebody. Now, that's sort of on the First
Amendment side. There's the aggregation of data
side, which doesn't necessarily have to do with
the First Amendment. It could, you know, in the
situation you posit, if they're looking up all
the protesters in a large centralized database
to try to find something on them that they can
use to get people in trouble that they don't
want to be out there protesting, you know, so
they're going to find information in federal
databases to use. against them, and again, I
haven't been following that specific issue, so
I don't know, then of course that's a concern
as well. And that would be an inappropriate use
of access to those databases. So in other words,
what is commonly thought of as phishing expeditions.
Again, if you have a specific articulable reason
under the law for looking at somebody, for example,
commissioned of a violent act or planning a criminal
act, then that would be a valid reason to look
it up. So I think, you know, as I hear you, you
know, one of the things that I, you know, that
comes to mind immediately is, you know, public
efficacy in our, you know, national security
and intelligence activities. And if the belief
is that, oh, you know, the government might use,
you know, the information that it collects, you
know, in a way that seems inconsistent with.
You know, whether it's the First Amendment or
the Privacy Act or other civil liberties and
privacy protections, you know, maybe that diminishes
the overall confidence in the national security
enterprise. And so I'm also wondering, you know,
as sort of an offshoot of that, you know, how
do you see the impact or, you know, I guess the
presence or lack thereof of transparency sort
of in that, you know, question of public efficacy?
I mean, particularly when you think about members
of the intelligence community. like NSA that
used to be called no such agency. So, you know,
how do you how do you see that? Yeah. So one
of the as you pointed out when you were going
over my bio, one of my titles when I was in the
government was chief transparency officer for
the director of national intelligence. So transparency
was a big push of ours following the Snowden
disclosures. I had always wanted more transparency
because I felt. It was very difficult to get
public trust to get one to get one of your issues
if you couldn't explain to the public what it
was that we were doing and how you were doing
it. So I had always felt that that that frustration
and not being able to explain how our rules work
and not only make them public, but sometimes,
you know, several sets of rules at the time were
public, not not nearly as many as are now. But
not only making the document public, but explaining
it. Right. So making sure you've met. with people
and went over it and made sure they understood
it, or you put information out there that explained
it more clearly. So following the Snowden disclosures,
even though I had been quite proud of our framework
for protecting privacy and civil liberties, it
was always secret. A large part of it was classified
and not available to the public. And then after
the Snowden disclosures, we realized, well, we
really need to make a stronger push. So coming
out of that, the intelligence community committed
to what is still in effect and it's still posted
on the dni website the principles of intelligence
transparency uh for the intelligence community
and these were organizing principles to make
sure that the agencies were able to lean into
providing more information to the public about
how what their authorities were how they interpreted
them how they used them what their compliance
with those authorities looked like what were
the compliance incidents and also how the intelligence
community operates how it does its job and uh
that became you know a cause for me. That was
something that I really championed and felt very
deeply about the importance of that. And we would
meet with advocates, including organizations
that were suing us. And I know that DHS was able
to do that much more. I know that your former
office had great relationships with... advocacy
groups. Absolutely. You know, super important
just to have those relationships. And I think
if in the absence of that, if you don't have
transparency, then people are naturally suspicious.
And it's a way of figuring out, well, you know,
you've mentioned these stories about databases.
Well, what are the databases? What are they doing
with the data? You know, the more transparent
you are, the better. The way I would put it is
that if I'm proud, we should feel be proud of
what we're doing. And unless there's a reason
to keep it hidden, for example, classified information
sources and methods, you know, a lot of active
law enforcement litigation. There are clearly
reasons, a lot of reasons to keep a lot of information,
a lot of detailed information secret. But generally
speaking, what you know, what we what we're doing
with data, how are we collecting it in general?
What are the protections? You should be proud
of what you're doing and there should be no embarrassment
in explaining it and what you're what you're.
what you are keeping secret are things that could
hamper operations, but you're not, you're not
even tempted to keep something secret because
you're embarrassed about it. Right. If you are
embarrassed about something, fix it, like do
something about it, fix it. So you're not embarrassed
about it anymore. Right. Or even if you're thinking
about it in advance, if you can't explain it,
maybe don't do it. Right. Exactly. Well, you
know, Alex, you've been so kind and generous
with your time. You know, I really appreciate
it. And I hope I know our audience will as well.
It's been incredibly educational. I feel like
we could talk about so many more issues in the
space. And so we'd love to have you back whenever
time allows. Is there anything that you'd like
to, you know, tell people, you know, you're working
on right now? Obviously, you know, we recognize
the you know privacy across borders initiative
but um if there's anything else you wanted to
highlight and then maybe tell folks you know
where they can find you you know on social media
or you know elsewhere if they wanted more information
yeah look for me on linkedin i think that that's
become the social media platform of choice at
least for me in terms of professional connections
um in a couple weeks i'm going to be speaking
on a couple of panels at the privacy symposium
in venice so if anyone's going to venice Would
love to see you there. One of them is on the
national security and privacy implications of
commercially available information in the age
of AI. So we're going to have a really interesting
panel discussion around this whole concept of
commercially available information. And if you
want to email me, my bio on the university website
has my email address. Excellent. Well, again,
thank you so much for joining us tonight, Alex.
Please join us for our next episode so that you
can stay engaged and stay informed. Remember,
protecting our democracy isn't a spectator sport.
This is Peter Mina for the SteadyState Sentinel.
Still standing watch. Thank you for listening
to the SteadyState Sentinel podcast. Don't miss
out on more insights and exposes from America's
premier global security experts. Also, subscribe
to our Substack at substack .com slash at SteadyState1
and follow our social media and join us right
here next week for another exciting edition.
The Steady State is a nonprofit organization
working to sustain our democracy and national
security. Join us and support our mission by
visiting www .thesteadysate .org.