Key Loophole Allows NSA To Avoid Telling Congress About Thousands Of Abuses
By Mike Masnick | Techdirt | August 19, 2013
As we’ve noted, one of the key claims by NSA surveillance defenders was that the program had strong oversight from Congress. However, with the revelations last week about thousands of abuses, it’s become quite clear that this isn’t true. Late on Friday, Rep. Jim Himes, who is on the House Intelligence Committee, claimed that he was unaware of those violations, was told that there were “no abuses” and that these kinds of abuses are unacceptable:
Remember, this isn’t just a Congressional Rep, but a member of the Intelligence Committee, who is in charge of overseeing the NSA surveillance program. Hell, he’s even on the oversight subcommittee, and no one told him about any abuses, despite thousands happening per year. That’s astounding, and highlights how the claims of Congressional oversight are clearly bogus. Furthermore, it makes a mockery of the statement that House Intelligence Committee chair Mike Rogers put out on Friday, claiming that “The Committee has been apprised of previous incidents.” Himes says that’s completely untrue.
How is this happening? Marc Ambinder explains the “loophole” that the NSA has used to avoid telling Congress about these abuses. It’s a bit convoluted, but basically, the NSA believes that Congressional oversight only covers spying done under FISA — the law that covers any spying done on Americans, for which a court order is needed. FISA doesn’t cover spying on non-US persons (i.e., foreigners who are outside the country at the time of surveillance). And that’s where some of the abuses came in, and the NSA believes that since those aren’t “FISA” related, and Congress is only overseeing “FISA,” they don’t have to report those mistakes.
Since the focus of oversight efforts has been on FISA compliance, NSA gives Congress detailed narratives of violations of the FISA-authorized data sets, like when metadata about American phone records was stored too long, when a wrong set of records was searched by an analyst or when names or “selectors” not previously cleared by FISA were used to acquire information from the databases. In these cases, the NSA’s compliance staff sends incident reports to the Senate Select Committee on Intelligence and the House Permanent Select Committee on Intelligence for each “significant” FISA violation, and those reports include “significant details,” the official said.
But privacy violations of this sort comprise just one third of those analyzed by the inspector general. Of the 2,776 violations reported by the NSA from May 2011 to May 2012, more than two-thirds were counted as E.O. 12333 incidents. And the agency doesn’t provide Congress detailed reports on E.O. 12333 violations.
Now, you can argue these are very different circumstances, but Ambinder points out that’s not really true in many cases:
In some ways, it’s a distinction without a difference: it does not matter to U.S. citizens whether their phone call was accidentally intercepted by an analyst focusing on U.S.-based activities or those involving a foreign country. But the difference is relevant as it keeps Congress uninformed and unable to perform its oversight duties because the NSA doesn’t provide the intelligence committees with a detailed narrative about the latter type of transgressions.
For example, if someone’s e-mails were inadvertently obtained by the NSA’s International Transit Switch Collection programs, it would count as 12333 error and not a FISA error, even though the data was taken from U.S. communication gateways, and NSA would not notify Congress.
So, basically, any “error” that involves spying on Americans doesn’t “count” as an abuse, as far as the NSA tells Congress (who keep claiming they’re in charge of oversight), because they “obtained” it outside the US, and the “error” is considered outside of FISA. That’s a pretty massive loophole through which the NSA can hide its abuse of programs from Congress.
Related articles
- EFF: Leaks Prove NSA Has No Meaningful Oversight – (dslreports.com)
- Uncontrolled by FISA court, NSA commits ‘thousands of privacy violations per year’ (alethonews.wordpress.com)
Cellphone tracking cases highlight privacy concerns in digital age
Rt | August 20, 2013
In recent weeks, two cert petitions were filed seeking review of whether the Fourth Amendment covers police searches of cellphone records upon arrest.
From mobile phone and GPS tracking to license plate reading and domestic surveillance drones — not to mention recent revelations of widespread abuse of surveillance capabilities by the National Security Agency — these cases and many others highlight major questions that remain unanswered regarding how privacy rights of Americans can co-exist with the use of rapidly evolving technologies.
State and federal law enforcement agencies have wasted no time seizing on gaps and omissions in established legal precedent to justify vast, routine surveillance of the American public which tests Fourth Amendment rights.
On July 30, a petition was filed in Riley v. California challenging a previous ruling in a California appellate court that affirmed the petitioner’s convictions, which stemmed in part from a questionable search of his smartphone in 2009 following a traffic stop for expired license plates. And late last week, the US Department of Justice filed a petition in United States v. Wurie asking for review of a First Circuit Court of Appeals ruling that police needed a warrant to access a suspect’s phone records. Regarding Wurie, the government contends a cell phone is no different from any other item on a suspect at the time of arrest. The search pertaining to Wurie occurred in 2007.
On the surface, the two cases have much in common. But in Riley, the phone in question is a smartphone – a Samsung Instinct M800. In Wurie, the cellphone was a Verizon LG flip-phone incapable of maintaining the breadth of information – including internet searches, email, photos and other media – that a smartphone can store.
As of May, Pew Research Center found that 91 percent of Americans own cellphones, and 61 percent of those cellphones are smartphones.
GPS technology has received more scrutiny from courts than cellphones have in recent years. Last week, the Justice Department appeared before a federal court defending its right to shield legal memos that provide guidance to federal prosecutors and investigators for how to use GPS devices and other surveillance technologies from the public. In a sense, the memos were released upon a Freedom of Information Act request by the American Civil LIberties Union (ACLU), though their contents were heavily redacted.
The memos (read here and here) were legal interpretations of a January 2012 Supreme Court ruling in United States v. Jones in which the court ruled the use of GPS technology to track a car’s movements constitutes a “search” within the parameters of the Fourth Amendment. Upon release of the indecipherable legal memos, the ACLU filed a lawsuit seeking the full, uncensored guidelines.
“While we agree that executive branch lawyers should be able to freely discuss legal theories, once those opinions become official government policy the public has an absolute right to know what they are,” wrote Brian Hauss, legal fellow with the ACLU’s Speech, Privacy and Technology Project. “Otherwise, the government is operating under secret law that makes accountability to the people impossible.”
The ruling in United States v. Jones left many unanswered questions regarding the use of other location-monitoring technologies pertaining to, for example, the tracking of cellphones or the use of license-plate readers – not to mention the use of surveillance drones in the US. In addition, the Jones ruling fell short of even determining whether a warrant is necessary to use GPS devices.
Building on the Jones decision, New Jersey recently became a state ahead of the curve in defining rules for law enforcement and privacy rights in the digital age. The New Jersey Supreme Court ruled in July that state police must have a search warrant before obtaining tracking information from cellphone providers.
“Using a cellphone to determine the location of its owner can be far more revealing than acquiring toll billing, bank, or internet subscriber records,” Chief Justice Stuart Rabner wrote in the case’s opinion. “Details about the location of a cellphone can provide an intimate picture of one’s daily life and reveal not just where people go – which doctors, religious services and stores they visit – but also the people and groups they choose to affiliate with. That information cuts across a broad range of personal ties with family, friends, political groups, health care providers and others.”
In June, Montana became the first state to require police to obtain a warrant before tracking a suspect’s cellphone.
In March 2012, the ACLU reviewed records from over 200 local police departments, finding vast, aggressive use of cellphone tracking for emergency and nonemergency uses.
Another ACLU report, released in July of this year, queried around 600 local and state police departments (and other state and federal agencies) via public records requests to assess how these agencies use automatic license plate readers. The civil liberties organization found massive databases of innocent motorists’ location information gleaned through hundreds of millions of “plate reads” by the ubiquitous readers. Data is often stored for an indefinite period of time, revealing just how easy it is for law enforcement – as well as many private companies – to track any license plate with few legal restrictions in place to stop them.
For example, for every one million plates that were read in the state of Maryland in the first half of 2012, 2000 (0.2 percent) were hits, mostly regarding registration or emissions issues. Of those 2000 hits, less than 3 percent (47) were potentially connected to more serious crimes.
In addition, much of this network of readers throughout the nation is in place thanks to a large amount of federal funding – $50 million in the last five years.
Approval of licenses for domestic drones has begun, as RT has reported, even though solid rules for their eventual use in American skies have yet to materialize from either Congress or the Federal Aviation Administration. The FAA expects as many as 30,000 drones in American airspace by 2020.
For now, many local law enforcement agencies are leading the quest for drone-use approval, though requests for commercial drones are mounting. As of February 15, 2013, there were 327 active drone certifications despite there being no regulatory framework in place. However, the FAA did get around to certifying two types of unmanned aircraft for civilian use in the US in late July.
In the meantime, federal government agencies have used drones domestically both out in the open and in secret. The Federal Bureau of Investigation has admitted to already using surveillance drones despite no established law or guidelines for their use. The US Department of Homeland Security has used surveillance-capable drones along the border for years, even allowing other federal agencies to use its fleet to the tune of 250 times in 2012 alone, The New York Times reported.
UK ordered Guardian to destroy hard drives in effort to stop Snowden revelations
RT | August 20, 2013
UK authorities reportedly raided the Guardian’s office in London to destroy hard drives in an effort to stop future publications of leaks from former NSA contractor Edward Snowden. The action is unlikely to prevent new materials coming out.
Guardian editor Alan Rusbridger revealed in a Monday article posted on the British newspaper’s website that intelligence officials from the Government Communications Headquarters (GCHQ) told him that he would either have to hand over all the classified documents or have the newspaper’s hard drives destroyed.
After more talks, two “security experts” from GCHQ – the British version of the National Security Agency – visited the Guardian’s London offices.
Rusbridger wrote that the government officials then watched as computers, which contained classified information passed on by Snowden, were physically destroyed in one of the newspaper building’s basements.
“We can call off the black helicopters,” Rusbridger said one of the officials joked.
Another source familiar with the event confirmed to Reuters that Guardian employees destroyed the computers as UK officials observed.
During negotiations with the government, Rusbridger said that the newspaper could not fulfill its journalistic duty if it satisfied the authorities’ requests.
But GCHQ reportedly responded by telling the Guardian that it had already sparked the debate, which was enough.
“You’ve had your debate. There’s no need to write any more,” Reuters quoted the unnamed official as saying.
In the article, Rusbridger explained that because of existing “international collaborations” between journalists, it was still possible to report the story and “take advantage of the most permissive legal environments.”
“I explained to the man from Whitehall about the nature of international collaborations… Bluntly, we did not have to do our reporting from London. Already most of the NSA stories were being reported and edited out of New York. And had it occurred to him that [reporter Glenn] Greenwald lived in Brazil?” wrote Rusbridger.
“The man was unmoved. And so one of the more bizarre moments in the Guardian’s long history occurred – with two GCHQ security experts overseeing the destruction of hard drives in the Guardian’s basement just to make sure there was nothing in the mangled bits of metal which could possibly be of any interest to passing Chinese agents.”
Rusbridger pointed out that the whole incident felt like a “pointless piece of symbolism that understood nothing about the digital age.”
The news comes after Sunday’s international incident during which David Miranda, the partner of Guardian journalist Glenn Greenwald, was held at Heathrow airport under the UK Terrorism Act for the maximum time allowed before pressing charges. Greenwald was the reporter who exclusively broke the Snowden story.
The editor promised that the Guardian will “continue to do patient, painstaking reporting on the Snowden documents, we just won’t do it in London. The seizure of Miranda’s laptop, phones, hard drives and camera will similarly have no effect on Greenwald’s work.”
Another US security source told Reuters that Miranda’s detention was meant to send a message to those who received Snowden’s classified documents, about how serious the UK is in closing all the leaks in relation to the whistleblower’s revelations.
Greenwald, who first published secrets leaked by former NSA contractor Edward Snowden, responded by promising to release more documents. He added that the UK would be “sorry” for detaining his partner for nine hours.
Snowden, who has been granted asylum by Russia, gave Greenwald up to 20,000 documents with details about the US National Security Agency and the UK’s GCHQ surveillance operations.
‘US is the intellectual author behind detention of Miranda’
Lawyer Eva Golinger told RT that the UK has violated all concepts of freedom of the press. “We are talking about a media outlet. Journalists and their spouses and partners being detained and interrogated. So clearly there has been a decision made that everything related to Edward Snowden must be captured no matter what, violating anyone’s right under any country’s laws.”
Golinger believes that government’s pressure on journalists could inspire some to cover the topic of government surveillance even more, instead of discouraging them to do so.
“The more principled the people reporting are, the more they will continue to pursue that work in the face of threat. Such cheap threats and intimidation give people even more reasons to continue doing what they are doing because it shows that those in power are clearly frightened of the information that is being put out,” she explained.
“At the same time it could certainly intimidate other journalists and create the environment of self-censorship, where many would be unwilling to take the risks that are involved with national security reporting, particularly when it comes to the US.”
Golinger argued that US is the “intellectual author behind the detainment of Miranda.”
“We are talking about a search and capture that is going on for Edward Snowden and it is the US that is leading that effort. It is not the UK or other European nations, they are merely abiding by the wishes of the US…What I believe is that Washington has simply put out a request to all of its allies that anyone related to Edward Snowden must be detained if they come into your territory and the UK abided by that and did their duty.”
Focusing on the Core Harms of Surveillance
By Frank Pasquale | Balkinization | August 16, 2013
The “summer of NSA revelations” rolls along, with a blockbuster finale today. In June, Jennifer Granick and Christopher Sprigman flatly declared the NSA criminal. Now the agency’s own internal documents (leaked by Snowden) appear to confirm thousands of legal violations.
Legal scholars will not be surprised by the day’s revelations, just as few surveillance experts were all that shocked by the breadth and depth of PRISM, PINWALE, MARINA, and other programs. Ray Ku called warrantless surveillance unconstitutional in 2010. Civil liberties groups and legal scholars warned us repeatedly about where Bush-era executive power theories would lead. As anyone familiar with Bruce Ackerman’s work might guess, pliable attorneys have rubber-stamped the telephony metadata program with a “white paper” that “fails to confront counterarguments and address contrary caselaw” and “cites cases that [are] relatively weak authority for its position.” There are no meaningful penalties in sight (perhaps because the OLC has prepared documents that function as a “get out of jail free” card for those involved).
Like the data mining they employ, the NSA surveillance programs are hard to govern democratically (or cabin legally) because of the speed, scale, and secrecy of the problems they address. They fall into “black holes” of administrative review, where the inclination of judges to review them is at lowest ebb. Even if judges find “ticking time bomb” scenarios unlikely in the extreme, the surveillance apparatus can evoke plenty of other existential risks to demand deference. If you were on the FISA court and the NSA told you that they needed to collect everyone’s data because they were trying to track down a swarm of poison-bearing microdrones, how long would you delay them to “dig into the substance” before approving the request? As Desmond Manderson has argued, “Trust Us Justice” is the order of the day.
Real Harms
Nevertheless, the long-term danger of an unaccountable surveillance state is probably much greater than that posed by any particular terror threat.* Both Julie Cohen and Neil Richards have explained the many dangers arising out of pervasive surveillance. As Richards observes,
[The] special harm that surveillance poses is its effect on the power dynamic between the watcher and the watched. This disparity creates the risk of a variety of harms, such as discrimination, coercion, and the threat of selective enforcement, where critics of the government can be prosecuted or blackmailed for wrongdoing unrelated to the purpose of the surveillance.
To make this more concrete: note that the US’s intelligence apparatus has already extensively monitored libertarians and peace activists. According to the Partnership for Civil Justice Fund, “from its inception, the FBI treated the Occupy movement as a potential criminal and terrorist threat.” During Occupy Wall Street, investigative journalists uncovered command centers advised by federal and local officials and banks. Skeptics wondered whether banks’ lucrative “private detail pay” and donations for police helped motivate multiple, brutal crackdowns on peaceful (if unorthodox) protesters. Homeland security officials may have advised local police on containment of the hundreds of “Occupy” encampments that arose in the fall of 2011. And in terms of selective enforcement: one has to wonder why police decided to care about a six-year-old open container violation at the homes of activists one day before May Day protests.
For a concrete example of how an activist deals with this type of news, consider the story of one Daytona woman:
[She] is a 45-year-old married mother of two young children. She is a homeowner, a taxpayer and a safe driver. She votes in every election. She attends a Unitarian Universalist church on Sundays. She is also, like nearly all who have a relationship with the Occupy movement in the United States, being monitored by the federal government. . . . McLeish worries about how being a target of FBI attention will affect her life. “Can the inclusion of my name and information on a federal law enforcement domestic terrorist watch list impact my ability to make a living and provide for my children?” she asked.
This is not a purely speculative concern, however much the SCOTUS majority in Clapper v. Amnesty may dismiss such worries as the fruit of a “chain of contingencies.” FBI screens are used to deny persons jobs, now. Many applicants have no idea they are even part of the hiring process:
Updating the records of those who fall through the cracks can be confusing and cumbersome. FBI regulations say that employers and licensing agencies should give applicants time to challenge and correct their records, either by contacting the FBI or the jurisdiction that collected the data. But applicants are not always given a copy of their report or told why they were disqualified. Often, the burden is on them to prove an error was made.
Even if the databases don’t include those who are not arrested, what stops law enforcement agencies from including “suspects” in related databases? Employers may not want to have anything to do with someone “under watch” by the government. Moreover, even being arrested can be a form of speech: consider the Moral Monday protesters in North Carolina.
Speculative No More
In his press conference last week, President Obama stated, “If you look at the reports, even the disclosures that Mr. Snowden’s put forward, all the stories that have been written, what you’re not reading about is the government actually abusing these programs and, you know, listening in on people’s phone calls or inappropriately reading people’s e-mails.” In Clapper v. Amnesty Int’l, Justice Alito trivialized the plaintiffs’ concerns as mere conjecture. Surveillance promoters on both left and right argue that privacy activists haven’t demonstrated any concrete harms. The former NSA director has dismissed those concerned as “nihilists, anarchists, activists, Lulzsec, Anonymous, twentysomethings who haven’t talked to the opposite sex in five or six years.”
Implications of paranoia (among those worried about surveillance) now themselves appear fantastical. The Supreme Court’s bizarre decision in Clapper v. Amnesty International, that respondents’ claims about being monitored were “too speculative” to merit judicial review, now deserves not merely rebuke, but reconsideration. Unless the surveillance apparatus wants to claim that Greenwald, the ACLU, EPIC, and PCJF are making up documents out of whole cloth, it has to acknowledge that not only have laws been violated, but exactly the types of harms those laws were designed to stop have indeed occurred. This is not just a matter of legalist punctilio or nihilist skepticism.
Tragically, the core surveillance harms are not likely to provoke much political pushback against the NSA. Unlike the Framers, who wrote the Constitution shortly after risking their lives for their political commitments, most Americans have little respect for the political targets of NSA/DHS/FBI/Police/DEA surveillance and information sharing.** For the average voter, about the only thing more suspect than the two major parties are political activists who operate outside their ken. Justice Roberts’s FISA Court, and the dozens of appellate judges like them, are unlikely to have more enlightened views. A movement to make the surveillance apparatus more accountable will need to achieve its goals indirectly, focusing on the costs, creepiness, or crony capitalism of mass surveillance. I hope to elaborate on each of these issues in future posts.
*Though perhaps not greater than the sum of terror threats—a question presently explored via cost-benefit analysis, but probably better addressed in scenario planning.
**To preempt the comment “you’re mixing up different programs:” please take a look at this article on vertical and horizontal fusion of data sources in the new Information Sharing Environment. For the TL;DR crowd, there’s this.
Related article
- NSA “Nothing to see here, people” types thoroughly embarrassed again (washingtonmonthly.com)
Feds Threaten To Arrest Lavabit Founder For Shutting Down His Service
By Mike Masnick | Techdirt | August 16, 2013
The saga of Lavabit founder Ladar Levison is getting even more ridiculous, as he explains that the government has threatened him with criminal charges for his decision to shut down the business, rather than agree to some mysterious court order. The feds are apparently arguing that the act of shutting down the business, itself, was a violation of the order:
… a source familiar with the matter told NBC News that James Trump, a senior litigation counsel in the U.S. attorney’s office in Alexandria, Va., sent an email to Levison’s lawyer last Thursday – the day Lavabit was shuttered — stating that Levison may have “violated the court order,” a statement that was interpreted as a possible threat to charge Levison with contempt of court.
That same article suggests that the decision to shut down Lavabit was over something much bigger than just looking at one individual’s information — since it appears that Lavabit has cooperated in the past on such cases. Instead, the suggestion now is that the government was seeking a tap on all accounts:
Levison stressed that he has complied with “upwards of two dozen court orders” for information in the past that were targeted at “specific users” and that “I never had a problem with that.” But without disclosing details, he suggested that the order he received more recently was markedly different, requiring him to cooperate in broadly based surveillance that would scoop up information about all the users of his service. He likened the demands to a requirement to install a tap on his telephone.
It sounds like the feds were asking for a full on backdoor on the system, not unlike some previous reports of ISPs who have received surprise visits from the NSA.
Majority of Americans say Director of National Intelligence Clapper should be prosecuted for perjury
Press TV – August 18, 2013
An overwhelming majority of Americans say James Clapper, the spy master who lied to Congress about domestic surveillance, should be prosecuted for perjury, results from a new survey show.
During a congressional hearing in March, Clapper, the Director of National Intelligence, said the National Security Agency (NSA) did not collect phone and Internet data on millions of ordinary Americans, a response he later admitted was “clearly erroneous.”
Commissioned by the Progressive Change Campaign Committee and Credo and conducted by Public Policy Polling in five states, a new survey finds that huge majorities of Americans want Clapper prosecuted for lying to Congress.
In response to the question, “Do you think the Director of National Intelligence should be prosecuted for perjury?” 68 percent of voters in Texas and 69 percent in Kentucky said the spy chief should be prosecuted.
In the Democratic states of California and Hawaii, 54 percent and 58 percent of voters, respectively, said they want him prosecuted. In Iowa, 65 percent of voters said the same.
Recent revelations by former NSA contractor Edward Snowden about the previously secret surveillance programs have sparked a heated national debate about government transparency and privacy issues in the United States, putting the Obama administration on the defensive.
In a move to dampen the controversy, President Barack Obama outlined a number of steps last Friday to increase transparency and reform some aspects of the NSA.
However the president’s four-point reform packaged provoked a backlash when it was implied that Clapper was being appointed to head an “independent group” of “outside experts” to oversee the government’s surveillance programs.
The White House later denied Clapper would lead the independent review, saying the director had to be involved for administrative reasons as the panel would need security clearance and access to classified information.
NSA to open new $60mln facility in N. Carolina university amid surveillance scrutiny
RT | August 16, 2013
While new disclosures this week have exposed inept oversight and gross privacy violations within the National Security Agency, news out of North Carolina has revealed that the NSA is spending $60.75 million on another brand new facility.
In the midst of an international debate focused on how the United States’ premier spy agency has conducted dragnet surveillance over much of the world, including at home, the NSA is expanding even further. The News & Observer reported on Thursday that North Carolina State University in Raleigh, NC is receiving a $60.75 million grant from the NSA to develop a top-secret data analysis lab.
The grant, the paper reported, is three times larger than any award ever received by the university in the school’s history.
Randy Woodson, the school’s chancellor, said Thursday that the deal had been in the works for three years. He said he hoped the data center would make North Carolina a more attractive destination for technology companies. Woodson predicted that the project would create 100 jobs over five years.
“We appreciate the confidence of the National Security Agency to select NC State for this groundbreaking endeavor,” Woodson said in a statement. “Not only will it enhance the academic experience for our students and faculty, it will also add to the economic prosperity of our community through new jobs, new industry and new partnerships.”
Many details on the project have been kept secret because of national security, according to officials. But North Carolina State already has contracts with the Department of Defense, helping the agency research technology which will help soldiers identify improvised explosive devices and expand their foreign language capabilities, among other functions.
The NSA has come under harsh scrutiny in recent months due to the disclosure of classified surveillance programs which the government has used to justify monitoring the communications of Americans, as well as the international community. Internal emails published by the News & Observer reveal that North Carolina State originally intended to announce their deal with the NSA just before the leaks were published but decided to delay in fear of potential blowback.
“A very important announcement about our new NSA-funded Laboratory for Analytic Sciences was supposed to be made public this morning, but with that bit out of The Guardian newspaper on NSA collecting phone records of Verizon customers – everyone thought it best to not make the announcement just yet,” Randy Avent, the associate vice chancellor for research at NCSU, wrote in a message to other administrators. “By the way – our Lab is just that – a research program studying the fundamental science behind analytics. It is not a storage facility for classified data and does not work with any data like that mentioned in the article.”
The delayed announcement comes after another disclosure which further harmed the NSA’s reputation. The Washington Post published top-secret documents Thursday night which provide a glimpse into just how often the NSA breaks the law and invades the privacy of Americans. Thousands of violations were recorded in each of the years since the NSA’s power was expanded in 2008.
Uncontrolled by FISA court, NSA commits ‘thousands of privacy violations per year’
RT | August 16, 2013
The National Security Agency broke the law and ignored privacy protections thousands of times in each of the years since Congressional leaders expanded the agency’s power in 2008, according to a new report citing documents leaked by Edward Snowden.
The majority of the violations are related to unauthorized surveillance on Americans or foreigners inside the United States, conditions deemed illegal by executive order, according to a new report from the Washington Post.
The account is based on top-secret documents and a May 2012 internal NSA audit that found 2,776 infractions – including unauthorized collection, storage, access to or distribution of legally protected communications – in the preceding 12 months alone. The audit, originally only meant to be seen by top NSA leaders, only accounted for violations at NSA headquarters at Fort Meade, Virginia, and other locations in the Washington DC region.
Three government sources told the Post that the 2,776 infractions would in fact be much higher had the audit included all NSA data collection centers. Each of the 2,776 violations could have potentially encompassed thousands of communications.
“One key to the Washington Post story,” tweeted journalist Glenn Greenwald, who first published Snowden’s disclosures in June, “the reports are internal, NSA audits, which means high likelihood of both under-counting and white-washing.”
One of the most flagrant examples is a 2008 incident when a “large number” of telephone calls were inadvertently intercepted because a programmer erroneously typed “202” instead of “20,” Egypt’s national calling code, according to a “quality assurance” memorandum never seen by NSA oversight staff.
Another time, the NSA kept 3,032 files they were ordered to destroy by the Foreign Intelligence Surveillance Act (FISA) court. Each individual file included an undisclosed number of telephone call records, according to the Post.
In a separate incident, the NSA failed to notify the FISA court about a new collection method the agency was using for months, at which point the court deemed the method unconstitutional. The agency reportedly “diverted large volumes of international data passing through fiber-optic cables in the United States into a repository where the material could be stored temporarily for processing and selection.”
This finding, and others like it, refutes claims made by NSA chief Keith Alexander and other brass that the government does not store or process the information it collects. As per NSA policy, the number of Americans affected was not disclosed in the top-secret documents.
NSA officials also failed to explain why, with the number of violations lower in 2008 and 2009 than in later years, violations only increased as time went on.
US District Judge Reggie Walton, the chief judge of the FISA court, admitted that the court’s rulings are based only on information provided by the government. Consequently, judges entrusted with determining what the NSA may and may not do are forced to rely on the NSA to prove the government has not and will not overstep its legal bounds.
“The [FISA court] is forced to rely upon the accuracy of the information that is provided to the Court,” Walton wrote to The Washington Post. “The [FISA court] does not have the capacity to investigate issues of noncompliance, and in that respect the [FISA court] is in the same position as any other court when it comes to enforcing [government] compliance with its orders.”
Privacy advocates have previously expressed concern that the court is never informed of many of the violations. Even when the court is informed of the agency’s intentions, however, the judges are sometimes ignored.
A recently declassified Justice Department review from 2009 discovered a “major operational glitch that had led to a series of significant violations of the court’s order and notified the court.” While specifics of the error were not disclosed, problems including the so-called “over-collection” of phone call metadata were reported.
“The problems generally involved the implementation of highly sophisticated technology in a complex and ever-changing communications environment which, in some instances, results in the automated tools operating in a manner that was not completely consistent with the specific terms of the Court’s orders,” a December 2009 memo to the Senate and House intelligence committees stated.
The Washington Post notified the NSA of Thursday’s report before it was published, at which point the agency said it stops mistakes “at the earliest possible moment, implement mitigation measures wherever possible, and drive them down.”
“We’re a human-run agency operating in a complex environment with a number of different regulatory regimes, so at times we find ourselves on the wrong side of the line,” said one senior official who spoke on the condition of anonymity. “You can look at a number in absolute terms that looks big, and you look at it in relative terms, it looks a little different.”
The documents also described a tutorial that NSA collectors and analysts are required to complete. Titled the “Target Analysts Rationale Instructions,” the training instructs employees on how to complete oversight requirements without revealing “extraneous information” to “our FAA overseers,” a reference to the FISA Amendments Act of 2008.
California Senator Dianne Feinstein said she did not receive a copy of the audit until questioned by the Post, despite her position as Senate Intelligence Committee Chairman. She said the committee “can and should do more to independently verify that NSA’s operations are appropriate, and its reports of compliance incidents are accurate.”
The timing of the report comes just after US President Barack Obama defended the NSA’s widespread domestic and foreign surveillance. Obama said the programs were necessary to protect national security and legitimate partly because of comprehensive oversight.
“If you look at the reports – even the disclosures that Mr. Snowden has put forward – all the stories that have been written, what you’re not reading about is the government actually abusing these programs and listening in on people’s phone calls or inappropriately reading people’s emails,” Obama said.
“What you’re hearing about is the prospect that these could be abused. Now, part of the reason they’re not abused is because these checks are in place, and those abuses would be against the law and would be against the orders of the Foreign Intelligence Surveillance Court.”
After the initial report was published Thursday night the Washington Post issued an appendix revealing that after reporters spoke with NSA leadership, the Obama administration refused allow the Post to publish their names or official titles. The explanation from the newspaper is reproduced in full below:
“The Obama administration referred all questions for this article to John DeLong, the NSA’s director of compliance, who answered questions freely in a 90-minute interview. DeLong and members of the NSA communications staff said he could be quoted “by name and title” on some of his answers after an unspecified internal review. The Post said it would not permit the editing of quotes. Two days later, White House and NSA spokesmen said that none of DeLong’s comments could be quoted on the record and sent instead a prepared statement in his name. The Post declines to accept the substitute language as quotations from DeLong. The statement is below.
“We want people to report if they have made a mistake or even if they believe that an NSA activity is not consistent with the rules. NSA, like other regulated organizations, also has a “hotline” for people to report — and no adverse action or reprisal can be taken for the simple act of reporting. We take each report seriously, investigate the matter, address the issue, constantly look for trends, and address them as well — all as a part of NSA’s internal oversight and compliance efforts. What’s more, we keep our overseers informed through both immediate reporting and periodic reporting. Our internal privacy compliance program has more than 300 personnel assigned to it: a fourfold increase since 2009. They manage NSA’s rules, train personnel, develop and implement technical safeguards, and set up systems to continually monitor and guide NSA’s activities. We take this work very seriously.”
Related article
Did The NSA Think The Public Can’t Do Math? Attempt To Downplay Data Collection Fails Miserably
By Mike Masnick | Techdirt | August 14, 2013
Last week we wrote about the NSA’s ridiculous attempt to justify its surveillance efforts, including this really wacky callout designed to show just how “little” data the NSA collects.
Scope and Scale of NSA Collection
According to figures published by a major tech provider, the Internet carries 1,826 Petabytes of information per day. In its foreign intelligence mission, NSA touches about 1.6% of that. However, of the 1.6% of the data, only 0.025% is actually selected for review. The net effect is that NSA analysts look at 0.00004% of the world’s traffic in conducting their mission — that’s less than one part in a million. Put another way, if a standard basketball court represented the global communications environment, NSA’s total collection would be represented by an area smaller than a dime on that basketball court.
This was bizarre on a number of levels, not the least of which is the wacky basketball court-to-dime scale. Next time, maybe we can play “is it bigger than a breadbox” with the NSA. But, as for what any of this meant, it hasn’t been at all clear. Since the NSA has already redefined basic English words like “collect,” “target,” “datamine,” and “relevant” it’s not at all clear what is meant by “touch.” However, some are starting to dig into the numbers, and contrary to the NSA’s attempt to suggest that this is “nothing to fear,” a bit of analysis certainly suggests they’re collecting quite a bit of info.
First up, we have Jeff Jarvis, who highlights a bunch of important comparative datapoints including that Sandvine claims that only 2.9% of US traffic is communication traffic and 68.8% of all email is spam — meaning that it’s entirely possible that the NSA collects nearly all non-spam email and it would still be within its 1.6% number. He also points out that 62% of traffic on the internet is considered entertainment, and we can assume that the NSA doesn’t need to collect every copy of Game of Thrones that people are passing around (I’m sure one or two will do the job). He similarly points out that Google itself claims to only index approximately 0.004% of traffic on the internet, suggesting that the NSA may be collecting more info than Google indexes by two orders of magnitude.
Meanwhile, Sean Gallagher, over at Ars Technica, digs a bit deeper into the numbers, suggesting that the NSA’s data collection is closer to being on par with Google, but still greater than Google:
The dime on the basketball court, as NSA describes it, is still 29.21 petabytes of data a day. That means NSA is “touching” more data than Google processes every day (a mere 20 petabytes).
Gallagher also looks much more closely at the recently revealed details of the Xkeyscore program, to show how that 1.6% of “touched” internet communications can cover pretty much everything important.
As a result, if properly tuned, the packet analyzer gear at the front-end of XKeyscore (and other deep packet inspection systems) can pick out a very small fraction of the actual packets sent over the wire while still extracting a great deal of information (or metadata) about who is sending what to who. This leaves disk space for “full log data” on connections of particular interest.
In other words, while the 1.6% number was put forth by the NSA to try to make people think this is no big deal, when you look at what it means, it suggests it’s a very big deal indeed. In fact, the NSA may be collecting even more information that people had believed before.
A Guide to the Deceptions, Misinformation, and Word Games Officials Use to Mislead the Public About NSA Surveillance
By Trevor Timm | EFF | August 14, 2013
It’s been two months since President Barack Obama first said that he welcomes a debate about NSA surveillance, which he once again reiterated last week at his press conference. Unfortunately, it’s very hard to have a real debate about a subject when the administration constantly and intentionally misleads Americans about the NSA’s capabilities and supposed legal powers.
Infamously, the Director of National Intelligence (DNI) James Clapper was forced to apologize for lying to Congress about whether the government was collecting information on millions of Americans, but that was merely the tip of the administration’s iceberg of mendacity and misdirection. At this point, it seems nothing the government says about the NSA can be taken at face value.
NSA’s Bizarro Dictionary
The latest example comes from the New York Times last week, which reported that the NSA is “searching the contents of vast amounts of Americans’ e-mail and text communications into and out of the country.” Despite the fact that millions of people’s communications are collected in bulk, the NSA says that this isn’t “bulk collection.” From the NYT story:
The senior intelligence official argued, however, that it would be inaccurate to portray the N.S.A. as engaging in “bulk collection” of the contents of communications. “ ‘Bulk collection’ is when we collect and retain for some period of time that lets us do retrospective analysis,” the official said. “In this case, we do not do that, so we do not consider this ‘bulk collection.’ ”
In other words, because the NSA does some sort of initial content searches of the bulk communications that they collect, perhaps using very fast computers, then only keep some unknown subset of that greater bulk for a later date, no “bulk collection” occurs. This is ridiculous. No matter how you slice it, the NSA is mass collecting and searching millions of American communications without a warrant.
Keep in mind that officials have previously said communications aren’t even “collected” when they are intercepted and stored in a database for long periods of time, much less “bulk collected.” Orwell would be impressed.
We’ve long documented the NSA’s unbelievable definitions of ordinary words like “collect,” “surveillance,” and “communications,” publishing a whole page of them last year. The ACLU’s Jameel Jaffer has added to the NSA’s bizarro dictionary, with words like “incidental,” “minimize” and even “no.”
The fact is, no one should have to read and parse a sentence a half-dozen times, plus have access to a secret government dictionary, in order to decipher its meaning. Yet, that’s apparently how the administration wants this debate to proceed.
Question Misdirection
When government officials can’t directly answer a question with a secret definition, officials will often answer a different question than they were asked. For example, if asked, “can you read Americans’ email without a warrant,” officials will answer: “we cannot target Americans’ email without a warrant.” As we explained last week, the NSA’s warped definition of word “target” is full of so many holes that it allows the NSA to reach into untold number of Americans’ emails, some which can be purely domestic.
“Under this Program” Dodge
Another tried and true technique in the NSA obfuscation playbook is to deny it does one invasive thing or another “under this program.” When it’s later revealed the NSA actually does do the spying it said it didn’t, officials can claim it was just part of another program not referred to in the initial answer.
This was the Bush administration’s strategy for the “Terrorist Surveillance Program”: The term “TSP” ended up being a meaningless label, created by administration officials after the much larger warrantless surveillance program was exposed by the New York Times in 2005. They used it to give the misleading impression that the NSA’s spying program was narrow and aimed only at intercepting the communications of terrorists. In fact, the larger program affected all Americans.
Now we’re likely seeing it as part of the telephone records collection debate when administration officials repeat over and over that they aren’t collecting location data “under this program.” Sen. Ron Wyden has strongly suggested this might not be the whole story.
From Downright False to Impossible to Understand
Some statements by government officials don’t seem to have any explanation.
The night before the New York Times story on “vast” warrantless searches of Americans’ communications came out, Obama told Jay Leno on The Tonight Show, “We don’t have a domestic spying program.” Mr. President, what do you call collecting the phone records of all Americans and searching any email sent by an American that happens to cross the border? That sounds a lot like a domestic spying program.
Similarly, Sen. Dianne Feinstein, chair of the Senate Intelligence Committee, recently said this: “[T]he government cannot listen to an American’s telephone calls or read their emails without a court warrant issued upon a showing of probable cause.” Leaked documents and, honestly, the FISA Amendments Act itself show Feinstein’s statement simply isn’t true—if Americans are talking to a “target” their telephone calls are listened to and their emails can be read without a warrant (and that doesn’t even include the searching of Americans’ communications that are “about a target”). All of those searches are done without a court order, much less a warrant based on probable cause.
Previously, President Obama has called the inherently secret FISA court “transparent,” to the befuddlement of just about everyone. A court that has issued tens of thousands of secret orders, while creating a secret body of privacy and Fourth Amendment law, is not “transparent” by any measure.
Just last week, the president claimed he would appoint an “independent” board of “outside” observers to review the surveillance programs, only to put DNI Clapper—the same man who lied to Congress and the public about the scope of the program—in charge of picking the members. The White House has since backtracked, but the DNI still will report the group’s findings to the President.
These are not all of the misleading statements, merely just a few that stick out at the moment. If the president is serious about transparency, he can start by declassifying the dictionary his administration is using to debate, and start speaking straight to the American public. A one-sided presentation of the facts, without straightforward answers to the public’s questions, isn’t really a debate at all.
Related articles
- The NSA is turning the internet into a total surveillance system
- Confessed Liar To Congress, James Clapper, Gets To Set Up The ‘Independent’ Review Over NSA Surveillance
- Jennifer Hoelzer’s Insider’s View Of The Administration’s Response To NSA Surveillance Leaks
- Pro-NSA Editorial Flails Wildly, Snarks At Internet Users And Claims Those Challenging NSA’s Reach ‘Hate Obama’
Brazil says may go to UN over NSA espionage
Press TV – August 15, 2013
Brazil says it may go to the UN over a controversial US spying program on Brazilian citizens, rejecting Washington’s claims that the operation was purely aimed at fighting terrorism.
Addressing a congressional panel on Wednesday, Brazilian Communications Minister Paulo Bernardo said Brasilia was not satisfied with the explanations presented by US Secretary of State John Kerry during his Tuesday visit.
“Consequently, we will bring the case to international organizations, probably the United Nations,” he added.
Kerry’s visit was aimed at easing diplomatic tensions with the Latin American country.
Washington has defended the espionage program as a lawful measure aimed at countering terrorist attacks across the world.
However, Bernardo stressed that the operation also “involved industrial, trade and diplomatic espionage.”
Based on documents leaked by former US intelligence contractor Edward Snowden, Washington has tapped Brazilians’ telephone conversations and emails.
They also indicate that Washington maintains an intelligence base in Brasilia, part of a network of 16 such stations operated by the US National Security Agency (NSA) around the world to intercept foreign satellite transmissions.

