Sophisticated telecommunication interception capabilities, of the sort that was used to unravel the cricket corruption scandal, are pushing the frontiers of communications intelligence.

IN the age of digital communication, criminals are often better equipped but the line is also increasingly becoming unsafe. So, it appears, is running a large corporation, managing state secrets or just being a political dissident.

Troops on border duties, even those on counter-terrorist duties in Jammu and Kashmir, have long known what Hansie Cronje and his associates evidently did not: no means of electronic communications is safe. Radio silence is maintained during all battle-fr ont operations. In emergencies, soldiers who speak Naga, Malayalam, or other languages, unlikely to be known to Pakistani signals intelligence, are pressed into service. Pakistan troops and irregulars on the Kargil heights last summer used a bewildering mix of Drassi, Shina, and Pushto in order to confuse Indian intelligence personnel, who were then forced to trawl the Kargil area for translators.

Emerging material on interception capabilities of the United States makes clear just what the future might hold. The recently-exposed Project Echelon, for example, allows the U.S. to copy almost every piece of electronic communication worldwide: every fa x transmission, every e-mail messages, every mobile phone call, every other kind of telephone conversation.

Few analysts of the cricket corruption scandal appear to have understood the capabilities of communication intelligence. The latest episode was, in fact, preceded by a series of successful technical telecommunication interception operations. Even as Indi an Airlines Flight IC 814 was on the tarmac in Kandahar last year, Research and Analysis Wing (RAW) officials had a good idea of who had carried out the hijacking, and how – thanks to a series of calls made by the Harkatul Mujahideen’s Mumbai-based opera tive, Abdul Ahmed Latif, during the course of the hijacking. Latif used a mobile telephone, and also a pay phone owned by three brothers from Jogeshwari – Rafiq Sheikh, Javed Sheikh and Muzaffar Sheikh – to remain in contact with his handlers in Karachi.

Among the calls Latif made was one to an Urdu-service staff reporter at the British Broadcasting Corporation headquarters in London, complaining about the Indian negotiators’ intransigence in Kandahar. What Latif did not know was that RAW personnel, who use sophisticated electronic equipment to scan thousands of international and domestic long-distance calls, were listening in. When RAW chief A.S. Dulat visited Jammu two days later to persuade a reluctant Chief Minister Farooq Abdullah to allow the rele ase of prisoners in exchange for the lives of the passengers on IC 814, he was able to promise rapid progress to secure justice. Working with the telephone numbers provided by RAW, Mumbai Crime Branch investigators tracked down Latif and his associates w ithin two days. Their interrogation was crucial in identifying the hijackers.

PAUL BATES / REUTERS

At Menwith Hill in the U.K., one of the data analysis centres under Project Echelon, the world’s most sophisticated intelligence gathering network. The Echelon system allows the U.S. and its associates in the controversial project to monitor almost ev ery piece of electronic communication worldwide.

Other technical operations have also been successful. In the summer of 1998, Punjab Police officials began an electronic communications sweep directed at the renewed activities of the Khalistan Liberation Force (KLF). Among the conversations that they st umbled upon were threat calls directed at affluent businessmen in Ludhiana, made by Dawood Ibrahim’s Nairobi-based associate Abu Salem, and from five unidentified mobile telephones in New Delhi. The numbers were passed on to the Delhi Crime Branch, where Inspector Ishwar Singh, responsible for the Hansie Cronje operation, was assigned charge of the investigation. The Delhi numbers were identified as belonging to the now-notorious Romesh Sharma.

By November, Delhi Police and Intelligence Bureau officials say, they held hours of taped conversations between Sharma, Abu Salem and even top businessmen like Reliance industries chief Dhirubhai Ambani. Ambani, Central Bureau of Investigation (CBI) offi cials now conducting the probe say, was being pressured to meet payments that two high-profile Mumbai stock brokers claimed as their dues. The deal may just have been closed had it not been for a fateful October 20 police raid on Sharma, carried out by c ity South Range officials who had no knowledge of the Crime Branch-Intelligence Bureau surveillance operation. Nothing significant has been heard of the affair since the CBI took charge, perhaps unsurprising given the agency’s track record in cases invol ving political corruption.

Other technical operations have not been quite as high profile, but they have led to significant results in combating terrorism. The five cellphone numbers provided by the Punjab Police in the Romesh Sharma case had also led, earlier that year, to the di scovery of a major arms-running operation run from New Delhi’s maximum security Tihar Jail. Punjab Police officials had begun by investigating reports that the KLF’s Harnek Singh ‘Bhap’ had entered into an alliance with jailed Uttar Pradesh mafia don Om Prakash ‘Babloo’ Shrivastav. The KLF, the force’s informants said, had agreed to provide personnel to execute a series of kidnappings to raise funds, while the Shrivastav gang in turn would be responsible for making available safehouses.

Surveillance led the Crime Branch investigators to some bizarre findings. Mobile phones activate the radio cells nearest to their users’ locations. The five cellphone numbers being monitored activated a single cell, that nearest to Tihar Jail. The Babbar Khalsa International (BKI), it transpired, had already cut a deal with criminals, using phones made available by corrupt prison administration officials, for the delivery of an explosives consignment. Delhi Police officials were waiting for the Haryana- registered truck when it arrived in New Delhi on August 12, 1998. A consignment of RDX or Research Department Explosive, weighing 18 kg, had been hiden in the space between the rim and the boot of the truck, along with four sophisticated electronic timin g devices.

Major breakthroughs based on technical operations came as early as 1996. Shortly after massive blasts occured in New Delhi’s Lajpat Nagar market on May 21, 1996, RAW made available intercepts that led the Srinagar Special Operations Group (SOG) of the Ja mmu and Kashmir Police to Jammu and Kashmir Islamic Front (JKIF) operative Farida Wani. Soon after, her boss, Hilal Baig, was shot dead by the SOG on July 17, 1996. Telephone intercepts also led the Gujarat Police to one of the JKIF’s top associates, Ahm edabad underworld baron and Dawood Ibrahim associate Abdul Rashid Latif. Latif was arrested from New Delhi by a Gujarat Police Anti-Terrorist Squad on October 10, 1996, and was killed later while attempting to escape from custody in Ahmedabad.

Although intelligence officials are unwilling to discuss details, sources say dozens of recent operations targeting the Lashkar-e-Taiba’s activities outside Jammu and Kashmir have been similarly based on communications intelligence. Khalistan terrorists have also been hit through technical means; the January 1999 arrest of a Babbar Khalsa operative who crossed over from Pakistan is one instance. In 1998, Indian intelligence personnel monitoring calls from two U.S.- based Khalistan financiers detected su ccessive calls to a mobile number in Chandigarh. Monitoring led the local police to the gates of the Burail Jail, where, it turned out, Beant Singh assassination-accused Jagtar Singh Hawara had been using the telephone not only to organise a jailbreak bu t to order pizzas, using the convenient address of the Jail Superintendent’s office.

JUST how, then, does communications intelligence work? Contrary to the popular perception, intercepting communications is fairly easy. Scanners can pluck mobile phone signals from the air, and many Western countries have an underground business in fake s ubscriber-identity cards. On August 27 last year, for example, the New York Police arrested three men who were intercepting pager messages meant for the city’s Mayor and Police Commissioner and then selling the contents to media outlets. A conference cal l between U.S. House Speaker Newt Gingrich and his party colleagues was similarly intercepted, and the transcript published in The New York Times. Commercially available equipment even allows remote espionage on the text being typed on a computer screen, or eavesdroppers to listen in to conversations being conducted over a hundred metres away.

Since 1997, however, is a growing body of material on the world’s largest and most sophisticated communications intelligence network, codenamed Echelon. Now the subject of growing controversy following revelations that Echelon was used by the U.S. for co mmercial espionage directed at its North Atlantic Treaty Organisation (NATO) allies, notably France, the organisation emerged from a 1947 United Kingdom-U.S. treaty on sharing intelligence. Canada, Australia and New Zealand later joined the treaty.

Unlike routine espionage operations, Echelon does not target individual electronic communications. It instead gathers vast amounts of traffic on satellites, sub-sea cables, microwave relay stations and high frequency radio. This body of information is su bjected to computer analysis at Echelon centres around the world, notably at Menwith Hill in the U.K., Pine Gap in Australia, Buckley Field near Denver in the U.S., and Bad Aibling in Germany. The computers separate the data gathered into fax, data and v oice communication. This body of material is then subject to searches for certain key words, for example ‘atomic’ or ‘missile’, or for specific telephone numbers and e-mail addresses.

A WELTER of means is available in the Echelon system to monitor almost all long-distance electronic communication. According to a report by expert Duncan Campbell, which formed the core of discussions in the European Parliament in 1998, U.S. Central Inte lligence Agency (CIA) satellites are central to the Echelon system. Satellites of the Magnum, Orion and Rutley class can target very high frequency (VHF) radios, cellular phones, pagers and mobile data links across the globe. Since only a fraction of mic rowave signals in fact arrive at the receiving station, and the rest pass into space, such traffic is also vulnerable. Satellites of the Mercury class target microwave communications, which carry much inter-city traffic. Other satellites intercept traffi c directed at communication satellites, including the Intelsat system.

Embassies and High Commissions form a second important chain in the Echelon system. Foreign missions are located in capital cities and important business centres, which also tend to be the hub for inter-city microwave networks. Since diplomatic premises are not subject to national regulations, most missions install surveillance equipment targeted at their host countries. In some cases, Echelon systems tap directly into the telecommunications infrastructure. Campbell discovered that the Menwith Hill stat ion, for example, taps directly into the British Telecom microwave hub, which receives traffic from sub-sea transatlantic cables. Some media reports have even accused U.S.-based corporations, such as Microsoft of cooperating with their governments to bui ld surveillance mechanisms into software.

Key word searches are just one of the means through which Echelon surveillance works. Since such searches are most effective for text, there has been extensive research on software that can translate voice communications into computer-readable characters . Campbell’s report to the European Parliament suggests that such technology is, at best, of only limited reliability. There has, however, been success in the matter of voice recognition software, which enables computer systems to pick out an individual speaking through the mass of intercepted data. In theory, for example, Echelon systems could detect Osama bin Laden once he initiated a conversation.

The Echelon network is not the world’s only major intelligence gathering operation, although it is by far the world’s most sophisticated. At least 30 countries operate large-scale communications intelligence operations, including India and Pakistan. The largest are outside Echelon is the Russian FAPSI, with some 54,000 employees. China also maintains a large establishment, with two stations directed at Russia in tandem with the U.S. There are no firm figures on Echelon’s budget, but reliable estimates s uggest that over $20 billion is spent worldwide on communication intelligence-related activities. Much of India’s effort has been focussed on military-related signals intelligence, which acquires not only communications but also radar data and details of Army movements.

Nor is it clear whether fighting crime or terrorism is the sole concern of major communications intelligence organisations. The 1998 European Parliament report on electronic espionage claims that U.S. intelligence intercepted conversations between govern ment officials in Brazil and the French firm Thompson-CSF. It used the information to secure a $1.3 billion contract for Thompson-CSF’s U.S. rival, Raytheon. Mike Frost, in his book Spyworld, claims that Canadian agents tapped the U.S. Ambassador’ s conversations to undercut that country’s bid for a $2.5 billion wheat deal. Frost, himself a former operative of the Canadian communication security establishment, claims that British intelligence even invited their counterparts in Canada to place unde r surveillance two politicians suspected by former Prime Minister Margaret Thatcher of political disloyalty.

NEW developments could push the frontiers of communications intelligence even further. In January, U.S. civil rights organisations challenged new rules which would compel telecommunications firms to provide on demand, without a warrant, the exact locatio n of mobile phone users to the Federal Bureau of Investigation (FBI). The new rules, which came about as a result of the Communications Assistance to Law Enforcement Act of 1994, would also mean that companies would have to deliver packet mode communicat ions, those used on the Internet, to the FBI. Echelon had allowed intelligence agencies to bypass laws forbidding unauthorised surveillance of U.S. and U.K. citizens by the simple expedient of asking their alliance counterparts, not bound by such laws, t o carry out the task.

There is little anecdotal material, and even less reliable literature, on the Indian capabilities in this field. It is known, for example, that intelligence agencies compelled pager and mobile phone companies to install surveillance equipment, but only o ther technical means that are at their disposal are not known. Few officials are willing to discuss the subject. Informed sources, however, told Frontline that RAW did have facilities to scan communications for key words, but that both the softwar e and the hardware used left more than a little to be desired. Its voice recognition capabilities too are relatively limited. Police organisations, for their part, have minimal access to such technology, which is limited relatively to simple operations s uch as mobile phone scanning. And while the pending Information Technology Bill of 1999 will give intelligence agencies wide powers to intercept Internet traffic, existing legal restrictions on telephone interception mean that little such evidence can be admitted to have been gathered in the first place, let alone used in trial courts.

When news of the cricket corruption scandal broke, commentators claimed variously that it was impossible to intercept mobile phone conversations or that the Delhi Police had secured a technological feat. Neither was true. Intercepting communications, voi ce or otherwise, is almost industrial in scale, more automated perhaps than any manufacturing process. Be sure when you next send an e-mail out into cyberspace that its recipient might not be the only one to read it with interest.

Volume 17 – Issue 09, Apr. 29 – May 12, 2000

PRAVEEN SWAMI

Find this story at 29 April 2000

Copyrights © 2000, Frontline.

No one is surprised that the United States uses sophisticated electronic spying techniques against its enemies. But Europeans are increasingly worried about allegations that the U.S. uses those same techniques to gather economic intelligence about its allies.

The most extensive claims yet came this spring in a report written for the European Parliament. The report says that the U.S.

National Security Agency, through an electronic surveillance system called Echelon, routinely tracks telephone, fax, and e-mail transmissions from around the world and passes on useful corporate intelligence to American companies.

Among the allegations: that the NSA fed information to Boeing and McDonnell Douglas enabling the companies to beat out European Airbus Industrie for a $ 6 billion contract; and that Raytheon received information that helped it win a $ 1.3 billion contract to provide radar to Brazil, edging out the French company Thomson-CSF. These claims follow previous allegations that the NSA supplied U.S. automakers with information that helped improve their competitiveness with the Japanese (see “Company Spies,” May/June 1994).

Is there truth to these allegations? The NSA is among the most secretive of U.S. intelligence agencies and won’t say much beyond the fact that its mission is “foreign signals intelligence.” The companies involved all refused to comment.

“Since the NSA’s collection capabilities are so grotesquely powerful, it’s difficult to know what’s going on over there,” says John Pike, an analyst at the watchdog group Federation of American Scientists, who has tracked the NSA for years.

This much is known: The NSA owns one of the largest collections of supercomputers in the world, and it’s an open secret–as documented in the European Parliament report–that Echelon vacuums up massive amounts of data from communications satellites and the Internet and then uses its computers to winnow it down. The system scans communications for keywords–“bomb,” for instance–that might tip off analysts to an interesting topic.

Fueling allegations of corporate espionage is the fact that defense contractors and U.S. intelligence agencies are linked extensively through business relationships. Raytheon, for instance, has large contracts to service NSA equipment, according to the European report.

Englishman Glyn Ford, the European Parliament member who initiated the study, wants the NSA to come clean about its activities in Europe. And the Europeans have some leverage on this issue, if they decide to use it. In a drive to improve surveillance, the United States is pressuring European governments to make telephone companies build eavesdropping capabilities into their new systems. But if that’s what the U.S. wants, says Ford, it’s going to have to be open about what information it’s collecting: “If we are going to leave the keys under the doormat for the United States, we want a guarantee that they’re not going to steal the family silver,” he says.

In the meantime, congressional critics have started to wonder if all that high-powered eavesdropping is limited to overseas snooping. In April, Bob Barr (R-Ga.), a member of the House Government Reform Committee, said he was worried by reports that the NSA was engaged in illicit domestic spying.

“We don’t have any direct evidence from the NSA, since they’ve refused to provide any reports, even when asked by the House Intelligence Committee,” Barr says. “But if in fact the NSA is pulling two million transmissions an hour off of these satellites, I don’t think there’s any way they have of limiting them to non-U.S. citizens.”

Last May, after the NSA stonewalled requests to discuss the issue, Congress amended the intelligence appropriations bill to require the agency to submit a report to Congress. (The bill is still in a conference committee.) And the NSA will face more questions when the Government Reform Committee holds hearings on Echelon and other surveillance programs.

“We ought to prevent any agency from the dragnet approach–where they throw out a net and drag anything in,” Barr says.

Kurt Kleiner
Mother Jones November 1, 1999

Find this story at 1 November 1999

Copyright © 2013 Mother Jones and the Foundation for National Progress.

Government Tapping CONTENT, Not Just Metadata … Using Bogus “Secret Interpretation” of Patriot Act

We reported in 2008 that foreign companies have had key roles scooping up Americans’ communications for the NSA:

At least two foreign companies play key roles in processing the information.

Specifically, an Israeli company called Narus processes all of the information tapped by AT &T (AT & T taps, and gives to the NSA, copies of all phone calls it processes), and an Israeli company called Verint processes information tapped by Verizon (Verizon also taps, and gives to the NSA, all of its calls).

Business Insider notes today:

The newest information regarding the NSA domestic spying scandal raises an important question: If America’s tech giants didn’t ‘participate knowingly’ in the dragnet of electronic communication, how does the NSA get all of their data?

One theory: the NSA hired two secretive Israeli companies to wiretap the U.S. telecommunications network.

In April 2012 Wired’s James Bamford — author of the book “The Shadow Factory: The NSA from 9/11 to the Eavesdropping on America” — reported that two companies with extensive links to Israel’s intelligence service provided hardware and software the U.S. telecommunications network for the National Security Agency (NSA).

By doing so, this would imply, companies like Facebook and Google don’t have to explicitly provide the NSA with access to their servers because major Internet Service Providers (ISPs) such as AT&T and Verizon already allows the U.S. signals intelligence agency to eavesdrop on all of their data anyway.

From Bamford (emphasis ours):

“According to a former Verizon employee briefed on the program, Verint, owned by Comverse Technology, taps the communication lines at Verizon…

At AT&T the wiretapping rooms are powered by software and hardware from Narus, now owned by Boeing, a discovery made by AT&T whistleblower Mark Klein in 2004.”

Klein, an engineer, discovered the “secret room” at AT&T central office in San Francisco, through which the NSA actively “vacuumed up Internet and phone-call data from ordinary Americans with the cooperation of AT&T” through the wiretapping rooms, emphasizing that “much of the data sent through AT&T to the NSA was purely domestic.”

NSA whistleblower Thomas Drake corroborated Klein’s assertions, testifying that while the NSA is using Israeli-made NARUS hardware to “seize and save all personal electronic communications.”

Both Verint and Narus were founded in Israel in the 1990s.

***

“Anything that comes through (an internet protocol network), we can record,” Steve Bannerman, marketing vice president of Narus, a Mountain View, California company, said. “We can reconstruct all of their e-mails along with attachments, see what web pages they clicked on, we can reconstruct their (voice over internet protocol) calls.”

With a telecom wiretap the NSA only needs companies like Microsoft, Google, and Apple to passively participate while the agency to intercepts, stores, and analyzes their communication data. The indirect nature of the agreement would provide tech giants with plausible deniability.

And having a foreign contractor bug the telecom grid would mean that the NSA gained access to most of the domestic traffic flowing through the U.S. without technically doing it themselves.

This would provide the NSA, whose official mission is to spy on foreign communications, with plausible deniability regarding domestic snooping.

The reason that Business Insider is speculating about the use of private Israeli companies to thwart the law is that 2 high-ranking members of the Senate Intelligence Committee – Senators Wyden and Udall – have long said that the government has adopted a secret interpretation of section 215 of the Patriot Act which would shock Americans, because it provides a breathtakingly wide program of spying.

Last December, top NSA whistleblower William Binney – a 32-year NSA veteran with the title of senior technical director, who headed the agency’s global digital data gathering program (featured in a New York Times documentary, and the source for much of what we know about NSA spying) – said that the government is using a secret interpretation of Section 215 of the Patriot Act which allows the government to obtain:

Any data in any third party, like any commercial data that’s held about U.S. citizens ….

(relevant quote starts at 4:19).

I called Binney to find out what he meant.

I began by asking Binney if Business Insider’s speculation was correct. Specifically, I asked Binney if the government’s secret interpretation of Section 215 of the Patriot Act was that a foreign company – like Narus, for example – could vacuum up information on Americans, and then the NSA would obtain that data under the excuse of spying on foreign entities … i.e. an Israeli company.

Binney replied no … it was broader than that.

Binney explained that the government is taking the position that it can gather and use any information about American citizens living on U.S. soil if it comes from:

Any service provider … any third party … any commercial company – like a telecom or internet service provider, libraries, medical companies – holding data about anyone, any U.S. citizen or anyone else.

I followed up to make sure I understood what Binney was saying, asking whether the government’s secret interpretation of Section 215 of the Patriot Act was that the government could use any information as long as it came from a private company … foreign or domestic. In other words, the government is using the antiquated, bogus legal argument that it was not using its governmental powers (called “acting under color of law” by judges), but that it was private companies just doing their thing (which the government happened to order all of the private companies to collect and fork over).

Binney confirmed that this was correct. This is what the phone company spying program and the Prism program – the government spying on big Internet companies – is based upon. Since all digital communications go through private company networks, websites or other systems, the government just demands that all of the companies turn them over.

Let’s use an analogy to understand how bogus this interpretation of the Patriot Act is. This argument is analogous to a Congressman hiring a hit man to shoot someone asking too many questions, and loaning him his gun to carry out the deed … and then later saying “I didn’t do it, it was that private citizen!” That wouldn’t pass the laugh test even at an unaccredited, web-based law school offered through a porn site.

I then asked the NSA veteran if the government’s claim that it is only spying on metadata – and not content – was correct. We have extensively documented that the government is likely recording content as well. (And the government has previously admitted to “accidentally” collecting more information on Americans than was legal, and then gagged the judges so they couldn’t disclose the nature or extent of the violations.)

Binney said that was not true; the government is gathering everything, including content.

Binney explained – as he has many times before – that the government is storing everything, and creating a searchable database … to be used whenever it wants, for any purpose it wants (even just going after someone it doesn’t like).

Binney said that former FBI counter-terrorism agent Tim Clemente is correct when he says that no digital data is safe (Clemente says that all digital communications are being recorded).

Binney gave me an idea of how powerful Narus recording systems are. There are probably 18 of them around the country, and they can each record 10 gigabytes of data – the equivalent of a million and a quarter emails with 1,000 characters each – per second.

Binney next confirmed the statement of the author of the Patriot Act – Congressman Jim Sensenbrenner – that the NSA spying programs violate the Patriot Act. After all, the Patriot Act is focused on spying on external threats … not on Americans.

Binney asked rhetorically: “How can an American court [FISA or otherwise] tell telecoms to cough up all domestic data?!”

Update: Binney sent the following clarifying email about content collection:

It’s clear to me that they are collecting most e-mail in full plus other text type data on the web.

As for phone calls, I don’t think they would record/transcribe the approximately 3 billion US-to-US calls every day. It’s more likely that they are recording and transcribing calls made by the 500,000 to 1,000,000 targets in the US and the world.

Posted on June 8, 2013 by WashingtonsBlog

Find this story at 8 June 2013

© 2007 – 2013 Washington’s Blog

AT&T’s central office on Folsom Street in San Francisco houses a secret room that allows the National Security Agency to monitor phone and internet traffic, according to former AT&T technician-cum-whistle-blower Mark Klein. View Slideshow

AT&T provided National Security Agency eavesdroppers with full access to its customers’ phone calls, and shunted its customers’ internet traffic to data-mining equipment installed in a secret room in its San Francisco switching center, according to a former AT&T worker cooperating in the Electronic Frontier Foundation’s lawsuit against the company.

Mark Klein, a retired AT&T communications technician, submitted an affidavit in support of the EFF’s lawsuit this week. That class action lawsuit, filed in federal court in San Francisco last January, alleges that AT&T violated federal and state laws by surreptitiously allowing the government to monitor phone and internet communications of AT&T customers without warrants.

On Wednesday, the EFF asked the court to issue an injunction prohibiting AT&T from continuing the alleged wiretapping, and filed a number of documents under seal, including three AT&T documents that purportedly explain how the wiretapping system works.

According to a statement released by Klein’s attorney, an NSA agent showed up at the San Francisco switching center in 2002 to interview a management-level technician for a special job. In January 2003, Klein observed a new room being built adjacent to the room housing AT&T’s #4ESS switching equipment, which is responsible for routing long distance and international calls.

“I learned that the person whom the NSA interviewed for the secret job was the person working to install equipment in this room,” Klein wrote. “The regular technician work force was not allowed in the room.”

Klein’s job eventually included connecting internet circuits to a splitting cabinet that led to the secret room. During the course of that work, he learned from a co-worker that similar cabinets were being installed in other cities, including Seattle, San Jose, Los Angeles and San Diego.

“While doing my job, I learned that fiber optic cables from the secret room were tapping into the Worldnet (AT&T’s internet service) circuits by splitting off a portion of the light signal,” Klein wrote.

The split circuits included traffic from peering links connecting to other internet backbone providers, meaning that AT&T was also diverting traffic routed from its network to or from other domestic and international providers, according to Klein’s statement.

The secret room also included data-mining equipment called a Narus STA 6400, “known to be used particularly by government intelligence agencies because of its ability to sift through large amounts of data looking for preprogrammed targets,” according to Klein’s statement.

Narus, whose website touts AT&T as a client, sells software to help internet service providers and telecoms monitor and manage their networks, look for intrusions, and wiretap phone calls as mandated by federal law.

Klein said he came forward because he does not believe that the Bush administration is being truthful about the extent of its extrajudicial monitoring of Americans’ communications.

“Despite what we are hearing, and considering the public track record of this administration, I simply do not believe their claims that the NSA’s spying program is really limited to foreign communications or is otherwise consistent with the NSA’s charter or with FISA,” Klein’s wrote. “And unlike the controversy over targeted wiretaps of individuals’ phone calls, this potential spying appears to be applied wholesale to all sorts of internet communications of countless citizens.”

After asking for a preview copy of the documents last week, the government did not object to the EFF filing the paper under seal, although the EFF asked the court Wednesday to make the documents public.

One of the documents is titled “Study Group 3, LGX/Splitter Wiring, San Francisco,” and is dated 2002. The others are allegedly a design document instructing technicians how to wire up the taps, and a document that describes the equipment installed in the secret room.

In a letter to the EFF, AT&T objected to the filing of the documents in any manner, saying that they contain sensitive trade secrets and could be “could be used to ‘hack’ into the AT&T network, compromising its integrity.”

According to court rules, AT&T has until Thursday to file a motion to keep the documents sealed. The government could also step in to the case and request that the documents not be made public, or even that the entire lawsuit be barred under the seldom-used State Secrets Privilege.

AT&T spokesman Walt Sharp declined to comment on the allegations, citing a company policy of not commenting on litigation or matters of national security, but did say that “AT&T follows all laws following requests for assistance from government authorities.”

Ryan Singel 04.07.06

Find this story at 4 July 2006

Wired.com © 2013 Condé Nast

Israeli high-tech firms Verint and Narus have had connections with U.S. companies and Israeli intelligence in the past, and ties between the countries’ intelligence agencies remain strong.

Were Israeli companies Verint and Narus the ones that collected information from the U.S. communications network for the National Security Agency?

The question arises amid controversy over revelations that the NSA has been collecting the phone records of hundreds of millions of Americans every day, creating a database through which it can learn whether terror suspects have been in contact with people in the United States. It also was disclosed this week that the NSA has been gathering all Internet usage – audio, video, photographs, emails and searches – from nine major U.S. Internet providers, including Microsoft and Google, in hopes of detecting suspicious behavior that begins overseas.

According to an article in the American technology magazine “Wired” from April 2012, two Israeli companies – which the magazine describes as having close connections to the Israeli security community – conduct bugging and wiretapping for the NSA.

Verint, which took over its parent company Comverse Technology earlier this year, is responsible for tapping the communication lines of the American telephone giant Verizon, according to a past Verizon employee sited by James Bamford in Wired. Neither Verint nor Verizon commented on the matter.

Natus, which was acquired in 2010 by the American company Boeing, supplied the software and hardware used at AT&T wiretapping rooms, according to whistleblower Mark Klein, who revealed the information in 2004. Klein, a past technician at AT&T who filed a suit against the company for spying on its customers, revealed a “secret room” in the company’s San Fransisco office, where the NSA collected data on American citizens’ telephone calls and Internet surfing.

Klein’s claims were reinforced by former NSA employee Thomas Drake who testified that the agency uses a program produced by Narus to save the personal electrical communications of AT&T customers.

Both Verint and Narus have ties to the Israeli intelligence agency and the Israel Defense Forces intelligence-gathering unit 8200. Hanan Gefen, a former commander of the 8200 unit, told Forbes magazine in 2007 that Comverse’s technology, which was formerly the parent company of Verint and merged with it this year, was directly influenced by the technology of 8200. Ori Cohen, one of the founders of Narus, told Fortune magazine in 2001 that his partners had done technology work for the Israeli intelligence.

International intel

The question of whether intelligence communities outside the United States were involved has been raised. According to The Guardian, the Government Communications Headquarters (GCHQ), Britain’s intelligence agency, secretly collected intelligence information from the world’s largest Internet companies via the American program PRISM. According to a top secret document obtained by The Guardian, GCHQ had access to PRISM since 2010 and it used the information to prepare 197 intelligence reports last year. In a statement to the Guardian, GCHQ, said it “takes its obligations under the law very seriously.”

According to The Guardian, details of GCHQ’s use of PRISM are set out in a 41-page PowerPoint presentation prepared for senior NSA analysts, and describe a “snooping” operation that gave the NSA and FBI access to the systems of nine Internet giants, including Google, Facebook, Microsoft, Apple, Yahoo and Skype.

Given the close ties between U.S. and Israeli intelligence, the question arises as to whether Israeli intelligence, including the Mossad, was party to the secret.

Obama stands by spies

At turns defensive and defiant, U.S. President Barack Obama stood by the spy programs revealed this week.

He declared Friday that his country is “going to have to make some choices” balancing privacy and security, launching a vigorous defense of formerly secret programs that sweep up an estimated 3 billion phone calls a day and amass Internet data from U.S. providers in an attempt to thwart terror attacks.

Obama also warned that it will be harder to detect threats against the United States now that the two top-secret tools to target terrorists have been so thoroughly publicized.

“Nobody is listening to your telephone calls,” Obama assured the nation after two days of reports that many found unsettling. What the government is doing, he said, is digesting phone numbers and the durations of calls, seeking links that might “identify potential leads with respect to folks who might engage in terrorism.” If there’s a hit, he said, “if the intelligence community then actually wants to listen to a phone call, they’ve got to go back to a federal judge, just like they would in a criminal investigation.”

Tapping thwarted terror attack

While Obama said the aim of the programs is to make America safe, he offered no specifics about how the surveillance programs have done this. House Intelligence Committee Chairman Mike Rogers, R-Mich., on Thursday said the phone records sweeps had thwarted a domestic terror attack, but he also didn’t offer specifics.

U.S. government sources said on Friday that the attack in question was an Islamist militant plot to bomb the New York City subway system in 2009.

Obama asserted his administration had tightened the phone records collection program since it started in the George W. Bush administration and is auditing the programs to ensure that measures to protect Americans’ privacy are heeded – part of what he called efforts to resist a mindset of “you know, `Trust me, we’re doing the right thing. We know who the bad guys are.'”

But again, he provided no details on how the program was tightened or what the audit is looking at.

Obama: 100% privacy is impossible

The furor this week has divided Congress, and led civil liberties advocates and some constitutional scholars to accuse Obama of crossing a line in the name of rooting out terror threats.

Obama, himself a constitutional lawyer, strove to calm Americans’ fears – but also remind them that Congress and the courts had signed off on the surveillance.

“I think the American people understand that there are some trade-offs involved,” Obama said when questioned by reporters at a health care event in San Jose, California.

“It’s important to recognize that you can’t have 100 percent security and also then have 100 percent privacy and zero inconvenience,” he said. “We’re going to have to make some choices as a society. And what I can say is that in evaluating these programs, they make a difference in our capacity to anticipate and prevent possible terrorist activity.”

Obama said U.S. intelligence officials are looking at phone numbers and lengths of calls – not at people’s names – and not listening in.

The two classified surveillance programs were revealed this week in newspaper reports that showed, for the first time, how deeply the National Security Agency dives into telephone and Internet data to look for security threats. The new details were first reported by The Guardian and The Washington Post, and prompted Director of National Intelligence James Clapper to take the unusual and reluctant step of acknowledging the programs’ existence.

Obama echoed intelligence experts – both inside and outside the government – who predicted that potential attackers will find other, secretive ways to communicate now that they know that their phone and Internet records may be targeted.

By TheMarker, Haaretz, The Associated Press and Reuters | Jun.08, 2013 | 12:41 PM | 17

Find this story at 8 June 2013

© Haaretz Daily Newspaper Ltd.

WASHINGTON—The National Security Agency’s monitoring of Americans includes customer records from the three major phone networks as well as emails and Web searches, and the agency also has cataloged credit-card transactions, said people familiar with the agency’s activities.

Jerry Seib explains how the far-reaching data collection conducted by the U.S. government includes phone companies in addition to Verizon, plus Internet service providers and Apple. Photo: Getty Images

The disclosure this week of an order by a secret U.S. court for Verizon Communications Inc.’s phone records set off the latest public discussion of the program. But people familiar with the NSA’s operations said the initiative also encompasses phone-call data from AT&T Inc. and Sprint Nextel Corp., records from Internet-service providers and purchase information from credit-card providers.

The Obama administration says its review of complete phone records of U.S. citizens is a “necessary tool” in protecting the nation from terror threats. Is this the accepted new normal, or has the Obama administration pushed the bounds of civil liberties? Cato Institute Director of Information Policy Studies Jim Harper weighs in. Photo: Getty Images.

The agency is using its secret access to the communications of millions of Americans to target possible terrorists, said people familiar with the effort.

The NSA’s efforts have become institutionalized—yet not so well known to the public—under laws passed in the wake of the Sept. 11, 2001, attacks. Most members of Congress defended them Thursday as a way to root out terrorism, but civil-liberties groups decried the program.
Vote and comment

The National Security Agency is obtaining phone records from all Verizon U.S. customers under a secret court order, according to a newspaper report and ex-officials. WSJ intelligence correspondent Siobhan Gorman joins MoneyBeat. Photo: AP.

“Everyone should just calm down and understand this isn’t anything that is brand new,” said Senate Majority Leader Harry Reid (D., Nev.), who added that the phone-data program has “worked to prevent” terrorist attacks.

Senate Intelligence Chairman Dianne Feinstein (D., Calif.) said the program is lawful and that it must be renewed by the secret U.S. court every three months. She said the revelation about Verizon, reported by the London-based newspaper the Guardian, seemed to coincide with its latest renewal.
All Things D
The Laws That Make It Easy for the Government to Spy on Americans
More
What the NSA Wants to Know About You and Your Phone
Tech Companies’ Data Is Also Tapped
FISA Court in Focus
Obama’s Civil-Liberties Record Questioned
When NSA Calls, Companies Answer
Mixed Reactions on Hill
Lawmakers Push Holder for Briefing on Phone Records | More Reaction
Verizon Says Must Comply with Data Requests
Government Is Tracking Verizon Calls
NSA’s Domestic Spying Grows as Agency Sweeps Up Data (3/10/2008)
NSA Exceeds Legal Limits in Eavesdropping Program (4/16/2009)
U.S. Plans ‘Perfect Citizen’ Cyber Shield for Utilities, Companies (7/8/2010)
NSA Activities Violated Fourth Amendment Rights, Letter Discloses (7/20/2012)

Civil-liberties advocates slammed the NSA’s actions. “The most recent surveillance program is breathtaking. It shows absolutely no effort to narrow or tailor the surveillance of citizens,” said Jonathan Turley, a constitutional law expert at George Washington University.

Meanwhile, the Obama administration acknowledged Thursday a secret NSA program dubbed Prism, which a senior administration official said targets only foreigners and was authorized under U.S. surveillance law. The Washington Post and the Guardian reported earlier Thursday the existence of the previously undisclosed program, which was described as providing the NSA and FBI direct access to server systems operated by tech companies that include Google Inc., Apple Inc., Facebook Inc., Yahoo Inc., Microsoft Corp. and Skype. The newspapers, citing what they said was an internal NSA document, said the agencies received the contents of emails, file transfers and live chats of the companies’ customers as part of their surveillance activities of foreigners whose activity online is routed through the U.S. The companies mentioned denied knowledge or participation in the program.

The arrangement with Verizon, AT&T and Sprint, the country’s three largest phone companies means, that every time the majority of Americans makes a call, NSA gets a record of the location, the number called, the time of the call and the length of the conversation, according to people familiar with the matter. The practice, which evolved out of warrantless wiretapping programs begun after 2001, is now approved by all three branches of the U.S. government.

AT&T has 107.3 million wireless customers and 31.2 million landline customers. Verizon has 98.9 million wireless customers and 22.2 million landline customers while Sprint has 55 million customers in total.

NSA also obtains access to data from Internet service providers on Internet use such as data about email or website visits, several former officials said. NSA has established similar relationships with credit-card companies, three former officials said.

It couldn’t be determined if any of the Internet or credit-card arrangements are ongoing, as are the phone company efforts, or one-shot collection efforts. The credit-card firms, phone companies and NSA declined to comment for this article.
From the Archives

More
Video: U.S. Data Gathering Highlights Carriers’ Balancing Act
Video: U.S. Tracks Verizon Calls: A Lawyer’s Take

Though extensive, the data collection effort doesn’t entail monitoring the content of emails or what is said in phone calls, said people familiar with the matter. Investigators gain access to so-called metadata, telling them who is communicating, through what medium, when, and where they are located.

But the disconnect between the program’s supporters and detractors underscored the difficulty Congress has had navigating new technology, national security and privacy.

The Obama administration, which inherited and embraced the program from the George W. Bush administration, moved Thursday to forcefully defend it. White House spokesman Josh Earnest called it “a critical tool in protecting the nation from terror threats.”

But Sen. Ron Wyden (D., Ore.), said he has warned about the breadth of the program for years, but only obliquely because of classification restrictions.

“When law-abiding Americans call their friends, who they call, when they call, and where they call from is private information,” he said. “Collecting this data about every single phone call that every American makes every day would be a massive invasion of Americans’ privacy.”

In the wake of the Sept. 11 attacks, phone records were collected without a court order as a component of the Bush-era warrantless surveillance program authorized by the 2001 USA Patriot Act, which permitted the collection of business records, former officials said.

The ad hoc nature of the NSA program changed after the Bush administration came under criticism for its handling of a separate, warrantless NSA eavesdropping program.

President Bush acknowledged its existence in late 2005, calling it the Terrorist Surveillance Program, or TSP.

When Democrats retook control of Congress in 2006, promising to investigate the administration’s counterterrorism policies, Bush administration officials moved to formalize court oversight of the NSA programs, according to former U.S. officials.

Congress in 2006 also made changes to the Patriot Act that made it easier for the government to collect phone-subscriber data under the Foreign Intelligence Surveillance Act.

Those changes helped the NSA collection program become institutionalized, rather than one conducted only under the authority of the president, said people familiar with the program.

Along with the TSP, the NSA collection of phone company customer data was put under the jurisdiction of a secret court that oversees the Foreign Intelligence Surveillance Act, according to officials.

David Kris, a former top national security lawyer at the Justice Department, told a congressional hearing in 2009 that the government first used the so-called business records authority in 2004.

At the time he was urging the reauthorization of the business-records provisions, known as Section 215 of the Patriot Act, which Congress later approved.

The phone records allow investigators to establish a database used to run queries when there is “reasonable, articulable suspicion” that the records are relevant and related to terrorist activity, Ms. Feinstein said Thursday.

Director of National Intelligence James Clapper also issued a defense of the phone data surveillance program, saying it is governed by a “robust legal regime.” Under the court order, the data can only “be queried when there is a reasonable suspicion, based on specific facts, that the particular basis for the query is associated with a foreign terrorist organization.” When the data is searched, all information acquired is “subject to strict restrictions on handling” overseen by the Justice Department and the surveillance court, and the program is reviewed roughly every 90 days, he said. Another U.S. official said less than 1% of the records are accessed.

The database allows investigators to “map” individuals connected with that information, said Jeremy Bash, who until recently was chief of staff at the Pentagon and is a former chief counsel to the House Intelligence committee.

“We are trying to find a needle in a haystack, and this is the haystack,” Mr. Bash said, referring to the database.

Sen. Wyden on Thursday questioned whether U.S. officials have been truthful in public descriptions of the program. In March, Mr. Wyden noted, he questioned Mr. Clapper, who said the NSA did not “wittingly” collect any type of data pertaining to millions Americans. Spokesmen for Mr. Clapper didn’t respond to requests for comment.

For civil libertarians, this week’s disclosure of the court authorization for part of the NSA program could offer new avenues for challenges. Federal courts largely have rebuffed efforts that target NSA surveillance programs, in part because no one could prove the information was being collected. The government, under both the Bush and Obama administrations, has successfully used its state-secrets privilege to block such lawsuits.

Jameel Jaffer, the American Civil Liberties Union’s deputy legal director, said the fact the FISA court record has now become public could give phone-company customers standing to bring a lawsuit.

“Now we have a set of people who can show they have been monitored,” he said.

Updated June 7, 2013, 9:25 a.m. ET

By SIOBHAN GORMAN, EVAN PEREZ and JANET HOOK

—Danny Yadron and Jennifer Valentino-DeVries contributed to this article.

Find this story at 7 June 2013

Copyright 2012 Dow Jones & Company, Inc. All Rights Reserved

The Carlyle Group has spent years attempting to shed its image as a well-connected private equity firm leveraging Washington heavyweights in the defense sector. Instead, it nurtured a reputation as a financially sophisticated asset manager that buys and sells everything from railroads to oil refineries.

The recent disclosures involving National Security Agency surveillance on U.S. citizens by an employee of Booz Allen Hamilton, a Virginia consulting firm that is majority owned by Carlyle, has thrust two of Washington’s most prominent corporate entities uncomfortably into the limelight, bound by the thread of turning government secrets into profits.

Booz Allen employee Edward Snowden was fired Tuesday after he confessed to being the source of stories about NSA data collection programs. Federal investigators are examining how Snowden, who worked at an NSA facility in Hawaii and had also worked for the CIA, was able to gain access to sensitive information.

Carlyle declined to comment.

Booz Allen, based in Tysons Corner, has been a local fixture for years, employing thousands and providing management and consulting services to the government, particularly the defense and intelligence agencies. It even sponsored a local golf tournament — the Booz Allen Classic — between 2004 and 2006.

It also became a leader among the contractors supplying tens of thousands of intelligence analysts to the government in recent years, including technologists such as Snowden.

Those government contracts, and thousands more like them, in 2008 made Booz Allen a ripe acquisition target for Carlyle.

It paid $2.54 billion for Booz Allen as a deep recession took hold. Fearing the risks of taking on too much debt in the midst of a financial crisis, Carlyle put up 50 percent cash instead of its normal 30 percent. It borrowed the rest to buy the company, which was then privately held.

Upon the close of the deal, the less profitable international and commercial business was spun off to become Booz & Co., leaving Carlyle with a government-only company.

After the split, the new Booz Allen Hamilton established an incentive-based compensation structure that gave the remaining partners a stake in the firm’s success. In effect, said one person close to the deal who was not authorized to speak publicly, “you got to eat what you killed.”

The incentives helped spur profits.

“Everybody has a responsibility, depending on your title, to bring in a certain amount of business,” said William Loomis, managing director at financial services firm Stifel Nicolaus.

Booz Allen, which employs 24,500, had a net profit of $219 million on revenue of nearly $5.8 billion for the fiscal year ended March 31. For the same period ending in 2010, the year the company went public, the company earned $25 million on $5.1 billion in revenue.

George A. Price Jr., senior equity research analyst for aerospace, defense and government services at BB&T Capital Markets, said “they’ve got a great brand, they’ve focused over time on hiring top people, including bringing on people who have a lot of senior government experience.”

Carlyle has cashed in on the increased demand of Booz Allen’s services. As profits and revenue have grown, Booz Allen has borrowed money to pay dividends to shareholders, including Carlyle.

Carlyle collected nearly $550 million in dividends in 2009 alone. Last year, Booz Allen issued another special shareholder dividend valued at $765 million — most of which went to Carlyle investors.

Booz Allen went public in 2010, and Carlyle now owns 95.66 million shares — around 69 percent of the total shares outstanding — valued at about $1.66 billion at the current stock price.

As government contracting began to wane, Booz Allen has pursued commercial work and opened an office in Abu Dhabi in the United Arab Emirates. The contractor, for instance, is marketing cybersecurity and other services to Middle Eastern companies and governments.

The moves are at least partly in response to federal budget cutting, which has taken a toll on the business.

“We consider ourselves a well-run company, and in the past year we’ve become even better in managing our business in a difficult market for government contracting,” Booz Allen spokesman James Fisher said.

Price, the analyst, said the company has seen revenue and profit declines more recently. “They’re not immune from the current environment,” he said, adding that the cuts the company has made have “blunted” the effect.

Carlyle may ultimately reap as much as $3 billion on its initial nearly $1 billion investment. In the end, Booz Allen is shaping up to be one of the firm’s biggest home runs.

By Thomas Heath and Marjorie Censer, Published: June 12

Find this story at 12 June 2013

© The Washington Post Company

WASHINGTON: The explosive leak uncovering America’s vast surveillance program highlights the risks Washington takes by entrusting so much of its defense and spy work to private firms, experts said on Monday.

From analyzing intelligence to training new spies, jobs that were once performed by government employees are now carried out by paid contractors, in a dramatic shift that began in the 1990s amid budget pressures.

Edward Snowden, the 29-year-old man whose leak uncovered how spy agencies sift through phone records and Internet traffic, is among a legion of private contractors who make up nearly 30 percent of the workforce in intelligence agencies.

After the attacks of September 11, 2001, the use of contractors boomed, as government agencies turned to private firms in the global hunt for terror suspects, touting it as a cost-effective way to avoid a permanent increase in the number of civil servants.

As a “contractor alley” rose in the suburbs of northern Virginia outside Washington, the increasing reliance on contractors by the Pentagon and spy services has often been criticized as wasteful and possibly corrupt. But some former intelligence officers and experts warn that it also opens up the spy agencies to big security risks.

The contractors who wear a “green badge” to enter government offices may lack the ethos and discretion of career intelligence officers who wear the “blue badge,” according to John Schindler, a former analyst at the National Security Agency and counterintelligence officer. In a series of tweets, Schindler, who now teaches at the Naval War College, heaped scorn on Snowden for spilling secrets.

But he said it was not surprising the disclosure came from a “green badge” holder and suggested sensitive information technology jobs should not be contracted out. “Been telling my CI (counter intelligence) peeps for years that NSA & IC ( intelligence community) only 1 disgruntled, maladjusted IT dork away from disaster (esp IT contractor)…oh well,” he wrote.

Systems administrators are the 21st century equivalent of the Cold War-era “code clerks,” he said, as they may not hold a high rank but have access to vital information.

Most contractors are former military or intelligence officers, and America’s top spy chief, James Clapper, once worked at Booz Allen Hamilton, the same firm that employed Snowden. Another former national intelligence director, Michael McConnell, also worked at the firm before and after holding the director’s post.

Booz Allen has profited heavily from intelligence work, reportedly earning $1.3 billion or 23 percent of its total revenue from contracts with spy agencies. Former CIA director and defense secretary Robert Gates has voiced concern that too much sensitive work has been farmed out to private companies.

“You want somebody who’s really in it for a career because they’re passionate about it and because they care about the country and not just because of the money,” he told the Washington Post in 2010.

A special website lists job openings for those with security credentials, clearancejobs.com, with positions advertised such as “Intelligence Analyst 3/Targeter” for Northrop Grumman.

“The primary function of a Specialized Skills Officer is to collaborate with a team of intelligence professionals in support of HUMINT operations against priority targets,” said the notice for a workplace in McLean, Virgina.

But the threat of damaging leaks may have less to do with a dependence on contractors and more to do with a younger generation’s distrust of Washington, said James Lewis, a former senior official and cyber security expert at the Center for Strategic and International Studies.

Private contracting does not in and itself pose a serious threat to keeping secrets, Lewis told AFP. “It’s a risk because of the differing attitudes of generations,” he said. “People who haven’t been in the federal service for a long time, who have this view of government shaped by the popular culture are probably more inclined to do this.”

He noted that the most extensive leak of US classified documents came not from a contractor but a low-ranking soldier in the US Army, Private Bradley Manning, who is on trial on espionage charges after admitting to handing over hundreds of thousands of secret files to the WikiLeaks website.

AFP Jun 11, 2013, 04.52AM IST

Find this story at 11 June 2013

© 2013 Bennett, Coleman & Co. Ltd.

The top-secret Boundless Informant tool details and maps by country the voluminous amount of information it collects from computer and telephone networks

guardian.co.uk, Saturday 8 June 2013 20.11 BST

Find this story at 8 June 2013

Revealed: The NSA’s powerful tool for cataloguing global surveillance data – including figures on US collection

The color scheme ranges from green (least subjected to surveillance) through yellow and orange to red (most surveillance). Note the ‘2007’ date in the image relates to the document from which the interactive map derives its top secret classification, not to the map itself.

The National Security Agency has developed a powerful tool for recording and analysing where its intelligence comes from, raising questions about its repeated assurances to Congress that it cannot keep track of all the surveillance it performs on American communications.

The Guardian has acquired top-secret documents about the NSA datamining tool, called Boundless Informant, that details and even maps by country the voluminous amount of information it collects from computer and telephone networks.

The focus of the internal NSA tool is on counting and categorizing the records of communications, known as metadata, rather than the content of an email or instant message.

The Boundless Informant documents show the agency collecting almost 3 billion pieces of intelligence from US computer networks over a 30-day period ending in March 2013. One document says it is designed to give NSA officials answers to questions like, “What type of coverage do we have on country X” in “near real-time by asking the SIGINT [signals intelligence] infrastructure.”

An NSA factsheet about the program, acquired by the Guardian, says: “The tool allows users to select a country on a map and view the metadata volume and select details about the collections against that country.”

Under the heading “Sample use cases”, the factsheet also states the tool shows information including: “How many records (and what type) are collected against a particular country.”

A snapshot of the Boundless Informant data, contained in a top secret NSA “global heat map” seen by the Guardian, shows that in March 2013 the agency collected 97bn pieces of intelligence from computer networks worldwide.
The heat map reveals how much data is being collected from around the world. Note the ‘2007’ date in the image relates to the document from which the interactive map derives its top secret classification, not to the map itself.

Iran was the country where the largest amount of intelligence was gathered, with more than 14bn reports in that period, followed by 13.5bn from Pakistan. Jordan, one of America’s closest Arab allies, came third with 12.7bn, Egypt fourth with 7.6bn and India fifth with 6.3bn.

The heatmap gives each nation a color code based on how extensively it is subjected to NSA surveillance. The color scheme ranges from green (least subjected to surveillance) through yellow and orange to red (most surveillance).

The disclosure of the internal Boundless Informant system comes amid a struggle between the NSA and its overseers in the Senate over whether it can track the intelligence it collects on American communications. The NSA’s position is that it is not technologically feasible to do so.

At a hearing of the Senate intelligence committee In March this year, Democratic senator Ron Wyden asked James Clapper, the director of national intelligence: “Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?”

“No sir,” replied Clapper.

Judith Emmel, an NSA spokeswoman, told the Guardian in a response to the latest disclosures: “NSA has consistently reported – including to Congress – that we do not have the ability to determine with certainty the identity or location of all communicants within a given communication. That remains the case.”

Other documents seen by the Guardian further demonstrate that the NSA does in fact break down its surveillance intercepts which could allow the agency to determine how many of them are from the US. The level of detail includes individual IP addresses.

IP address is not a perfect proxy for someone’s physical location but it is rather close, said Chris Soghoian, the principal technologist with the Speech Privacy and Technology Project of the American Civil Liberties Union. “If you don’t take steps to hide it, the IP address provided by your internet provider will certainly tell you what country, state and, typically, city you are in,” Soghoian said.

That approximation has implications for the ongoing oversight battle between the intelligence agencies and Congress.

On Friday, in his first public response to the Guardian’s disclosures this week on NSA surveillance, Barack Obama said that that congressional oversight was the American peoples’ best guarantee that they were not being spied on.

“These are the folks you all vote for as your representatives in Congress and they are being fully briefed on these programs,” he said. Obama also insisted that any surveillance was “very narrowly circumscribed”.

Senators have expressed their frustration at the NSA’s refusal to supply statistics. In a letter to NSA director General Keith Alexander in October last year, senator Wyden and his Democratic colleague on the Senate intelligence committee, Mark Udall, noted that “the intelligence community has stated repeatedly that it is not possible to provide even a rough estimate of how many American communications have been collected under the Fisa Amendments Act, and has even declined to estimate the scale of this collection.”

At a congressional hearing in March last year, Alexander denied point-blank that the agency had the figures on how many Americans had their electronic communications collected or reviewed. Asked if he had the capability to get them, Alexander said: “No. No. We do not have the technical insights in the United States.” He added that “nor do we do have the equipment in the United States to actually collect that kind of information”.

Soon after, the NSA, through the inspector general of the overall US intelligence community, told the senators that making such a determination would jeopardize US intelligence operations – and might itself violate Americans’ privacy.

“All that senator Udall and I are asking for is a ballpark estimate of how many Americans have been monitored under this law, and it is disappointing that the inspectors general cannot provide it,” Wyden told Wired magazine at the time.

The documents show that the team responsible for Boundless Informant assured its bosses that the tool is on track for upgrades.

The team will “accept user requests for additional functionality or enhancements,” according to the FAQ acquired by the Guardian. “Users are also allowed to vote on which functionality or enhancements are most important to them (as well as add comments). The BOUNDLESSINFORMANT team will periodically review all requests and triage according to level of effort (Easy, Medium, Hard) and mission impact (High, Medium, Low).”

Emmel, the NSA spokeswoman, told the Guardian: “Current technology simply does not permit us to positively identify all of the persons or locations associated with a given communication (for example, it may be possible to say with certainty that a communication traversed a particular path within the internet. It is harder to know the ultimate source or destination, or more particularly the identity of the person represented by the TO:, FROM: or CC: field of an e-mail address or the abstraction of an IP address).

“Thus, we apply rigorous training and technological advancements to combine both our automated and manual (human) processes to characterize communications – ensuring protection of the privacy rights of the American people. This is not just our judgment, but that of the relevant inspectors general, who have also reported this.”

She added: “The continued publication of these allegations about highly classified issues, and other information taken out of context, makes it impossible to conduct a reasonable discussion on the merits of these programs.”

Glenn Greenwald and Ewen MacAskill
guardian.co.uk, Tuesday 11 June 2013 14.00 BST
Additional reporting: James Ball in New York and Spencer Ackerman in Washington

Find this story at 11 June 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.

Analysts at the National Security Agency can now secretly access real-time user data provided by as many as 50 American companies, ranging from credit rating agencies to internet service providers, two government officials familiar with the arrangements said.

Several of the companies have provided records continuously since 2006, while others have given the agency sporadic access, these officials said. These officials disclosed the number of participating companies in order to provide context for a series of disclosures about the NSA’s domestic collection policies. The officials, contacted independently, repeatedly said that “domestic collection” does not mean that the target is based in the U.S. or is a U.S. citizen; rather, it refers only to the origin of the data.

The Wall Street Journal reported today that U.S. credit card companies had also provided customer information. The officials would not disclose the names of the companies because, they said, doing so would provide U.S. enemies with a list of companies to avoid. They declined to confirm the list of participants in an internet monitoring program revealed by the Washington Post and the Guardian, but both confirmed that the program existed.

“The idea is to create a mosaic. We get a tip. We vet it. Then we mine the data for intelligence,” one of the officials said.

In a statement, Director of National Intelligence James Clapper said that programs collect communications “pursuant to section 702 of the Foreign Intelligence Surveillance Act, ” and “cannot be used to intentionally target any U.S. citizen, any other U.S person, or anyone within the United States.”

He called the leaks “reprehensible” and said the program “is among the most important” sources of “valuable” intelligence information the government takes in.

One of the officials who spoke to me said that because data types are not standardized, the NSA needs several different collection tools, of which PRISM, disclosed today by the Guardian and the Washington Post, is one. PRISM works well because it is able to handle several different types of data streams using different basic encryption methods, the person said. It is a “front end” system, or software, that allows an NSA analyst to search through the data and pull out items of significance, which are then stored in any number of databases. PRISM works with another NSA program to encrypt and remove from the analysts’ screen data that a computer or the analyst deems to be from a U.S. person who is not the subject of the investigation, the person said. A FISA order is required to continue monitoring and analyzing these datasets, although the monitoring can start before an application package is submitted to the Foreign Intelligence Surveillance Court.

From the different types of data, including their credit card purchases, the locations they sign in to the internet from, and even local police arrest logs, the NSA can track people it considers terrorism or espionage suspects in near-real time. An internet geo-location cell is on constant standby to help analysts determine where a subject logs in from. Most of the collection takes place on subjects outside the U.S, but a large chunk of the world’s relevant communication passes through American companies with servers on American soil. So the NSA taps in locally to get at targets globally.

It is not clear how the NSA interfaces with the companies. It cannot use standard law enforcement transmission channels to do, since most use data protocols that are not compatible with that hardware. Several of the companies mentioned in the Post report deny granting access to the NSA, although it is possible that they are lying, or that the NSA’s arrangements with the company are kept so tightly compartmentalized that very few people know about it. Those who do probably have security clearances and are bound by law not to reveal the arrangement.

This arrangement allows the U.S. companies to “stay out of the intelligence business,” one of the officials said. That is, the government bears the responsibility for determining what’s relevant, and the company can plausibly deny that it subjected any particular customer to unlawful government surveillance. Previously, Congressional authors of the FAA said that such a “get out of jail free” card was insisted by corporations after a wave of lawsuits revealed the extent of their cooperation with the government.

It is possible, but not likely, that the NSA clandestinely burrows into servers on American soil, without the knowledge of the company in question, although that would be illegal.

The 2008 FISA Amendments Act allow the NSA to analyze, with court orders, domestic communications of all types for counter-terrorism, counter-espionage, counter-narcotics and counter-proliferation purposes. If the agency believes that both ends of the communication, or the circle of those communicating, are wholly within the U.S., the FBI takes over. If one end of the conversation is outside the U.S., the NSA keeps control of the monitoring. An administration official said that such monitoring is subject to “extensive procedures,” but as the Washington Post reported, however, it is often very difficult to segregate U.S. citizens and residents from incidental contact.

One official likened the NSA’s collection authority to a van full of sealed boxes that are delivered to the agency. A court order, similar to the one revealed by the Guardian, permits the transfer of custody of the “boxes.” But the NSA needs something else, a specific purpose or investigation, in order to open a particular box. The chairman of the Senate intelligence committee, Sen. Dianne Feinstein, said the standard was “a reasonable, articulatable” suspicion, but did not go into details.

Legally, the government can ask companies for some of these records under a provision of the PATRIOT Act called the “business records provision.” Initially, it did so without court cognizance. Now, the FISC signs off on every request.

Armed with what amounts to a rubber stamp court order, however, the NSA can collect and store trillions of bytes of electromagnetic detritus shaken off by American citizens. In the government’s eyes, the data is simply moving from one place to another. It does not become, in the government’s eyes, relevant or protected in any way unless and until it is subject to analysis. Analysis requires that second order.

And the government insists that the rules allowing the NSA or the FBI to analyze anything relating to U.S. persons or corporations are strict, bright-line, and are regularly scrutinized to ensure that innocents don’t get caught up in the mix. The specifics, however, remain classified, as do the oversight mechanisms in place.

The wave of disclosures about the NSA programs have significantly unsettled the intelligence community.

The documents obtained by the two newspapers are marked ORCON, or originator controlled, which generally means that the agency keeps a record of every person who accesses them online and knows exactly who might have printed out or saved or accessed a copy. The NSA in particular has a good record of protecting its documents.

The scope of the least suggest to one former senior intelligence official who now works for a corporation that provides data to the NSA that several people with top-level security clearances had to be involved.

The motive, I suspect, is to punch through the brittle legal and moral foundation that modern domestic surveillance is based upon. Someone, at a very high level, or several people, may have simply found that the agency’s zeal to collect information blinded it to the real-world consequences of such a large and unending program. The minimization procedures might also be well below the threshold that most Americans would expect.

Clapper said in his statement that the disclosures about the program “risk important protections for the security of Americans.”

June 6, 2013, at 8:02 PM

Ambinder is co-author of a new book about government secrecy and surveillance, Deep State: Inside the Government Secrecy Industry.

Find this story at 6 June 2013

© 2013 THE WEEK PUBliCATIONS, INC.

A slide depicting the top-secret PRISM program.

The National Security Agency has obtained direct access to the systems of Google, Facebook, Apple and other US internet giants, according to a top secret document obtained by the Guardian.

The NSA access is part of a previously undisclosed program called Prism, which allows officials to collect material including search history, the content of emails, file transfers and live chats, the document says.

The Guardian has verified the authenticity of the document, a 41-slide PowerPoint presentation – classified as top secret with no distribution to foreign allies – which was apparently used to train intelligence operatives on the capabilities of the program. The document claims “collection directly from the servers” of major US service providers.

Although the presentation claims the program is run with the assistance of the companies, all those who responded to a Guardian request for comment on Thursday denied knowledge of any such program.

In a statement, Google said: “Google cares deeply about the security of our users’ data. We disclose user data to government in accordance with the law, and we review all such requests carefully. From time to time, people allege that we have created a government ‘back door’ into our systems, but Google does not have a back door for the government to access private user data.”

Several senior tech executives insisted that they had no knowledge of Prism or of any similar scheme. They said they would never have been involved in such a program. “If they are doing this, they are doing it without our knowledge,” one said.

An Apple spokesman said it had “never heard” of Prism.

The NSA access was enabled by changes to US surveillance law introduced under President Bush and renewed under Obama in December 2012.

The program facilitates extensive, in-depth surveillance on live communications and stored information. The law allows for the targeting of any customers of participating firms who live outside the US, or those Americans whose communications include people outside the US.

It also opens the possibility of communications made entirely within the US being collected without warrants.

Disclosure of the Prism program follows a leak to the Guardian on Wednesday of a top-secret court order compelling telecoms provider Verizon to turn over the telephone records of millions of US customers.

The participation of the internet companies in Prism will add to the debate, ignited by the Verizon revelation, about the scale of surveillance by the intelligence services. Unlike the collection of those call records, this surveillance can include the content of communications and not just the metadata.

Some of the world’s largest internet brands are claimed to be part of the information-sharing program since its introduction in 2007. Microsoft – which is currently running an advertising campaign with the slogan “Your privacy is our priority” – was the first, with collection beginning in December 2007.

It was followed by Yahoo in 2008; Google, Facebook and PalTalk in 2009; YouTube in 2010; Skype and AOL in 2011; and finally Apple, which joined the program in 2012. The program is continuing to expand, with other providers due to come online.

Collectively, the companies cover the vast majority of online email, search, video and communications networks.

The extent and nature of the data collected from each company varies.

Companies are legally obliged to comply with requests for users’ communications under US law, but the Prism program allows the intelligence services direct access to the companies’ servers. The NSA document notes the operations have “assistance of communications providers in the US”.

The revelation also supports concerns raised by several US senators during the renewal of the Fisa Amendments Act in December 2012, who warned about the scale of surveillance the law might enable, and shortcomings in the safeguards it introduces.

When the FAA was first enacted, defenders of the statute argued that a significant check on abuse would be the NSA’s inability to obtain electronic communications without the consent of the telecom and internet companies that control the data. But the Prism program renders that consent unnecessary, as it allows the agency to directly and unilaterally seize the communications off the companies’ servers.

A chart prepared by the NSA, contained within the top-secret document obtained by the Guardian, underscores the breadth of the data it is able to obtain: email, video and voice chat, videos, photos, voice-over-IP (Skype, for example) chats, file transfers, social networking details, and more.

The document is recent, dating to April 2013. Such a leak is extremely rare in the history of the NSA, which prides itself on maintaining a high level of secrecy.

The Prism program allows the NSA, the world’s largest surveillance organisation, to obtain targeted communications without having to request them from the service providers and without having to obtain individual court orders.

With this program, the NSA is able to reach directly into the servers of the participating companies and obtain both stored communications as well as perform real-time collection on targeted users.

The presentation claims Prism was introduced to overcome what the NSA regarded as shortcomings of Fisa warrants in tracking suspected foreign terrorists. It noted that the US has a “home-field advantage” due to housing much of the internet’s architecture. But the presentation claimed “Fisa constraints restricted our home-field advantage” because Fisa required individual warrants and confirmations that both the sender and receiver of a communication were outside the US.

“Fisa was broken because it provided privacy protections to people who were not entitled to them,” the presentation claimed. “It took a Fisa court order to collect on foreigners overseas who were communicating with other foreigners overseas simply because the government was collecting off a wire in the United States. There were too many email accounts to be practical to seek Fisas for all.”

The new measures introduced in the FAA redefines “electronic surveillance” to exclude anyone “reasonably believed” to be outside the USA – a technical change which reduces the bar to initiating surveillance.

The act also gives the director of national intelligence and the attorney general power to permit obtaining intelligence information, and indemnifies internet companies against any actions arising as a result of co-operating with authorities’ requests.

In short, where previously the NSA needed individual authorisations, and confirmation that all parties were outside the USA, they now need only reasonable suspicion that one of the parties was outside the country at the time of the records were collected by the NSA.

The document also shows the FBI acts as an intermediary between other agencies and the tech companies, and stresses its reliance on the participation of US internet firms, claiming “access is 100% dependent on ISP provisioning”.

In the document, the NSA hails the Prism program as “one of the most valuable, unique and productive accesses for NSA”.

It boasts of what it calls “strong growth” in its use of the Prism program to obtain communications. The document highlights the number of obtained communications increased in 2012 by 248% for Skype – leading the notes to remark there was “exponential growth in Skype reporting; looks like the word is getting out about our capability against Skype”. There was also a 131% increase in requests for Facebook data, and 63% for Google.

The NSA document indicates that it is planning to add Dropbox as a PRISM provider. The agency also seeks, in its words, to “expand collection services from existing providers”.

The revelations echo fears raised on the Senate floor last year during the expedited debate on the renewal of the FAA powers which underpin the PRISM program, which occurred just days before the act expired.

Senator Christopher Coons of Delaware specifically warned that the secrecy surrounding the various surveillance programs meant there was no way to know if safeguards within the act were working.

“The problem is: we here in the Senate and the citizens we represent don’t know how well any of these safeguards actually work,” he said.

“The law doesn’t forbid purely domestic information from being collected. We know that at least one Fisa court has ruled that the surveillance program violated the law. Why? Those who know can’t say and average Americans can’t know.”

Other senators also raised concerns. Senator Ron Wyden of Oregon attempted, without success, to find out any information on how many phone calls or emails had been intercepted under the program.

When the law was enacted, defenders of the FAA argued that a significant check on abuse would be the NSA’s inability to obtain electronic communications without the consent of the telecom and internet companies that control the data. But the Prism program renders that consent unnecessary, as it allows the agency to directly and unilaterally seize the communications off the companies’ servers.

When the NSA reviews a communication it believes merits further investigation, it issues what it calls a “report”. According to the NSA, “over 2,000 Prism-based reports” are now issued every month. There were 24,005 in 2012, a 27% increase on the previous year.

In total, more than 77,000 intelligence reports have cited the PRISM program.

Jameel Jaffer, director of the ACLU’s Center for Democracy, that it was astonishing the NSA would even ask technology companies to grant direct access to user data.

“It’s shocking enough just that the NSA is asking companies to do this,” he said. “The NSA is part of the military. The military has been granted unprecedented access to civilian communications.

“This is unprecedented militarisation of domestic communications infrastructure. That’s profoundly troubling to anyone who is concerned about that separation.”

A senior administration official said in a statement: “The Guardian and Washington Post articles refer to collection of communications pursuant to Section 702 of the Foreign Intelligence Surveillance Act. This law does not allow the targeting of any US citizen or of any person located within the United States.

“The program is subject to oversight by the Foreign Intelligence Surveillance Court, the Executive Branch, and Congress. It involves extensive procedures, specifically approved by the court, to ensure that only non-US persons outside the US are targeted, and that minimize the acquisition, retention and dissemination of incidentally acquired information about US persons.

“This program was recently reauthorized by Congress after extensive hearings and debate.

“Information collected under this program is among the most important and valuable intelligence information we collect, and is used to protect our nation from a wide variety of threats.

“The Government may only use Section 702 to acquire foreign intelligence information, which is specifically, and narrowly, defined in the Foreign Intelligence Surveillance Act. This requirement applies across the board, regardless of the nationality of the target.”

Additional reporting by James Ball and Dominic Rushe

Glenn Greenwald and Ewen MacAskill
The Guardian, Friday 7 June 2013

Find this story at 7 June 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.

(Reuters) – The leak of a document showing the Obama administration asked for millions of phone records has turned a spotlight anew on a secretive U.S. federal court set up 35 years ago to curb intelligence abuses.

Made up of 11 judges who serve staggered seven-year terms, it is called the U.S. Foreign Intelligence Surveillance Court. The judges’ identities are known, along with the name of the person who appoints them: the chief justice, now John Roberts.

In a departure from other courts, all of its rulings are secret and there is no adversarial system. Instead, government lawyers make a request and the judge either approves or rejects it. No other parties are present. The court approves nearly all requests, according to Justice Department data.

In an annual report to Congress that is publicly available, the department said that in 2012 the government made 212 applications for access to business records, which is the same kind of request as that made of Verizon Communications Inc in the present case.

The court denied none of the applications but amended 200 of them, the report said.

The court also oversees applications for electronic surveillance and physical searches. There were 1,856 such applications in 2012, when all were approved except for one, which the government withdrew before the court could rule.

Congress enacted the Foreign Intelligence Surveillance Act setting up the court in 1978 amid concerns about the lack of legal oversight over the intelligence community’s activities.

Activity by the U.S. intelligence community uncovered by congressional investigations included illegal mail-opening programs and the targeting of domestic protesters and political opponents by the Nixon administration.

Now, critics say, the court set up to curb misconduct is rubber-stamping drastically expanded intelligence gathering efforts started after the September 11, 2001, attacks that prompt similar concerns about infringements on civil liberties.

Government authority to obtain records was expanded further by the 2001 USA Patriot Act, which Congress passed with overwhelming bipartisan support in the immediate aftermath of the attacks.

‘ANY TANGIBLE THINGS’

The government cited Section 215 of the Patriot Act in making its request in the Verizon case. This section allows the government to ask the court for “any tangible things” as part of any authorized investigation related to terrorism or intelligence activities.

As the Justice Department wrote in an October 2011 letter to members of Congress, the government must show, among other things, that the information sought is “relevant to an authorized national security investigation.”

At least one president has tried to sidestep the court.

President George W. Bush’s administration chose not to ask the court to approve wiretapping of calls between suspected terrorists until 2007, news accounts of the program’s existence prompted controversy. This incident led to increased concerns among civil liberties advocates that the government effectively had a green light to invade the privacy of Americans.

Among the few who know how the secret court acts are members of Congress. The Obama administration has been keen to highlight how access to orders and opinions issued by the secret court is provided to members of both parties on the intelligence committees in both houses of Congress and on the Senate Judiciary Committee.

The court is comprised of sitting federal judges, appointed for life, who take on the additional responsibility for the seven years of the surveillance court term. The judges are all over the country, although several are in the Washington area.

It is not clear exactly how the chief justice chooses the judges who serve on the court. Some of the judges have a national security background while others do not, according to a source familiar with the court. Further information on how Chief Justice Roberts appoints judges was not immediately available from a U.S. Supreme Court spokeswoman.

WASHINGTON PRESENCE

The court has a physical presence in the U.S. District Court in Washington. The current presiding judge is Reggie Walton, a U.S. district judge in Washington who was appointed by Bush.

The vast majority of judges now on the court are Republican appointees.

The judge who approved the Verizon order, Roger Vinson, is a senior federal district judge in Florida. His term ended at the beginning of May. Vinson, a U.S. Navy veteran, was appointed to the bench by Republican President Ronald Reagan in 1983.

The intelligence court’s workload increased after the September 11 attacks. Between 1978 and 2001, it received 46 emergency requests. In the year after September 11, there were 113, according to a legal textbook on national security by legal experts J. Douglas Wilson and David Kris, who was head of the Justice Department’s national security division from 2009 to 2011.

A former member, U.S. District Judge Royce Lamberth of the District of Columbia, described his experience serving in a 2002 speech in which he denied that the court was a rubber stamp.

“I ask questions. I get into the nitty gritty,” he said. “I know exactly what is going to be done and why. And my questions are answered, in every case, before I approve an application.”

By Lawrence Hurley
WASHINGTON | Thu Jun 6, 2013 6:40pm EDT
(Reporting by Lawrence Hurley; Editing by Howard Goller and Philip Barbara)

Find this story at 6 June 2013

@2013 Thomson Reuters

On Sept. 11, 2007, the National Security Agency signed up Microsoft as its first partner for PRISM, a massive domestic surveillance program whose existence was reported by the Washington Post today. That’s barely a month after Congress passed, and President George W. Bush signed, the Protect America Act.

The Bush Administration portrayed the PAA as a technical fix designed to close a gap in America’s surveillance capabilities that had been opened by a then-recent ruling of the secretive Foreign Intelligence Surveillance Court (FISC). It proved to be much more than that.

While the details are still classified, reports suggested that the FISC had ruled that it was illegal for the government to intercept communications between two foreign endpoints if the communications happened to pass through the United States. Warning that the U.S. would suddenly lose the ability to continue its surveillance of terrorists, the administration pushed the PAA through Congress in a matter of days.

In reality, the PAA represented a sweeping change to American surveillance law. Before conducting surveillance, the PAA only required executive branch officials to “certify” that there were “reasonable procedures” in place for ensuring that surveillance “concerns” persons located outside the United States and that the foreign intelligence is a “significant purpose” of the program. A single certification could cover a broad program intercepting the communications of numerous individuals. And there was no requirement for judicial review of individual surveillance targets within a “certified” program.

Civil liberties groups warned that the PAA’s vague requirements and lack of oversight would give the government a green light to seek indiscriminate access to the private communications of Americans. They predicted that the government would claim that they needed unfettered access to domestic communications to be sure they had gotten all relevant information about suspected terrorists.

It now appears that this is exactly what the government did. Today’s report suggests that the moment the PAA was the law of the land, the NSA started using it to obtain unfettered access to the servers of the nation’s leading online services. To comply with the requirement that the government not target Americans, PRISM searches are reportedly “designed to produce at least 51 percent confidence in a target’s ‘foreignness’” — the lowest conceivable standard. PRISM training materials reportedly instruct users that if searches happen to turn up the private information of Americans, “it’s nothing to worry about.”

The Protect America Act included a short six-month sunset provision, triggering another heated debate in the midst of the 2008 Democratic primary campaign. But that debate focused more on the past than the future. The telecom industry sought retroactive immunity for their participation in warrantless surveillance programs prior to 2007, a request Congress did not grant with the PAA.

Retroactive immunity for telecom companies dominated the 2008 debate, overshadowing the more important issue of the sweeping new powers that Congress had just granted to the executive branch. When Congress finally passed the FISA Amendments Act in July 2008, it included both immunity and a four-year extension of the government’s warrantless spying powers. But few members of Congress realized the breadth of the surveillance powers they were effectively approving.

The FISA Amandments Act was re-authorized for another five years in 2012 with little controversy. It will come up for a vote again in 2017 — though Congress could always choose to revisit it earlier.

By Timothy B. Lee, Updated: June 6, 2013

Find this story at 6 June 2013

© The Washington Post Company

The National Security Agency has been secretly collecting the phone call records of tens of millions of Americans, using data provided by AT&T, Verizon and BellSouth, people with direct knowledge of the arrangement told USA TODAY.

The NSA program reaches into homes and businesses across the nation by amassing information about the calls of ordinary Americans — most of whom aren’t suspected of any crime. This program does not involve the NSA listening to or recording conversations. But the spy agency is using the data to analyze calling patterns in an effort to detect terrorist activity, sources said in separate interviews.

QUESTIONS AND ANSWERS: The NSA record collection program

“It’s the largest database ever assembled in the world,” said one person, who, like the others who agreed to talk about the NSA’s activities, declined to be identified by name or affiliation. The agency’s goal is “to create a database of every call ever made” within the nation’s borders, this person added.

For the customers of these companies, it means that the government has detailed records of calls they made — across town or across the country — to family members, co-workers, business contacts and others.

The three telecommunications companies are working under contract with the NSA, which launched the program in 2001 shortly after the Sept. 11 terrorist attacks, the sources said. The program is aimed at identifying and tracking suspected terrorists, they said.

The sources would talk only under a guarantee of anonymity because the NSA program is secret.

Air Force Gen. Michael Hayden, nominated Monday by President Bush to become the director of the CIA, headed the NSA from March 1999 to April 2005. In that post, Hayden would have overseen the agency’s domestic call-tracking program. Hayden declined to comment about the program.

The NSA’s domestic program, as described by sources, is far more expansive than what the White House has acknowledged. Last year, Bush said he had authorized the NSA to eavesdrop — without warrants — on international calls and international e-mails of people suspected of having links to terrorists when one party to the communication is in the USA. Warrants have also not been used in the NSA’s efforts to create a national call database.

In defending the previously disclosed program, Bush insisted that the NSA was focused exclusively on international calls. “In other words,” Bush explained, “one end of the communication must be outside the United States.”

As a result, domestic call records — those of calls that originate and terminate within U.S. borders — were believed to be private.

Sources, however, say that is not the case. With access to records of billions of domestic calls, the NSA has gained a secret window into the communications habits of millions of Americans. Customers’ names, street addresses and other personal information are not being handed over as part of NSA’s domestic program, the sources said. But the phone numbers the NSA collects can easily be cross-checked with other databases to obtain that information.

Don Weber, a senior spokesman for the NSA, declined to discuss the agency’s operations. “Given the nature of the work we do, it would be irresponsible to comment on actual or alleged operational issues; therefore, we have no information to provide,” he said. “However, it is important to note that NSA takes its legal responsibilities seriously and operates within the law.”

The White House would not discuss the domestic call-tracking program. “There is no domestic surveillance without court approval,” said Dana Perino, deputy press secretary, referring to actual eavesdropping.

She added that all national intelligence activities undertaken by the federal government “are lawful, necessary and required for the pursuit of al-Qaeda and affiliated terrorists.” All government-sponsored intelligence activities “are carefully reviewed and monitored,” Perino said. She also noted that “all appropriate members of Congress have been briefed on the intelligence efforts of the United States.”

The government is collecting “external” data on domestic phone calls but is not intercepting “internals,” a term for the actual content of the communication, according to a U.S. intelligence official familiar with the program. This kind of data collection from phone companies is not uncommon; it’s been done before, though never on this large a scale, the official said. The data are used for “social network analysis,” the official said, meaning to study how terrorist networks contact each other and how they are tied together.

Carriers uniquely positioned

AT&T recently merged with SBC and kept the AT&T name. Verizon, BellSouth and AT&T are the nation’s three biggest telecommunications companies; they provide local and wireless phone service to more than 200 million customers.

The three carriers control vast networks with the latest communications technologies. They provide an array of services: local and long-distance calling, wireless and high-speed broadband, including video. Their direct access to millions of homes and businesses has them uniquely positioned to help the government keep tabs on the calling habits of Americans.

Among the big telecommunications companies, only Qwest has refused to help the NSA, the sources said. According to multiple sources, Qwest declined to participate because it was uneasy about the legal implications of handing over customer information to the government without warrants.

Qwest’s refusal to participate has left the NSA with a hole in its database. Based in Denver, Qwest provides local phone service to 14 million customers in 14 states in the West and Northwest. But AT&T and Verizon also provide some services — primarily long-distance and wireless — to people who live in Qwest’s region. Therefore, they can provide the NSA with at least some access in that area.

Created by President Truman in 1952, during the Korean War, the NSA is charged with protecting the United States from foreign security threats. The agency was considered so secret that for years the government refused to even confirm its existence. Government insiders used to joke that NSA stood for “No Such Agency.”

In 1975, a congressional investigation revealed that the NSA had been intercepting, without warrants, international communications for more than 20 years at the behest of the CIA and other agencies. The spy campaign, code-named “Shamrock,” led to the Foreign Intelligence Surveillance Act (FISA), which was designed to protect Americans from illegal eavesdropping.

Enacted in 1978, FISA lays out procedures that the U.S. government must follow to conduct electronic surveillance and physical searches of people believed to be engaged in espionage or international terrorism against the United States. A special court, which has 11 members, is responsible for adjudicating requests under FISA.

Over the years, NSA code-cracking techniques have continued to improve along with technology. The agency today is considered expert in the practice of “data mining” — sifting through reams of information in search of patterns. Data mining is just one of many tools NSA analysts and mathematicians use to crack codes and track international communications.

Paul Butler, a former U.S. prosecutor who specialized in terrorism crimes, said FISA approval generally isn’t necessary for government data-mining operations. “FISA does not prohibit the government from doing data mining,” said Butler, now a partner with the law firm Akin Gump Strauss Hauer & Feld in Washington, D.C.

The caveat, he said, is that “personal identifiers” — such as names, Social Security numbers and street addresses — can’t be included as part of the search. “That requires an additional level of probable cause,” he said.

The usefulness of the NSA’s domestic phone-call database as a counterterrorism tool is unclear. Also unclear is whether the database has been used for other purposes.

The NSA’s domestic program raises legal questions. Historically, AT&T and the regional phone companies have required law enforcement agencies to present a court order before they would even consider turning over a customer’s calling data. Part of that owed to the personality of the old Bell Telephone System, out of which those companies grew.

Ma Bell’s bedrock principle — protection of the customer — guided the company for decades, said Gene Kimmelman, senior public policy director of Consumers Union. “No court order, no customer information — period. That’s how it was for decades,” he said.

The concern for the customer was also based on law: Under Section 222 of the Communications Act, first passed in 1934, telephone companies are prohibited from giving out information regarding their customers’ calling habits: whom a person calls, how often and what routes those calls take to reach their final destination. Inbound calls, as well as wireless calls, also are covered.

The financial penalties for violating Section 222, one of many privacy reinforcements that have been added to the law over the years, can be stiff. The Federal Communications Commission, the nation’s top telecommunications regulatory agency, can levy fines of up to $130,000 per day per violation, with a cap of $1.325 million per violation. The FCC has no hard definition of “violation.” In practice, that means a single “violation” could cover one customer or 1 million.

In the case of the NSA’s international call-tracking program, Bush signed an executive order allowing the NSA to engage in eavesdropping without a warrant. The president and his representatives have since argued that an executive order was sufficient for the agency to proceed. Some civil liberties groups, including the American Civil Liberties Union, disagree.

Companies approached

The NSA’s domestic program began soon after the Sept. 11 attacks, according to the sources. Right around that time, they said, NSA representatives approached the nation’s biggest telecommunications companies. The agency made an urgent pitch: National security is at risk, and we need your help to protect the country from attacks.

The agency told the companies that it wanted them to turn over their “call-detail records,” a complete listing of the calling histories of their millions of customers. In addition, the NSA wanted the carriers to provide updates, which would enable the agency to keep tabs on the nation’s calling habits.

The sources said the NSA made clear that it was willing to pay for the cooperation. AT&T, which at the time was headed by C. Michael Armstrong, agreed to help the NSA. So did BellSouth, headed by F. Duane Ackerman; SBC, headed by Ed Whitacre; and Verizon, headed by Ivan Seidenberg.

With that, the NSA’s domestic program began in earnest.

AT&T, when asked about the program, replied with a comment prepared for USA TODAY: “We do not comment on matters of national security, except to say that we only assist law enforcement and government agencies charged with protecting national security in strict accordance with the law.”

In another prepared comment, BellSouth said: “BellSouth does not provide any confidential customer information to the NSA or any governmental agency without proper legal authority.”

Verizon, the USA’s No. 2 telecommunications company behind AT&T, gave this statement: “We do not comment on national security matters, we act in full compliance with the law and we are committed to safeguarding our customers’ privacy.”

Qwest spokesman Robert Charlton said: “We can’t talk about this. It’s a classified situation.”

In December, The New York Times revealed that Bush had authorized the NSA to wiretap, without warrants, international phone calls and e-mails that travel to or from the USA. The following month, the Electronic Frontier Foundation, a civil liberties group, filed a class-action lawsuit against AT&T. The lawsuit accuses the company of helping the NSA spy on U.S. phone customers.

Last month, U.S. Attorney General Alberto Gonzales alluded to that possibility. Appearing at a House Judiciary Committee hearing, Gonzales was asked whether he thought the White House has the legal authority to monitor domestic traffic without a warrant. Gonzales’ reply: “I wouldn’t rule it out.” His comment marked the first time a Bush appointee publicly asserted that the White House might have that authority.

Similarities in programs

The domestic and international call-tracking programs have things in common, according to the sources. Both are being conducted without warrants and without the approval of the FISA court. The Bush administration has argued that FISA’s procedures are too slow in some cases. Officials, including Gonzales, also make the case that the USA Patriot Act gives them broad authority to protect the safety of the nation’s citizens.

The chairman of the Senate Intelligence Committee, Sen. Pat Roberts, R-Kan., would not confirm the existence of the program. In a statement, he said, “I can say generally, however, that our subcommittee has been fully briefed on all aspects of the Terrorist Surveillance Program. … I remain convinced that the program authorized by the president is lawful and absolutely necessary to protect this nation from future attacks.”

The chairman of the House Intelligence Committee, Rep. Pete Hoekstra, R-Mich., declined to comment.

One company differs

One major telecommunications company declined to participate in the program: Qwest.

According to sources familiar with the events, Qwest’s CEO at the time, Joe Nacchio, was deeply troubled by the NSA’s assertion that Qwest didn’t need a court order — or approval under FISA — to proceed. Adding to the tension, Qwest was unclear about who, exactly, would have access to its customers’ information and how that information might be used.

Financial implications were also a concern, the sources said. Carriers that illegally divulge calling information can be subjected to heavy fines. The NSA was asking Qwest to turn over millions of records. The fines, in the aggregate, could have been substantial.

The NSA told Qwest that other government agencies, including the FBI, CIA and DEA, also might have access to the database, the sources said. As a matter of practice, the NSA regularly shares its information — known as “product” in intelligence circles — with other intelligence groups. Even so, Qwest’s lawyers were troubled by the expansiveness of the NSA request, the sources said.

The NSA, which needed Qwest’s participation to completely cover the country, pushed back hard.

Trying to put pressure on Qwest, NSA representatives pointedly told Qwest that it was the lone holdout among the big telecommunications companies. It also tried appealing to Qwest’s patriotic side: In one meeting, an NSA representative suggested that Qwest’s refusal to contribute to the database could compromise national security, one person recalled.

In addition, the agency suggested that Qwest’s foot-dragging might affect its ability to get future classified work with the government. Like other big telecommunications companies, Qwest already had classified contracts and hoped to get more.

Unable to get comfortable with what NSA was proposing, Qwest’s lawyers asked NSA to take its proposal to the FISA court. According to the sources, the agency refused.

The NSA’s explanation did little to satisfy Qwest’s lawyers. “They told (Qwest) they didn’t want to do that because FISA might not agree with them,” one person recalled. For similar reasons, this person said, NSA rejected Qwest’s suggestion of getting a letter of authorization from the U.S. attorney general’s office. A second person confirmed this version of events.

In June 2002, Nacchio resigned amid allegations that he had misled investors about Qwest’s financial health. But Qwest’s legal questions about the NSA request remained.

Unable to reach agreement, Nacchio’s successor, Richard Notebaert, finally pulled the plug on the NSA talks in late 2004, the sources said.

By Leslie Cauley, USA TODAY
Contributing: John Diamond
Posted 5/10/2006 11:16 PM ET
Updated 5/11/2006 10:38 AM ET

Find this story at 5 October 2006

Copyright 2011 USA TODAY