D.E.A. Secretly Collected Bulk Records of Money-Counter Purchases

WASHINGTON — The Drug Enforcement Administration secretly collected data in bulk about Americans’ purchases of money-counting machines — and took steps to hide the effort from defendants and courts — before quietly shuttering the program in 2013 amid the uproar over the disclosures by the National Security Agency contractor Edward Snowden, an inspector general report found.

Seeking leads about who might be a drug trafficker, the D.E.A. started in 2008 to issue blanket administrative subpoenas to vendors to learn who was buying money counters. The subpoenas involved no court oversight and were not pegged to any particular investigation. The agency collected tens of thousands of records showing the names and addresses of people who bought the devices.

The public version of the report, which portrayed the program as legally questionable, blacked out the device whose purchase the D.E.A. had tracked. But in a slip-up, the report contained one uncensored reference in a section about how D.E.A. policy called for withholding from official case files the fact that agents first learned the names of suspects from its database of its money-counter purchases.

That instruction, it said, “was intended to protect the program’s sources and methods; criminals would obtain money counters by other means if they knew that the D.E.A. collected this data.”

A preamble said the D.E.A. and the inspector general worked together on redactions, and press officers for both declined to comment on the inadvertent disclosure. The D.E.A., which is an arm of the Justice Department, provided a statement responding to the inspector general’s findings, pledging fealty to the rule of law while citing “the importance of protecting the techniques and procedures that D.E.A. agents rely upon to protect our nation.”

The report cited field offices’ complaints that the program had wasted time with a high volume of low-quality leads, resulting in agents scrutinizing people “without any connection to illicit activity.” But the D.E.A. eventually refined its analysis to produce fewer but higher-quality leads, and the D.E.A. said it had led to arrests and seizures of drugs, guns, cars and illicit cash.

The idea for the nationwide program originated in a D.E.A. operation in Chicago, when a subpoena for three months of purchase records from a local store led to two arrests and “significant seizures of drugs and related proceeds,” it said.

But Sarah St. Vincent, a Human Rights Watch researcher who flagged the slip-up on Twitter, argued that it was an abuse to suck Americans’ names into a database that would be analyzed to identify criminal suspects, based solely upon their purchase of a lawful product.

Ms. Vincent, who wrote a report last year criticizing “parallel construction” — the practice of concealing an intelligence program by reobtaining the same data, through a traditional targeted subpoena or other measures, to submit it as court evidence — also flagged a 2008 email cited in the report in which a D.E.A. official wrote, “Unless a federal court tells us we can’t do this, I think we can continue this project.”

Because the D.E.A. was hiding the program, she pointed out, no judge would have an opportunity to evaluate it.

The report described a cursory review by D.E.A. lawyers but said the agency never developed a comprehensive analysis for why it was lawful for it to use the statute that authorized administrative subpoenas to obtain bulk records. The statute permits gathering records that are “relevant or material” to a drug investigation. Citing the D.E.A.’s “uniquely expansive use” of this subpoena authority, the report called that failure “troubling.”

In the spring of 2013, the report said, the D.E.A. submitted its database to a joint operations hub where law enforcement agencies working together on organized crime and drug enforcement could mine it. But F.B.I. agents questioned whether the data had been lawfully acquired, and the bureau banned its officials from gaining access to it.

The F.B.I. agents “explained that running all of these names, which had been collected without foundation, through a massive government database and producing comprehensive intelligence products on any ‘hits,’ which included detailed information on family members and pictures, ‘didn’t sit right,’” the report said.

Then, in June 2013, Mr. Snowden leaked a trove of files from the N.S.A., bringing to light that the agency was collecting Americans’ domestic calling records in bulk — and setting off an uproar.

An intelligence court had secretly blessed the N.S.A. effort under Section 215 of the Patriot Act, which similarly permitted the government to collect records that were “relevant” to a counterterrorism investigation. A federal appeals court in New York later rejected that interpretation of the law, and Congress ended that practice and replaced it with the USA Freedom Act in 2015.

Other bulk data collection or exploitation programs existed. The New York Times reported in November 2013 that the C.I.A. was using the same law to collect bulk records of international money transfers handled by companies like Western Union — including transactions into and out of the United States.

And the inspector general report also addressed two other D.E.A. programs that focused on call records, and whose existence was already public.

The first is the Hemisphere Project, which The Times first reported in September 2013. It has involved AT&T analyzing its vast database of historical logs about Americans’ phone calls on behalf of counterdrug agents. A section of the report that discusses what appears to be Hemisphere — its name is redacted — says it is still operating.

The other was a D.E.A. program that used administrative subpoenas to collect bulk logs of outgoing international phone calls from the United States to countries linked to drug trafficking. The Justice Department disclosed its existence, which began in the first Bush administration, in a 2015 court filing, and it was later the subject of a detailed report by USA Today. Attorney General Eric H. Holder Jr. had ordered the D.E.A. to shut it down in September 2013 — the same time it shuttered the money-counter purchase records program.