Unsecure Line

A House committee unanimously approved a bill Wednesday that could significantly curtail the data collecting power of the National Security Agency. 

Under the new rule, the NSA would not be allowed to collect metadata from phone companies without first obtaining a warrant from the Foreign Intelligence Surveillance Court (FISC.)

Currently, the NSA preserves metadata for five years, which it can access at any time. The new rule would mean phone companies only need to keep the data for one year and a half and that the NSA will have to ask for it. 

The bill would also limit the number of "hops" (from 3 to 2) the NSA can make in analyzing the contact list of its targets. If James Clapper, for instance, were a current target, the NSA could access the phone records of Clapper's contacts, all of their contacts, and then also the third layer of contacts. 

When you did something wrong and are caught, you need flowers - or a good excuse. The NSA and its employees provided us with many of the latter. Here's a round-up of our favorite excuses:

1. In early January, Senator Bernie Sanders from Vermont sent a concerned letter to NSA director Keith Alexander, asking if the agency had ever spied "on members of Congress or other American elected officials." 

The answer he got eleven days later must have appeared to him more like a joke than a sincere reply. Alexander wrote, "NSA can query the metadata only based on phone numbers reasonably suspected to be associated with specific foreign terrorist groups. For that reason, NSA cannot lawfully search to determine if any records NSA has received under the program have included metadata of the phone calls of any member of Congress, other American elected officials, or any other American without the predicate.”

2. More transparency would certainly help to avoid other privacy intrusions of spy agencies in the future, you might think. Wrong - at least according to Robert Litt, general council for the Office of the Director of National Intelligence, and Bradford Wiegmann, deputy assistant attorney general.

During a Senate hearing in November 2013 on the proposed Surveillance Transparency Act of 2013, the two testified in a joint written statement, "Attempting to identify the numbers of persons or U.S. persons whose communications or information may be incidentally collected would, in practice, have a privacy-diminishing effect directly contrary to the aims of this bill.” 

This, at the same time, is an excuse for why the NSA can't distinguish between information intercepted from US citizens and non-US citizens. Only in late March, James Clapper, the Director of National Intelligence, admitted that the NSA used a loophole in the law to "lawfully" acquire information on Americans. 

3. It's all a matter of definition. As we have pointed out in a previous post, during a congressional hearing in March 2013, Senator Ron Wyden from Oregon asked Clapper, "Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?”

"Not wittingly," Clapper replied. 

The excuse here was a semantic one; the NSA doesn't collect data, because the information it intercepts is processed by computers and not humans. Both Glenn Kessler for the Washington Post and Bruce Schneier for the Defense One section of The Atlantic see this as a contradiction or even lie. 

In June 2013, Clapper admitted in a letter to Congress that "my response was clearly erroneous."

4. In case you missed this groundbreaking revelation: A small number of NSA employees used their data access privileges to spy on love interests. The activities are known as LOVEINT, a label that stands for love intelligence. 

Since Edward Snowden leaked a trove of documents to select media outlets last summer, there have been a flood of revelations about exactly what the United States’s spying arm, the National Security Agency, has been up to. It’s been almost impossible to keep up, so here’s a run down of five things you may not have heard already.

1) Taping fiber-optic cables 

In the US debate over government surveillance, one agency has been largely overlooked: GCHQ, Britain’s equivalent to the NSA. GCHQ and the NSA have been very generous in sharing information, which has greatly added to the NSA’s spying capabilities.

In fact, one Guardian article indicated GCHQ can track even more metadata than the US. That’s because the agency figured out a way to tap into fiber-optic cables, which carry internet data such as email, facebook posts, and internet search histories as well as phone calls.

Later articles showed that the NSA has also likely been taping into fiber-optic cables. 

2) Tracking which countries get spied on most

In June, The Guardian broke a story about Boundless Informant, a program which allows the NSA to see how much data it is gathering in each country in real time.

The article shows a map with the entire world, color-coded by where the most data is coming from. Perhaps not surprisingly, most of the top 5 countries are in the Middle East:

Iran, Pakistan, Jordan, Egypt, India

The United States appears to rank somewhere in the middle.

3) We can record 100 percent of a country’s phone calls

A story by the Washington Post revealed an NSA program called MYSTIC, which allows the spying agency to record all of a country’s calls and be able to play them back for a month afterwards. The technology is referred to as “retrospective retrieval.”

In 2011, the program had been used on one country and was being prepared for use on others. The Post apparently knew which countries these were, but withheld that information at the request of the US government.

4) Elite hackers intercepted computer deliveries

More revelations published by Der Spiegel revealed the existence of the Office of Tailored Access Operations, an elite hacking unit within the NSA. The tagline for TAO, as it is referred, is “getting the ungettable.”

The unit has grown immensely since 2001. “During the middle part of the last decade, the special unit succeeded in gaining access to 258 targets in 89 countries -- nearly everywhere in the world,” according to the Spiegel story.

Among the detailed activities was TAO’s history of intercepting computers being delivered through the mail and installing monitoring software.

5) NSA hit 50,000 computer networks with malware

During the past year, US officials have expressed dismay and outrage over Chinese hackers breaking into American companies and networks. But even in the face of this, a Dutch newspaper published a report, based on Snowden leaks, which showed that the NSA has infected 50,000 computer networks worldwide in order to gain sensitive information.

"Be it resolved: State surveillance is a legitimate defence of our freedoms..." So began Friday night's Munk Debate between the team of retired General Mike Hayden and trial attorney Alan Dershowitz against the team of Pulitzer Prize-winning journalist Glenn Greenwald and tech entrepreneur Alexis Ohanian.

Mr. Dershowitz made mention early that his pairing with Hayden, a Bush Administration stalwart stood in contrast to his own criticism of President Bush's practice of torturing terrorist detainees. However, that was perhaps the only daylight between the two men as Dershowitz vehemently defended the national security practices that Edward Snowden revealed last year. For the opposing team, Mr. Greenwald was relentless is his criticisms that the sweeping surveillance policies that Hayden had put into place violated the 4th Amendment and made Americans less safe than if the NSA had decided to simply pursue only terrorist leads. Mr. Ohanian largely stayed outside of the three-way fight beside him, and focused on the detrimental effects that the NSA's conduct had on commerce and the integrity of the entire internet. The four competitors stayed on-topic, but it would have been satisfying had Greenwald pointed out some weaknesses in Dershowitz's ideological stance against threats to America. After all, this is the same Alan Dershowitz who has consistently supported the release of a man convicted of spying against America for another nation.

The video linked to above has a lengthy intro sequence, so we recommend fast-forwarding to time 27:13 to see the start of the debate.

Prior to the debate's commencement, the audience was polled as to whether or not they supported the resolution. Fully 21% were undecided beforehand, but none were afterwards.

Click here to see the debate's results.

***

Despite all the revelations that have come to light in the past year, it’s very unlikely that the NSA really is aware of every word you type in an email or speak over the phone. There seems to be a wide gap between what information the agency can collect and how much of that information it can use. 

It's safe to assume that the agency hasn't yet found a way to make sense of all the data it's gathering. Even with all its manpower and spying software, its resources aren't sufficient to read every message and listen in on every call it intercepts. The sheer volume of information that's communicated today is simply overwhelming. 

Alone a look at the number of emails sent every day is impressive: almost 200 billion, according to a report by the research firm The Radicati Group.

One solution is to store the data and analyze it over a longer period of time or wait until the necessary software has been developed to get the job done. This explains the massive new NSA data center in Utah, which is scheduled to open later this year after technical difficulties have been resolved. Its size is more than five times that of the US Capitol. 

During a US Senate hearing last year, Keith Alexander, then director of the NSA, defended this approach, referring in particular to the collection of phone records. “There is no upper limit," he said. “I believe it is in the nation’s best interest to put all the phone records into a lock box that we can search when the nation needs to do it.”

But William Binney, a former NSA employee, even suggested that this bulk collection of data is hurting the day-to-day operation of the agency. "What they are doing is making themselves dysfunctional by taking all this data," he was quoted in the Wall Street Journal.

When you ask the NSA about what kind of information it collects, it won't tell you. Not even when it's about an issue as absurd as the possibility that the agency has secret information about the Malaysian Airlines flight MH370. Orly Taitz, a California lawyer and leading figure of the birther movement, submitted a FOIA request for all information held by the NSA pertaining to the missing airplane. The response she received reads, "We have determined that the fact of the existence or non-existence of the materials you request is a currently and properly classified matter in accordance with Executive Order 13526, as set forth in Subparagraph (c) of Section 1.4." 

Head over to whitehouse.gov for a rare look inside in the National Security Agency's thought process on public disclosures. 

Yesterday, Michael Daniel, an internet security adviser to the President, took to the White House's blog to explain how the NSA decides whether to tell us if it knows about an internet security breach, such as heartbleed, for instance. (The NSA maintains it knew nothing of the vulnerability, prior to the public disclosure of heartbleed's existence on April 7.)

The post combined fascinating insight, with PR government speak. Daniel notes, for instance, that sometimes when a vulnerability is left open, the NSA can pursue suspects and gain knowledge of other vulnerabilities unhampered, if it does not disclose its knowledge of any breach. 

But then he doubles back immediately:

"Building up a huge stockpile of undisclosed vulnerabilities while leaving the Internet vulnerable and the American people unprotected would not be in our national security interest. But that is not the same as arguing that we should completely forgo this tool as a way to conduct intelligence collection, and better protect our country in the long-run."

"Huh?" you ask. 

It seems like Daniel is arguing that it's flat-out bad to leave the internet vulnerable and the American people in the dark, just in the interest of "building up a huge stockpile of undisclosed vulnerabilities." But then strangely he argues in the next sentence that we shouldn't forgo using the tool in the long-run.

When it comes to making the final call on whether or not to withhold information, Daniel writes, "We have also established a disciplined, rigorous and high-level decision-making process for vulnerability disclosure."

While the process is disciplined and rigorous, Daniels wants us to know that "there are no hard and fast rules" about how decisions are ultimately made. But rest assured, dear public, that the decision making process leans "toward responsibly disclosing the vulnerability."

Last night HBO’s new series Last Week With John Oliver debuted, and Oliver’s first guest was recently retired General Keith Alexander – former director of the National Security Agency.

  Mr. Oliver was visibly delighted as he needled Gen. Alexander about his former agency’s program of collecting metadata on all Americans’ phone calls. The general insisted that the program was essential for national security, but that didn’t stop Oliver from politely mocking nearly every point Alexander raised.

  At the top of the segment, Oliver went after the NSA right away, citing a recent policy change by intelligence chief James Clapper – Gen. Alexander’s former boss --that seems completely at odds with testimony Clapper gave to Congress this past January.

  Oliver: …back in January, Director Clapper said:

Clapper: the major takeaway for us, certainly for me, from the past several months, is that we must lean in the direction of transparency whenever and wherever we can.

  Oliver: except as we learned earlier this week, after leaning in the direction of transparency, Clapper didn’t so much as lean away as he did run furiously in the opposite direction.

  Narrator: under new rules by the administration and the nation’s intel chief James Clapper, intelligence employees are banned from speaking to journalists about any intelligence-related matter.

  Oliver: well, that’ll restore the American people’s trust. As we all know the first step in rebuilding any relationship is cutting off any all communication.

  See his interview with Gen. Alexander here:

In the more than ten months since the Guardian published the first article about the NSA based on leaked documents by Edward Snowden, there has been a flood of reports and revelations. If you're looking for a good overview, have no fear. We've put together a few of the best timelines for you:

As mentioned in our last post, the Electronic Frontier Foundation is a good place to look for information about NSA news and it has a nice intuitive timeline. It combines major media reports, policy action and political events surrounding the issue. On top of that, you can filter the information in the timeline by source. It goes back all the way to the Bill of Rights in 1791.

If you're looking for something very detailed, the Wikipedia timeline is a good starting point. It lists most of what you will ever want to know about the NSA revelations. As always with Wikipedia, however, the crowd-sourced information might not be a 100-percent accurate.

ProPublica put together a timeline that looks at how the NSA intercepted vast amounts of telecommunications data and how legislation helped enable it. It starts with the Foreign Intelligence Surveillance Act (FISA) in 1978 and ends with the reactions of the White House and Congress to the Guardian story on the Verizon court order. 

Al Jazeera America put together a timeline as well. It's a little more difficult to navigate than the rest, but well worth a look. 

On March 12th 2013, Senator Ron Wyden (D-OR) asked James Clapper, Director of National Intelligence, a straight yes or no question, and Clapper lied to him under oath.

Wyden asked: "What I wanted to see is if you could give me a yes or no answer to the question 'Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?'"

Clapper responded: "No, sir."

Wyden: "It does not?"

Clapper: "Not wittingly. There are cases where they could inadvertently, perhaps, collect, but not wittingly."

Wyden later revealed that he'd even given Clapper's office that same question a day in advance, so that Director Clapper could consider his response.

But in the wake of revelations on NSA activities made public by Edward Snowden after Clapper's testimony, it is clear that Dir. Clapper lied to Congress.

Or, as a dissembling Clapper later said to Andrea Mitchell, he'd "given the least untruthful answer possible."

As a result, Rep. Darrell Issa (R-CA) and five other members of the House of Representatives sent a letter to President Barack Obama in which they call Clapper's position as DNI is "incompatible with the goal of restoring trust in our security programs and ensuring the highest levels of transparency."

And yet, Clapper has neither lost his job, nor has he been charged with perjury. Perhaps it's because he has the support of the President.

The Washington Post reported that White House spokesperson Caitlin Hayden replied via email to questions about this situation that President Obama has "full faith in Director Clapper’s leadership of the intelligence community. The Director has provided an explanation for his answers to Senator Wyden and made clear that he did not intend to mislead the Congress."

So, just to recap the Obama Administration's logic: if you get called to testify before Congress, swear to tell the truth and then lie, you are not committing perjury if you felt you had to lie to protect classified information and apologize thereafter.

1. The Extent of the NSA’s Powers

One of the first revelations from the documents leaked by former NSA employee Edward Snowden gave a glimpse of just how much information the agency could access about US citizens. The first leak showed that in April 2013 the FBI obtained a court order requiring Verizon to hand over all the information on phone calls within the US and to other countries "on an ongoing, daily basis."

The order which was ruled by the Foreign Intelligence Surveillance Court (FISA) meant that for the next three months the phone company would hand over the numbers of both parties, location, call duration, time and unique identifiers relating to the call. It showed that the NSA was not just collecting information on suspected terrorists, it also had the capabilities to indiscriminately collect information on its own citizens – whether suspected of wrongdoing or not.  

2. PRISM

One of the NSA’s most powerful surveillance programs revealed to date is PRISM. It gave the agency the ability to directly access to the servers of the some biggest technology companies in the world including Google, Yahoo!, Facebook, Hotmail, Skype, YouTube, Apple, AOL and PalTalk.

PRISM lays out how the agency can access the email, chat, videos, photos, stored data, file transfers, login activity and social networking details of users of any of the companies. It was later revealed that some companies, including Microsoft, gave the NSA direct access to encrypted messages on its servers.

3. Accessing Diplomatic Communications

The agency got into a lot of hot water over the revelations it was intercepting communications of the Russian delegation at the G20 in the UK in 2009. However it soon emerged that was the tip of the iceberg, as its capabilities extended far beyond the reach of the G20.

The EU embassy in Washington was allegedly bugged and its computer system infiltrated by the NSA. Cyber attacks were also carried out against the Washington embassy and in New York. The agency also had a further list of 38 ‘target’ embassies. It later emerged that US embassies were encouraged to share contact information with the NSA so that they can be tracked and that the agency monitored the calls of 35 world leaders including German Chancellor, Angela Merkel.

4. Cooperation with Foreign Governments

Foreign governments have collaborated with and passed information to the NSA including the UK Government Communications Headquarters (GCHQ), as well as New Zealand and Australia though their communications facilities.  

It emerged in February this year that US and UK authorities were accessing millions of Yahoo! webcam images through a program called Optic Nerve and targeted 1.8 million users in a six month period. The NSA has also paid GCHQ $160 million for influence and access to its data.  

5. Spying on Foreign Citizens

The NSA also spied on foreign citizens in allied countries. German citizens have been the targets of NSA surveillance, with up to 500 million communication points targeted through emails, texts and calls every month. The agency is believed to then store the metadata about the communications at its headquarters in Fort Meade.