Exclusive: UK security agency GCHQ gaining information from world’s biggest internet firms through US-run Prism programme

Documents show GCHQ (above) has had access to the NSA’s Prism programme since at least June 2010. Photograph: David Goddard/Getty Images

The UK’s electronic eavesdropping and security agency, GCHQ, has been secretly gathering intelligence from the world’s biggest internet companies through a covertly run operation set up by America’s top spy agency, documents obtained by the Guardian reveal.

The documents show that GCHQ, based in Cheltenham, has had access to the system since at least June 2010, and generated 197 intelligence reports from it last year.

The US-run programme, called Prism, would appear to allow GCHQ to circumvent the formal legal process required to seek personal material such as emails, photos and videos from an internet company based outside the UK.

The use of Prism raises ethical and legal issues about such direct access to potentially millions of internet users, as well as questions about which British ministers knew of the programme.

In a statement to the Guardian, GCHQ, insisted it “takes its obligations under the law very seriously”.

The details of GCHQ’s use of Prism are set out in documents prepared for senior analysts working at America’s National Security Agency, the biggest eavesdropping organisation in the world.

Dated April this year, the papers describe the remarkable scope of a previously undisclosed “snooping” operation which gave the NSA and the FBI easy access to the systems of nine of the world’s biggest internet companies. The group includes Google, Facebook, Microsoft, Apple, Yahoo and Skype.

The documents, which appear in the form of a 41-page PowerPoint presentation, suggest the firms co-operated with the Prism programme. Technology companies denied knowledge of Prism, with Google insisting it “does not have a back door for the government to access private user data”. But the companies acknowledged that they complied with legal orders.

The existence of Prism, though, is not in doubt.

Thanks to changes to US surveillance law introduced under President George W Bush and renewed under Barack Obama in December 2012, Prism was established in December 2007 to provide in-depth surveillance on live communications and stored information about foreigners overseas.

The law allows for the targeting of any customers of participating firms who live outside the US, or those Americans whose communications include people outside the US.

The documents make clear the NSA has been able to obtain unilaterally both stored communications as well as real-time collection of raw data for the last six years, without the knowledge of users, who would assume their correspondence was private.

The NSA describes Prism as “one of the most valuable, unique and productive accesses” of intelligence, and boasts the service has been made available to spy organisations from other countries, including GCHQ.

It says the British agency generated 197 intelligence reports from Prism in the year to May 2012 – marking a 137% increase in the number of reports generated from the year before. Intelligence reports from GCHQ are normally passed to MI5 and MI6.

The documents underline that “special programmes for GCHQ exist for focused Prism processing”, suggesting the agency has been able to receive material from a bespoke part of the programme to suit British interests.

Unless GCHQ has stopped using Prism, the agency has accessed information from the programme for at least three years. It is not mentioned in the latest report from the Interception of Communications Commissioner Office, which scrutinises the way the UK’s three security agencies use the laws covering the interception and retention of data.

Asked to comment on its use of Prism, GCHQ said it “takes its obligations under the law very seriously. Our work is carried out in accordance with a strict legal and policy framework which ensures that our activities are authorised, necessary and proportionate, and that there is rigorous oversight, including from the secretary of state, the interception and intelligence services commissioners and the intelligence and security committee”.

The agency refused to be drawn on how long it had been using Prism, how many intelligence reports it had gleaned from it, or which ministers knew it was being used.

A GCHQ spokesperson added: “We do not comment on intelligence matters.”

The existence and use of Prism reflects concern within the intelligence community about access it has to material held by internet service providers.

Many of the web giants are based in the US and are beyond the jurisdiction of British laws. Very often, the UK agencies have to go through a formal legal process to request information from service providers.

Because the UK has a mutual legal assistance treaty with America, GCHQ can make an application through the US department of justice, which will make the approach on its behalf.

Though the process is used extensively – almost 3,000 requests were made to Google alone last year – it is time consuming. Prism would appear to give GCHQ a chance to bypass the procedure.

In its statement about Prism, Google said it “cares deeply about the security of our users’ data. We disclose user data to government in accordance with the law, and we review all such requests carefully. From time to time, people allege that we have created a government ‘back door’ into our systems, but Google does not have a back door for the government to access private user data”.

Several senior tech executives insisted they had no knowledge of Prism or of any similar scheme. They said they would never have been involved in such a programme.

“If they are doing this, they are doing it without our knowledge,” one said. An Apple spokesman said it had “never heard” of Prism.

In a statement confirming the existence of Prism, James Clapper, the director of national intelligence in the US, said: “Information collected under this programme is among the most important and valuable intelligence information we collect, and is used to protect our nation from a wide variety of threats.”

A senior US administration official said: “The programme is subject to oversight by the foreign intelligence surveillance court, the executive branch, and Congress. It involves extensive procedures, specifically approved by the court, to ensure that only non-US persons outside the US are targeted, and that minimise the acquisition, retention and dissemination of incidentally acquired information about US persons.”

Nick Hopkins
guardian.co.uk, Friday 7 June 2013 14.27 BST

Find this story at 7 June 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.

Data on U.S. customers, secretly collected from phone companies, has been shared with British security agencies, writes Eli Lake. Plus, everything you need to know about the NSA Spying Program.

At least one foreign government has gained access to sensitive data collected by the National Security Agency from U.S. telecommunications companies in dragnet court warrants demanding the secret transfer of U.S. customers’ calling records.

The information collected by the NSA, known as “metadata,” does not include the content of the phone calls or the names of the people associated with the accounts. But it does tell the government when calls were made, what numbers were dialed, and the location and duration of those calls. Current and former U.S. intelligence officials familiar with the longstanding program to collect metadata from American telecommunications and Internet companies tell The Daily Beast that, in a few discreet cases, the NSA has shared unedited analysis of these records with its British counterpart, the Government Communications Headquarters (GCHQ).

The Guardian on Friday reported that documents the newspaper obtained showed the GCHQ in 2010 gained access to an NSA metadata collection program known as Prism to secretly tap into the servers of leading internet companies such as Apple and Google. The documents showed the British generated 197 intelligence reports from access to the system in 2012, the Guardian reported.

Late Thursday, James Clapper, the director of national intelligence, issued a statement defending the government’s collection of phone records, which he said protected the privacy of most Americans. For example, Clapper said only specially trained personnel could access the vast database of metadata collected by the government. A secret body known as the Foreign Intelligence Surveillance Court reviews the program every 90 days and only allows the government to query the database “when there is a reasonable suspicion, based on specific facts, that the particular basis for the query is associated with a foreign terrorist organization.”

Clapper was responding to an article The Guardian published Wednesday based on a secret court order that demanded Verizon Business Network Services Inc. hand over to the federal government all “metadata” from its customers between April 25 and July 19. On Thursday the chairmen and ranking members of the House and Senate intelligence committees said the program had been in place since 2006, and the court order disclosed by The Guardian was a routine request by the government for the caller records. The Washington Post on Thursday disclosed that the NSA has also run a separate monitoring program to tap directly into the servers of nine U.S. Internet companies to extract information from users, ranging from video and audio files to emails.

With advances in computer science, intelligence services can now mine vast amounts of data collected by telecom companies, Internet service providers, and social-media sites for patterns that can illuminate terrorist networks and help solve crimes. Rep. Mike Rogers, the Republican chairman of the House Permanent Select Committee on Intelligence, told reporters that he knew of one instance where the NSA metadata program thwarted a domestic terrorist attack.

‘Somebody’s gotta go to jail for something!’ Watch these amateur Internet pundits scold the NSA.
These metadata, these intelligence officers say, reside in vast hard drives that belong to the NSA. Analysts there can then take a phone number or email address and uncover suspected terrorists’ associates, find their locations, and even learn clues about their possible targets.

Peter Wood, the CEO of First Base Technologies, a security firm that works closely with British law enforcement in this area, says this kind of “big data” analysis can be useful to federal law enforcement.

“All emails have headers, which are full of information most people don’t see,” Wood says. “It allows law enforcement to trace the root and source of emails—that gives them the provenance of an email. This allows them to determine the physical origin of threats, if they can be sure the source of the email has not, in turn, been compromised itself.” Wood compared the analysis to how commercial Internet companies use similar data to target ads to individuals based on their search patterns.

“The big open question is what happens to this data when it’s collected.”
Sometimes, the analysis of metadata is shared between allied services, current and retired U.S. intelligence officers say. This is particularly true with the GCHQ, Britain’s equivalent of the NSA.

One former senior U.S. intelligence official with knowledge of the program tells The Daily Beast, “My understanding is if the British had a phone number, we might run the number through the database for them and provide them with the results.”

“I do not know of cases where the U.S. government has shared this kind of metadata with the United Kingdom, but I would be surprised if this never happened,” Wood says. “Both countries cooperate very closely on counterterrorism.”

The U.S. and the U.K. have an agreement to share signal intercepts and electronic intelligence through a pact known as the United Kingdom United States of America Agreement. Over the years, the agreement has been expanded to include Australia, Canada, and New Zealand.

U.S. intelligence officials who spoke to The Daily Beast said that British nationals were not permitted to sit at the actual terminals where NSA analysts mine the metadata collected from phone companies and Internet service providers. But British GCHQ has received unredacted analysis of targeted searches, according to these sources.

A spokeswoman for the NSA declined to comment for this article.

“The whole idea of sharing information that could be of value in a terrorism investigation would be a high priority, especially after 9/11,” says James Bamford, the author of three histories of the NSA, including his most recent book, The Shadow Factory. “If the United States feels it got the information legally, which it does in this case, then from all I know the NSA believes it has the authority to pass the intelligence on to intelligence partners.”

Jameel Jaffer, deputy legal director at the American Civil Liberties Union, says he is worried about what becomes of the records collected by the NSA. “The big open question is what happens to this data when it’s collected,” Jaffer says. “Is it shared amongst agencies? Is it used in law-enforcement investigations? Has it been used in prosecutions? And has it been shared with foreign countries—and which foreign countries has it been shared with and under what conditions?”

The Daily Beast
by Eli Lake Jun 7, 2013 4:45 AM EDT

Find this story at 7 June 2013

© 2013 The Newsweek/Daily Beast Company LLC

American telecoms giant Verizon has been handing information about British companies to the US government, putting it on a collision course with UK regulators.
On Verizon’s UK website, the company makes a point of telling customers it will help to defend them against spying by government agencies Photo: AP

The company has found itself at the centre of a major scandal in the US, after it emerged that the National Security Agency (NSA) is collecting the telephone records of millions of customers on an “ongoing, daily basis”, under a top-secret court order issued in April.

The US is also reaching directly into the servers of Facebook, Google and other internet companies to harvest data. The NSA’s classified PRISM programme reportedly allows the government to collect virtually limitless amounts of information from emails, pictures and social media accounts.

Verizon on Thursday battled to prevent a customer backlash by telling them it had no choice in the matter. The Obama administration justified the surveillance, claiming it was a “critical tool in protecting the nation from terrorist threats”.

Two other major American wireless providers, AT&T and Sprint, have also been receiving similar orders, as have credit card companies, sources told the Wall Street Journal.

It is not clear whether Verzion Wireless, the US wireless operator owned by Verizon and Britain’s Vodafone, has received an order. Vodafone, which owns 45pc and has no operational role in the company, had no comment on Friday.
Related Articles
US spy scandal threatens Silicon Valley 11 Jun 2013
US harvests data from Facebook, Google and other web giants 07 Jun 2013
US to declassify secret surveillance documents after uproar 07 Jun 2013
Obama govt secretly collecting US phone records 06 Jun 2013
Analysis: latest leak could devastate Obama 06 Jun 2013
EE to offer shared smartphone and tablet data plans 06 Jun 2013

Verizon’s court order did not just stop at US shores. Washington called for Verizon to hand over all telephone records “for communications between the United States and abroad”, including calls routed via Verizon’s UK subsidiary, based in Reading.

On Verizon’s UK website, the company makes a point of telling customers it will help to defend them against spying by government agencies.

“Whether global or local, [your communications] must be secure because there are many threats to your organisation, from those that want to destroy your reputation and from those that want to take what’s yours,” the company says in a video entitled “2013 data breach”.

“This year’s most talked about threat is espionage… with many [breaches] tracing back to state affiliated culprits, taking months or even years to detect.”

However, the US government’s secret court order instructed Verizon to collect the numbers of the people at either end of each call, information about their location and the time and length of the conversation. It was not asked to record the actual conversations, but it was obliged to hold the information for a minimum of three months.

The Information Commissioner’s Office, the regulator responsible for safeguarding privacy in the UK, is expected to investigate the security breach.

When ordinary customers make calls out of the US, their network will connect them to the UK network they are calling, meaning Verizon has limited information about calls. However, it has comprehensive details about business customers making calls to colleagues across the Atlantic, as their calls are kept within the confines of the same network. Verizon would have pulled the information from its UK servers.

These so-called enterprise systems are theoretically designed to reduce costs and boost security.

Verizon could not be reached for comment.

Unlike the phone tracking programme, where telecom companies are forced to hand over records, PRISM appears to allow the NSA to freely search the tech firms’ networks at any time.

PRISM also allows the government access to the content of online accounts, whereas the phone programme provides data on the time and location of a call but does not tell investigators what was said.

A secret slide show obtained by The Guardian and The Washington Post appear to indicate that the nine companies are willing participants in the programme, beginning with Microsoft in 2007.

However, the Guardian reported that several of the companies claimed to have no knowledge of that their servers were being accessed by the government.

Google said in a statement: “From time to time, people allege that we have created a government ‘back door’ into our systems, but Google does not have a ‘back door’ for the government to access private user data.”

An Apple spokesman said: “We have never heard of PRISM. We do not provide any government agency with direct access to our servers and any agency requesting customer data must get a court order,” he said.

The scale of the operation is detailed in a 41-page slideshow obtained by the two newspapers, which describes PRISM as the single largest source of NSA data.

By Katherine Rushton, US Business Editor

10:30AM BST 07 Jun 2013

Find this story at 7 June 2013

© Copyright of Telegraph Media Group Limited 2013

Sophisticated telecommunication interception capabilities, of the sort that was used to unravel the cricket corruption scandal, are pushing the frontiers of communications intelligence.

IN the age of digital communication, criminals are often better equipped but the line is also increasingly becoming unsafe. So, it appears, is running a large corporation, managing state secrets or just being a political dissident.

Troops on border duties, even those on counter-terrorist duties in Jammu and Kashmir, have long known what Hansie Cronje and his associates evidently did not: no means of electronic communications is safe. Radio silence is maintained during all battle-fr ont operations. In emergencies, soldiers who speak Naga, Malayalam, or other languages, unlikely to be known to Pakistani signals intelligence, are pressed into service. Pakistan troops and irregulars on the Kargil heights last summer used a bewildering mix of Drassi, Shina, and Pushto in order to confuse Indian intelligence personnel, who were then forced to trawl the Kargil area for translators.

Emerging material on interception capabilities of the United States makes clear just what the future might hold. The recently-exposed Project Echelon, for example, allows the U.S. to copy almost every piece of electronic communication worldwide: every fa x transmission, every e-mail messages, every mobile phone call, every other kind of telephone conversation.

Few analysts of the cricket corruption scandal appear to have understood the capabilities of communication intelligence. The latest episode was, in fact, preceded by a series of successful technical telecommunication interception operations. Even as Indi an Airlines Flight IC 814 was on the tarmac in Kandahar last year, Research and Analysis Wing (RAW) officials had a good idea of who had carried out the hijacking, and how – thanks to a series of calls made by the Harkatul Mujahideen’s Mumbai-based opera tive, Abdul Ahmed Latif, during the course of the hijacking. Latif used a mobile telephone, and also a pay phone owned by three brothers from Jogeshwari – Rafiq Sheikh, Javed Sheikh and Muzaffar Sheikh – to remain in contact with his handlers in Karachi.

Among the calls Latif made was one to an Urdu-service staff reporter at the British Broadcasting Corporation headquarters in London, complaining about the Indian negotiators’ intransigence in Kandahar. What Latif did not know was that RAW personnel, who use sophisticated electronic equipment to scan thousands of international and domestic long-distance calls, were listening in. When RAW chief A.S. Dulat visited Jammu two days later to persuade a reluctant Chief Minister Farooq Abdullah to allow the rele ase of prisoners in exchange for the lives of the passengers on IC 814, he was able to promise rapid progress to secure justice. Working with the telephone numbers provided by RAW, Mumbai Crime Branch investigators tracked down Latif and his associates w ithin two days. Their interrogation was crucial in identifying the hijackers.

PAUL BATES / REUTERS

At Menwith Hill in the U.K., one of the data analysis centres under Project Echelon, the world’s most sophisticated intelligence gathering network. The Echelon system allows the U.S. and its associates in the controversial project to monitor almost ev ery piece of electronic communication worldwide.

Other technical operations have also been successful. In the summer of 1998, Punjab Police officials began an electronic communications sweep directed at the renewed activities of the Khalistan Liberation Force (KLF). Among the conversations that they st umbled upon were threat calls directed at affluent businessmen in Ludhiana, made by Dawood Ibrahim’s Nairobi-based associate Abu Salem, and from five unidentified mobile telephones in New Delhi. The numbers were passed on to the Delhi Crime Branch, where Inspector Ishwar Singh, responsible for the Hansie Cronje operation, was assigned charge of the investigation. The Delhi numbers were identified as belonging to the now-notorious Romesh Sharma.

By November, Delhi Police and Intelligence Bureau officials say, they held hours of taped conversations between Sharma, Abu Salem and even top businessmen like Reliance industries chief Dhirubhai Ambani. Ambani, Central Bureau of Investigation (CBI) offi cials now conducting the probe say, was being pressured to meet payments that two high-profile Mumbai stock brokers claimed as their dues. The deal may just have been closed had it not been for a fateful October 20 police raid on Sharma, carried out by c ity South Range officials who had no knowledge of the Crime Branch-Intelligence Bureau surveillance operation. Nothing significant has been heard of the affair since the CBI took charge, perhaps unsurprising given the agency’s track record in cases invol ving political corruption.

Other technical operations have not been quite as high profile, but they have led to significant results in combating terrorism. The five cellphone numbers provided by the Punjab Police in the Romesh Sharma case had also led, earlier that year, to the di scovery of a major arms-running operation run from New Delhi’s maximum security Tihar Jail. Punjab Police officials had begun by investigating reports that the KLF’s Harnek Singh ‘Bhap’ had entered into an alliance with jailed Uttar Pradesh mafia don Om Prakash ‘Babloo’ Shrivastav. The KLF, the force’s informants said, had agreed to provide personnel to execute a series of kidnappings to raise funds, while the Shrivastav gang in turn would be responsible for making available safehouses.

Surveillance led the Crime Branch investigators to some bizarre findings. Mobile phones activate the radio cells nearest to their users’ locations. The five cellphone numbers being monitored activated a single cell, that nearest to Tihar Jail. The Babbar Khalsa International (BKI), it transpired, had already cut a deal with criminals, using phones made available by corrupt prison administration officials, for the delivery of an explosives consignment. Delhi Police officials were waiting for the Haryana- registered truck when it arrived in New Delhi on August 12, 1998. A consignment of RDX or Research Department Explosive, weighing 18 kg, had been hiden in the space between the rim and the boot of the truck, along with four sophisticated electronic timin g devices.

Major breakthroughs based on technical operations came as early as 1996. Shortly after massive blasts occured in New Delhi’s Lajpat Nagar market on May 21, 1996, RAW made available intercepts that led the Srinagar Special Operations Group (SOG) of the Ja mmu and Kashmir Police to Jammu and Kashmir Islamic Front (JKIF) operative Farida Wani. Soon after, her boss, Hilal Baig, was shot dead by the SOG on July 17, 1996. Telephone intercepts also led the Gujarat Police to one of the JKIF’s top associates, Ahm edabad underworld baron and Dawood Ibrahim associate Abdul Rashid Latif. Latif was arrested from New Delhi by a Gujarat Police Anti-Terrorist Squad on October 10, 1996, and was killed later while attempting to escape from custody in Ahmedabad.

Although intelligence officials are unwilling to discuss details, sources say dozens of recent operations targeting the Lashkar-e-Taiba’s activities outside Jammu and Kashmir have been similarly based on communications intelligence. Khalistan terrorists have also been hit through technical means; the January 1999 arrest of a Babbar Khalsa operative who crossed over from Pakistan is one instance. In 1998, Indian intelligence personnel monitoring calls from two U.S.- based Khalistan financiers detected su ccessive calls to a mobile number in Chandigarh. Monitoring led the local police to the gates of the Burail Jail, where, it turned out, Beant Singh assassination-accused Jagtar Singh Hawara had been using the telephone not only to organise a jailbreak bu t to order pizzas, using the convenient address of the Jail Superintendent’s office.

JUST how, then, does communications intelligence work? Contrary to the popular perception, intercepting communications is fairly easy. Scanners can pluck mobile phone signals from the air, and many Western countries have an underground business in fake s ubscriber-identity cards. On August 27 last year, for example, the New York Police arrested three men who were intercepting pager messages meant for the city’s Mayor and Police Commissioner and then selling the contents to media outlets. A conference cal l between U.S. House Speaker Newt Gingrich and his party colleagues was similarly intercepted, and the transcript published in The New York Times. Commercially available equipment even allows remote espionage on the text being typed on a computer screen, or eavesdroppers to listen in to conversations being conducted over a hundred metres away.

Since 1997, however, is a growing body of material on the world’s largest and most sophisticated communications intelligence network, codenamed Echelon. Now the subject of growing controversy following revelations that Echelon was used by the U.S. for co mmercial espionage directed at its North Atlantic Treaty Organisation (NATO) allies, notably France, the organisation emerged from a 1947 United Kingdom-U.S. treaty on sharing intelligence. Canada, Australia and New Zealand later joined the treaty.

Unlike routine espionage operations, Echelon does not target individual electronic communications. It instead gathers vast amounts of traffic on satellites, sub-sea cables, microwave relay stations and high frequency radio. This body of information is su bjected to computer analysis at Echelon centres around the world, notably at Menwith Hill in the U.K., Pine Gap in Australia, Buckley Field near Denver in the U.S., and Bad Aibling in Germany. The computers separate the data gathered into fax, data and v oice communication. This body of material is then subject to searches for certain key words, for example ‘atomic’ or ‘missile’, or for specific telephone numbers and e-mail addresses.

A WELTER of means is available in the Echelon system to monitor almost all long-distance electronic communication. According to a report by expert Duncan Campbell, which formed the core of discussions in the European Parliament in 1998, U.S. Central Inte lligence Agency (CIA) satellites are central to the Echelon system. Satellites of the Magnum, Orion and Rutley class can target very high frequency (VHF) radios, cellular phones, pagers and mobile data links across the globe. Since only a fraction of mic rowave signals in fact arrive at the receiving station, and the rest pass into space, such traffic is also vulnerable. Satellites of the Mercury class target microwave communications, which carry much inter-city traffic. Other satellites intercept traffi c directed at communication satellites, including the Intelsat system.

Embassies and High Commissions form a second important chain in the Echelon system. Foreign missions are located in capital cities and important business centres, which also tend to be the hub for inter-city microwave networks. Since diplomatic premises are not subject to national regulations, most missions install surveillance equipment targeted at their host countries. In some cases, Echelon systems tap directly into the telecommunications infrastructure. Campbell discovered that the Menwith Hill stat ion, for example, taps directly into the British Telecom microwave hub, which receives traffic from sub-sea transatlantic cables. Some media reports have even accused U.S.-based corporations, such as Microsoft of cooperating with their governments to bui ld surveillance mechanisms into software.

Key word searches are just one of the means through which Echelon surveillance works. Since such searches are most effective for text, there has been extensive research on software that can translate voice communications into computer-readable characters . Campbell’s report to the European Parliament suggests that such technology is, at best, of only limited reliability. There has, however, been success in the matter of voice recognition software, which enables computer systems to pick out an individual speaking through the mass of intercepted data. In theory, for example, Echelon systems could detect Osama bin Laden once he initiated a conversation.

The Echelon network is not the world’s only major intelligence gathering operation, although it is by far the world’s most sophisticated. At least 30 countries operate large-scale communications intelligence operations, including India and Pakistan. The largest are outside Echelon is the Russian FAPSI, with some 54,000 employees. China also maintains a large establishment, with two stations directed at Russia in tandem with the U.S. There are no firm figures on Echelon’s budget, but reliable estimates s uggest that over $20 billion is spent worldwide on communication intelligence-related activities. Much of India’s effort has been focussed on military-related signals intelligence, which acquires not only communications but also radar data and details of Army movements.

Nor is it clear whether fighting crime or terrorism is the sole concern of major communications intelligence organisations. The 1998 European Parliament report on electronic espionage claims that U.S. intelligence intercepted conversations between govern ment officials in Brazil and the French firm Thompson-CSF. It used the information to secure a $1.3 billion contract for Thompson-CSF’s U.S. rival, Raytheon. Mike Frost, in his book Spyworld, claims that Canadian agents tapped the U.S. Ambassador’ s conversations to undercut that country’s bid for a $2.5 billion wheat deal. Frost, himself a former operative of the Canadian communication security establishment, claims that British intelligence even invited their counterparts in Canada to place unde r surveillance two politicians suspected by former Prime Minister Margaret Thatcher of political disloyalty.

NEW developments could push the frontiers of communications intelligence even further. In January, U.S. civil rights organisations challenged new rules which would compel telecommunications firms to provide on demand, without a warrant, the exact locatio n of mobile phone users to the Federal Bureau of Investigation (FBI). The new rules, which came about as a result of the Communications Assistance to Law Enforcement Act of 1994, would also mean that companies would have to deliver packet mode communicat ions, those used on the Internet, to the FBI. Echelon had allowed intelligence agencies to bypass laws forbidding unauthorised surveillance of U.S. and U.K. citizens by the simple expedient of asking their alliance counterparts, not bound by such laws, t o carry out the task.

There is little anecdotal material, and even less reliable literature, on the Indian capabilities in this field. It is known, for example, that intelligence agencies compelled pager and mobile phone companies to install surveillance equipment, but only o ther technical means that are at their disposal are not known. Few officials are willing to discuss the subject. Informed sources, however, told Frontline that RAW did have facilities to scan communications for key words, but that both the softwar e and the hardware used left more than a little to be desired. Its voice recognition capabilities too are relatively limited. Police organisations, for their part, have minimal access to such technology, which is limited relatively to simple operations s uch as mobile phone scanning. And while the pending Information Technology Bill of 1999 will give intelligence agencies wide powers to intercept Internet traffic, existing legal restrictions on telephone interception mean that little such evidence can be admitted to have been gathered in the first place, let alone used in trial courts.

When news of the cricket corruption scandal broke, commentators claimed variously that it was impossible to intercept mobile phone conversations or that the Delhi Police had secured a technological feat. Neither was true. Intercepting communications, voi ce or otherwise, is almost industrial in scale, more automated perhaps than any manufacturing process. Be sure when you next send an e-mail out into cyberspace that its recipient might not be the only one to read it with interest.

Volume 17 – Issue 09, Apr. 29 – May 12, 2000

PRAVEEN SWAMI

Find this story at 29 April 2000

Copyrights © 2000, Frontline.

No one is surprised that the United States uses sophisticated electronic spying techniques against its enemies. But Europeans are increasingly worried about allegations that the U.S. uses those same techniques to gather economic intelligence about its allies.

The most extensive claims yet came this spring in a report written for the European Parliament. The report says that the U.S.

National Security Agency, through an electronic surveillance system called Echelon, routinely tracks telephone, fax, and e-mail transmissions from around the world and passes on useful corporate intelligence to American companies.

Among the allegations: that the NSA fed information to Boeing and McDonnell Douglas enabling the companies to beat out European Airbus Industrie for a $ 6 billion contract; and that Raytheon received information that helped it win a $ 1.3 billion contract to provide radar to Brazil, edging out the French company Thomson-CSF. These claims follow previous allegations that the NSA supplied U.S. automakers with information that helped improve their competitiveness with the Japanese (see “Company Spies,” May/June 1994).

Is there truth to these allegations? The NSA is among the most secretive of U.S. intelligence agencies and won’t say much beyond the fact that its mission is “foreign signals intelligence.” The companies involved all refused to comment.

“Since the NSA’s collection capabilities are so grotesquely powerful, it’s difficult to know what’s going on over there,” says John Pike, an analyst at the watchdog group Federation of American Scientists, who has tracked the NSA for years.

This much is known: The NSA owns one of the largest collections of supercomputers in the world, and it’s an open secret–as documented in the European Parliament report–that Echelon vacuums up massive amounts of data from communications satellites and the Internet and then uses its computers to winnow it down. The system scans communications for keywords–“bomb,” for instance–that might tip off analysts to an interesting topic.

Fueling allegations of corporate espionage is the fact that defense contractors and U.S. intelligence agencies are linked extensively through business relationships. Raytheon, for instance, has large contracts to service NSA equipment, according to the European report.

Englishman Glyn Ford, the European Parliament member who initiated the study, wants the NSA to come clean about its activities in Europe. And the Europeans have some leverage on this issue, if they decide to use it. In a drive to improve surveillance, the United States is pressuring European governments to make telephone companies build eavesdropping capabilities into their new systems. But if that’s what the U.S. wants, says Ford, it’s going to have to be open about what information it’s collecting: “If we are going to leave the keys under the doormat for the United States, we want a guarantee that they’re not going to steal the family silver,” he says.

In the meantime, congressional critics have started to wonder if all that high-powered eavesdropping is limited to overseas snooping. In April, Bob Barr (R-Ga.), a member of the House Government Reform Committee, said he was worried by reports that the NSA was engaged in illicit domestic spying.

“We don’t have any direct evidence from the NSA, since they’ve refused to provide any reports, even when asked by the House Intelligence Committee,” Barr says. “But if in fact the NSA is pulling two million transmissions an hour off of these satellites, I don’t think there’s any way they have of limiting them to non-U.S. citizens.”

Last May, after the NSA stonewalled requests to discuss the issue, Congress amended the intelligence appropriations bill to require the agency to submit a report to Congress. (The bill is still in a conference committee.) And the NSA will face more questions when the Government Reform Committee holds hearings on Echelon and other surveillance programs.

“We ought to prevent any agency from the dragnet approach–where they throw out a net and drag anything in,” Barr says.

Kurt Kleiner
Mother Jones November 1, 1999

Find this story at 1 November 1999

Copyright © 2013 Mother Jones and the Foundation for National Progress.

Government Tapping CONTENT, Not Just Metadata … Using Bogus “Secret Interpretation” of Patriot Act

We reported in 2008 that foreign companies have had key roles scooping up Americans’ communications for the NSA:

At least two foreign companies play key roles in processing the information.

Specifically, an Israeli company called Narus processes all of the information tapped by AT &T (AT & T taps, and gives to the NSA, copies of all phone calls it processes), and an Israeli company called Verint processes information tapped by Verizon (Verizon also taps, and gives to the NSA, all of its calls).

Business Insider notes today:

The newest information regarding the NSA domestic spying scandal raises an important question: If America’s tech giants didn’t ‘participate knowingly’ in the dragnet of electronic communication, how does the NSA get all of their data?

One theory: the NSA hired two secretive Israeli companies to wiretap the U.S. telecommunications network.

In April 2012 Wired’s James Bamford — author of the book “The Shadow Factory: The NSA from 9/11 to the Eavesdropping on America” — reported that two companies with extensive links to Israel’s intelligence service provided hardware and software the U.S. telecommunications network for the National Security Agency (NSA).

By doing so, this would imply, companies like Facebook and Google don’t have to explicitly provide the NSA with access to their servers because major Internet Service Providers (ISPs) such as AT&T and Verizon already allows the U.S. signals intelligence agency to eavesdrop on all of their data anyway.

From Bamford (emphasis ours):

“According to a former Verizon employee briefed on the program, Verint, owned by Comverse Technology, taps the communication lines at Verizon…

At AT&T the wiretapping rooms are powered by software and hardware from Narus, now owned by Boeing, a discovery made by AT&T whistleblower Mark Klein in 2004.”

Klein, an engineer, discovered the “secret room” at AT&T central office in San Francisco, through which the NSA actively “vacuumed up Internet and phone-call data from ordinary Americans with the cooperation of AT&T” through the wiretapping rooms, emphasizing that “much of the data sent through AT&T to the NSA was purely domestic.”

NSA whistleblower Thomas Drake corroborated Klein’s assertions, testifying that while the NSA is using Israeli-made NARUS hardware to “seize and save all personal electronic communications.”

Both Verint and Narus were founded in Israel in the 1990s.

***

“Anything that comes through (an internet protocol network), we can record,” Steve Bannerman, marketing vice president of Narus, a Mountain View, California company, said. “We can reconstruct all of their e-mails along with attachments, see what web pages they clicked on, we can reconstruct their (voice over internet protocol) calls.”

With a telecom wiretap the NSA only needs companies like Microsoft, Google, and Apple to passively participate while the agency to intercepts, stores, and analyzes their communication data. The indirect nature of the agreement would provide tech giants with plausible deniability.

And having a foreign contractor bug the telecom grid would mean that the NSA gained access to most of the domestic traffic flowing through the U.S. without technically doing it themselves.

This would provide the NSA, whose official mission is to spy on foreign communications, with plausible deniability regarding domestic snooping.

The reason that Business Insider is speculating about the use of private Israeli companies to thwart the law is that 2 high-ranking members of the Senate Intelligence Committee – Senators Wyden and Udall – have long said that the government has adopted a secret interpretation of section 215 of the Patriot Act which would shock Americans, because it provides a breathtakingly wide program of spying.

Last December, top NSA whistleblower William Binney – a 32-year NSA veteran with the title of senior technical director, who headed the agency’s global digital data gathering program (featured in a New York Times documentary, and the source for much of what we know about NSA spying) – said that the government is using a secret interpretation of Section 215 of the Patriot Act which allows the government to obtain:

Any data in any third party, like any commercial data that’s held about U.S. citizens ….

(relevant quote starts at 4:19).

I called Binney to find out what he meant.

I began by asking Binney if Business Insider’s speculation was correct. Specifically, I asked Binney if the government’s secret interpretation of Section 215 of the Patriot Act was that a foreign company – like Narus, for example – could vacuum up information on Americans, and then the NSA would obtain that data under the excuse of spying on foreign entities … i.e. an Israeli company.

Binney replied no … it was broader than that.

Binney explained that the government is taking the position that it can gather and use any information about American citizens living on U.S. soil if it comes from:

Any service provider … any third party … any commercial company – like a telecom or internet service provider, libraries, medical companies – holding data about anyone, any U.S. citizen or anyone else.

I followed up to make sure I understood what Binney was saying, asking whether the government’s secret interpretation of Section 215 of the Patriot Act was that the government could use any information as long as it came from a private company … foreign or domestic. In other words, the government is using the antiquated, bogus legal argument that it was not using its governmental powers (called “acting under color of law” by judges), but that it was private companies just doing their thing (which the government happened to order all of the private companies to collect and fork over).

Binney confirmed that this was correct. This is what the phone company spying program and the Prism program – the government spying on big Internet companies – is based upon. Since all digital communications go through private company networks, websites or other systems, the government just demands that all of the companies turn them over.

Let’s use an analogy to understand how bogus this interpretation of the Patriot Act is. This argument is analogous to a Congressman hiring a hit man to shoot someone asking too many questions, and loaning him his gun to carry out the deed … and then later saying “I didn’t do it, it was that private citizen!” That wouldn’t pass the laugh test even at an unaccredited, web-based law school offered through a porn site.

I then asked the NSA veteran if the government’s claim that it is only spying on metadata – and not content – was correct. We have extensively documented that the government is likely recording content as well. (And the government has previously admitted to “accidentally” collecting more information on Americans than was legal, and then gagged the judges so they couldn’t disclose the nature or extent of the violations.)

Binney said that was not true; the government is gathering everything, including content.

Binney explained – as he has many times before – that the government is storing everything, and creating a searchable database … to be used whenever it wants, for any purpose it wants (even just going after someone it doesn’t like).

Binney said that former FBI counter-terrorism agent Tim Clemente is correct when he says that no digital data is safe (Clemente says that all digital communications are being recorded).

Binney gave me an idea of how powerful Narus recording systems are. There are probably 18 of them around the country, and they can each record 10 gigabytes of data – the equivalent of a million and a quarter emails with 1,000 characters each – per second.

Binney next confirmed the statement of the author of the Patriot Act – Congressman Jim Sensenbrenner – that the NSA spying programs violate the Patriot Act. After all, the Patriot Act is focused on spying on external threats … not on Americans.

Binney asked rhetorically: “How can an American court [FISA or otherwise] tell telecoms to cough up all domestic data?!”

Update: Binney sent the following clarifying email about content collection:

It’s clear to me that they are collecting most e-mail in full plus other text type data on the web.

As for phone calls, I don’t think they would record/transcribe the approximately 3 billion US-to-US calls every day. It’s more likely that they are recording and transcribing calls made by the 500,000 to 1,000,000 targets in the US and the world.

Posted on June 8, 2013 by WashingtonsBlog

Find this story at 8 June 2013

© 2007 – 2013 Washington’s Blog

AT&T’s central office on Folsom Street in San Francisco houses a secret room that allows the National Security Agency to monitor phone and internet traffic, according to former AT&T technician-cum-whistle-blower Mark Klein. View Slideshow

AT&T provided National Security Agency eavesdroppers with full access to its customers’ phone calls, and shunted its customers’ internet traffic to data-mining equipment installed in a secret room in its San Francisco switching center, according to a former AT&T worker cooperating in the Electronic Frontier Foundation’s lawsuit against the company.

Mark Klein, a retired AT&T communications technician, submitted an affidavit in support of the EFF’s lawsuit this week. That class action lawsuit, filed in federal court in San Francisco last January, alleges that AT&T violated federal and state laws by surreptitiously allowing the government to monitor phone and internet communications of AT&T customers without warrants.

On Wednesday, the EFF asked the court to issue an injunction prohibiting AT&T from continuing the alleged wiretapping, and filed a number of documents under seal, including three AT&T documents that purportedly explain how the wiretapping system works.

According to a statement released by Klein’s attorney, an NSA agent showed up at the San Francisco switching center in 2002 to interview a management-level technician for a special job. In January 2003, Klein observed a new room being built adjacent to the room housing AT&T’s #4ESS switching equipment, which is responsible for routing long distance and international calls.

“I learned that the person whom the NSA interviewed for the secret job was the person working to install equipment in this room,” Klein wrote. “The regular technician work force was not allowed in the room.”

Klein’s job eventually included connecting internet circuits to a splitting cabinet that led to the secret room. During the course of that work, he learned from a co-worker that similar cabinets were being installed in other cities, including Seattle, San Jose, Los Angeles and San Diego.

“While doing my job, I learned that fiber optic cables from the secret room were tapping into the Worldnet (AT&T’s internet service) circuits by splitting off a portion of the light signal,” Klein wrote.

The split circuits included traffic from peering links connecting to other internet backbone providers, meaning that AT&T was also diverting traffic routed from its network to or from other domestic and international providers, according to Klein’s statement.

The secret room also included data-mining equipment called a Narus STA 6400, “known to be used particularly by government intelligence agencies because of its ability to sift through large amounts of data looking for preprogrammed targets,” according to Klein’s statement.

Narus, whose website touts AT&T as a client, sells software to help internet service providers and telecoms monitor and manage their networks, look for intrusions, and wiretap phone calls as mandated by federal law.

Klein said he came forward because he does not believe that the Bush administration is being truthful about the extent of its extrajudicial monitoring of Americans’ communications.

“Despite what we are hearing, and considering the public track record of this administration, I simply do not believe their claims that the NSA’s spying program is really limited to foreign communications or is otherwise consistent with the NSA’s charter or with FISA,” Klein’s wrote. “And unlike the controversy over targeted wiretaps of individuals’ phone calls, this potential spying appears to be applied wholesale to all sorts of internet communications of countless citizens.”

After asking for a preview copy of the documents last week, the government did not object to the EFF filing the paper under seal, although the EFF asked the court Wednesday to make the documents public.

One of the documents is titled “Study Group 3, LGX/Splitter Wiring, San Francisco,” and is dated 2002. The others are allegedly a design document instructing technicians how to wire up the taps, and a document that describes the equipment installed in the secret room.

In a letter to the EFF, AT&T objected to the filing of the documents in any manner, saying that they contain sensitive trade secrets and could be “could be used to ‘hack’ into the AT&T network, compromising its integrity.”

According to court rules, AT&T has until Thursday to file a motion to keep the documents sealed. The government could also step in to the case and request that the documents not be made public, or even that the entire lawsuit be barred under the seldom-used State Secrets Privilege.

AT&T spokesman Walt Sharp declined to comment on the allegations, citing a company policy of not commenting on litigation or matters of national security, but did say that “AT&T follows all laws following requests for assistance from government authorities.”

Ryan Singel 04.07.06

Find this story at 4 July 2006

Wired.com © 2013 Condé Nast

Israeli high-tech firms Verint and Narus have had connections with U.S. companies and Israeli intelligence in the past, and ties between the countries’ intelligence agencies remain strong.

Were Israeli companies Verint and Narus the ones that collected information from the U.S. communications network for the National Security Agency?

The question arises amid controversy over revelations that the NSA has been collecting the phone records of hundreds of millions of Americans every day, creating a database through which it can learn whether terror suspects have been in contact with people in the United States. It also was disclosed this week that the NSA has been gathering all Internet usage – audio, video, photographs, emails and searches – from nine major U.S. Internet providers, including Microsoft and Google, in hopes of detecting suspicious behavior that begins overseas.

According to an article in the American technology magazine “Wired” from April 2012, two Israeli companies – which the magazine describes as having close connections to the Israeli security community – conduct bugging and wiretapping for the NSA.

Verint, which took over its parent company Comverse Technology earlier this year, is responsible for tapping the communication lines of the American telephone giant Verizon, according to a past Verizon employee sited by James Bamford in Wired. Neither Verint nor Verizon commented on the matter.

Natus, which was acquired in 2010 by the American company Boeing, supplied the software and hardware used at AT&T wiretapping rooms, according to whistleblower Mark Klein, who revealed the information in 2004. Klein, a past technician at AT&T who filed a suit against the company for spying on its customers, revealed a “secret room” in the company’s San Fransisco office, where the NSA collected data on American citizens’ telephone calls and Internet surfing.

Klein’s claims were reinforced by former NSA employee Thomas Drake who testified that the agency uses a program produced by Narus to save the personal electrical communications of AT&T customers.

Both Verint and Narus have ties to the Israeli intelligence agency and the Israel Defense Forces intelligence-gathering unit 8200. Hanan Gefen, a former commander of the 8200 unit, told Forbes magazine in 2007 that Comverse’s technology, which was formerly the parent company of Verint and merged with it this year, was directly influenced by the technology of 8200. Ori Cohen, one of the founders of Narus, told Fortune magazine in 2001 that his partners had done technology work for the Israeli intelligence.

International intel

The question of whether intelligence communities outside the United States were involved has been raised. According to The Guardian, the Government Communications Headquarters (GCHQ), Britain’s intelligence agency, secretly collected intelligence information from the world’s largest Internet companies via the American program PRISM. According to a top secret document obtained by The Guardian, GCHQ had access to PRISM since 2010 and it used the information to prepare 197 intelligence reports last year. In a statement to the Guardian, GCHQ, said it “takes its obligations under the law very seriously.”

According to The Guardian, details of GCHQ’s use of PRISM are set out in a 41-page PowerPoint presentation prepared for senior NSA analysts, and describe a “snooping” operation that gave the NSA and FBI access to the systems of nine Internet giants, including Google, Facebook, Microsoft, Apple, Yahoo and Skype.

Given the close ties between U.S. and Israeli intelligence, the question arises as to whether Israeli intelligence, including the Mossad, was party to the secret.

Obama stands by spies

At turns defensive and defiant, U.S. President Barack Obama stood by the spy programs revealed this week.

He declared Friday that his country is “going to have to make some choices” balancing privacy and security, launching a vigorous defense of formerly secret programs that sweep up an estimated 3 billion phone calls a day and amass Internet data from U.S. providers in an attempt to thwart terror attacks.

Obama also warned that it will be harder to detect threats against the United States now that the two top-secret tools to target terrorists have been so thoroughly publicized.

“Nobody is listening to your telephone calls,” Obama assured the nation after two days of reports that many found unsettling. What the government is doing, he said, is digesting phone numbers and the durations of calls, seeking links that might “identify potential leads with respect to folks who might engage in terrorism.” If there’s a hit, he said, “if the intelligence community then actually wants to listen to a phone call, they’ve got to go back to a federal judge, just like they would in a criminal investigation.”

Tapping thwarted terror attack

While Obama said the aim of the programs is to make America safe, he offered no specifics about how the surveillance programs have done this. House Intelligence Committee Chairman Mike Rogers, R-Mich., on Thursday said the phone records sweeps had thwarted a domestic terror attack, but he also didn’t offer specifics.

U.S. government sources said on Friday that the attack in question was an Islamist militant plot to bomb the New York City subway system in 2009.

Obama asserted his administration had tightened the phone records collection program since it started in the George W. Bush administration and is auditing the programs to ensure that measures to protect Americans’ privacy are heeded – part of what he called efforts to resist a mindset of “you know, `Trust me, we’re doing the right thing. We know who the bad guys are.'”

But again, he provided no details on how the program was tightened or what the audit is looking at.

Obama: 100% privacy is impossible

The furor this week has divided Congress, and led civil liberties advocates and some constitutional scholars to accuse Obama of crossing a line in the name of rooting out terror threats.

Obama, himself a constitutional lawyer, strove to calm Americans’ fears – but also remind them that Congress and the courts had signed off on the surveillance.

“I think the American people understand that there are some trade-offs involved,” Obama said when questioned by reporters at a health care event in San Jose, California.

“It’s important to recognize that you can’t have 100 percent security and also then have 100 percent privacy and zero inconvenience,” he said. “We’re going to have to make some choices as a society. And what I can say is that in evaluating these programs, they make a difference in our capacity to anticipate and prevent possible terrorist activity.”

Obama said U.S. intelligence officials are looking at phone numbers and lengths of calls – not at people’s names – and not listening in.

The two classified surveillance programs were revealed this week in newspaper reports that showed, for the first time, how deeply the National Security Agency dives into telephone and Internet data to look for security threats. The new details were first reported by The Guardian and The Washington Post, and prompted Director of National Intelligence James Clapper to take the unusual and reluctant step of acknowledging the programs’ existence.

Obama echoed intelligence experts – both inside and outside the government – who predicted that potential attackers will find other, secretive ways to communicate now that they know that their phone and Internet records may be targeted.

By TheMarker, Haaretz, The Associated Press and Reuters | Jun.08, 2013 | 12:41 PM | 17

Find this story at 8 June 2013

© Haaretz Daily Newspaper Ltd.

WASHINGTON—The National Security Agency’s monitoring of Americans includes customer records from the three major phone networks as well as emails and Web searches, and the agency also has cataloged credit-card transactions, said people familiar with the agency’s activities.

Jerry Seib explains how the far-reaching data collection conducted by the U.S. government includes phone companies in addition to Verizon, plus Internet service providers and Apple. Photo: Getty Images

The disclosure this week of an order by a secret U.S. court for Verizon Communications Inc.’s phone records set off the latest public discussion of the program. But people familiar with the NSA’s operations said the initiative also encompasses phone-call data from AT&T Inc. and Sprint Nextel Corp., records from Internet-service providers and purchase information from credit-card providers.

The Obama administration says its review of complete phone records of U.S. citizens is a “necessary tool” in protecting the nation from terror threats. Is this the accepted new normal, or has the Obama administration pushed the bounds of civil liberties? Cato Institute Director of Information Policy Studies Jim Harper weighs in. Photo: Getty Images.

The agency is using its secret access to the communications of millions of Americans to target possible terrorists, said people familiar with the effort.

The NSA’s efforts have become institutionalized—yet not so well known to the public—under laws passed in the wake of the Sept. 11, 2001, attacks. Most members of Congress defended them Thursday as a way to root out terrorism, but civil-liberties groups decried the program.
Vote and comment

The National Security Agency is obtaining phone records from all Verizon U.S. customers under a secret court order, according to a newspaper report and ex-officials. WSJ intelligence correspondent Siobhan Gorman joins MoneyBeat. Photo: AP.

“Everyone should just calm down and understand this isn’t anything that is brand new,” said Senate Majority Leader Harry Reid (D., Nev.), who added that the phone-data program has “worked to prevent” terrorist attacks.

Senate Intelligence Chairman Dianne Feinstein (D., Calif.) said the program is lawful and that it must be renewed by the secret U.S. court every three months. She said the revelation about Verizon, reported by the London-based newspaper the Guardian, seemed to coincide with its latest renewal.
All Things D
The Laws That Make It Easy for the Government to Spy on Americans
More
What the NSA Wants to Know About You and Your Phone
Tech Companies’ Data Is Also Tapped
FISA Court in Focus
Obama’s Civil-Liberties Record Questioned
When NSA Calls, Companies Answer
Mixed Reactions on Hill
Lawmakers Push Holder for Briefing on Phone Records | More Reaction
Verizon Says Must Comply with Data Requests
Government Is Tracking Verizon Calls
NSA’s Domestic Spying Grows as Agency Sweeps Up Data (3/10/2008)
NSA Exceeds Legal Limits in Eavesdropping Program (4/16/2009)
U.S. Plans ‘Perfect Citizen’ Cyber Shield for Utilities, Companies (7/8/2010)
NSA Activities Violated Fourth Amendment Rights, Letter Discloses (7/20/2012)

Civil-liberties advocates slammed the NSA’s actions. “The most recent surveillance program is breathtaking. It shows absolutely no effort to narrow or tailor the surveillance of citizens,” said Jonathan Turley, a constitutional law expert at George Washington University.

Meanwhile, the Obama administration acknowledged Thursday a secret NSA program dubbed Prism, which a senior administration official said targets only foreigners and was authorized under U.S. surveillance law. The Washington Post and the Guardian reported earlier Thursday the existence of the previously undisclosed program, which was described as providing the NSA and FBI direct access to server systems operated by tech companies that include Google Inc., Apple Inc., Facebook Inc., Yahoo Inc., Microsoft Corp. and Skype. The newspapers, citing what they said was an internal NSA document, said the agencies received the contents of emails, file transfers and live chats of the companies’ customers as part of their surveillance activities of foreigners whose activity online is routed through the U.S. The companies mentioned denied knowledge or participation in the program.

The arrangement with Verizon, AT&T and Sprint, the country’s three largest phone companies means, that every time the majority of Americans makes a call, NSA gets a record of the location, the number called, the time of the call and the length of the conversation, according to people familiar with the matter. The practice, which evolved out of warrantless wiretapping programs begun after 2001, is now approved by all three branches of the U.S. government.

AT&T has 107.3 million wireless customers and 31.2 million landline customers. Verizon has 98.9 million wireless customers and 22.2 million landline customers while Sprint has 55 million customers in total.

NSA also obtains access to data from Internet service providers on Internet use such as data about email or website visits, several former officials said. NSA has established similar relationships with credit-card companies, three former officials said.

It couldn’t be determined if any of the Internet or credit-card arrangements are ongoing, as are the phone company efforts, or one-shot collection efforts. The credit-card firms, phone companies and NSA declined to comment for this article.
From the Archives

More
Video: U.S. Data Gathering Highlights Carriers’ Balancing Act
Video: U.S. Tracks Verizon Calls: A Lawyer’s Take

Though extensive, the data collection effort doesn’t entail monitoring the content of emails or what is said in phone calls, said people familiar with the matter. Investigators gain access to so-called metadata, telling them who is communicating, through what medium, when, and where they are located.

But the disconnect between the program’s supporters and detractors underscored the difficulty Congress has had navigating new technology, national security and privacy.

The Obama administration, which inherited and embraced the program from the George W. Bush administration, moved Thursday to forcefully defend it. White House spokesman Josh Earnest called it “a critical tool in protecting the nation from terror threats.”

But Sen. Ron Wyden (D., Ore.), said he has warned about the breadth of the program for years, but only obliquely because of classification restrictions.

“When law-abiding Americans call their friends, who they call, when they call, and where they call from is private information,” he said. “Collecting this data about every single phone call that every American makes every day would be a massive invasion of Americans’ privacy.”

In the wake of the Sept. 11 attacks, phone records were collected without a court order as a component of the Bush-era warrantless surveillance program authorized by the 2001 USA Patriot Act, which permitted the collection of business records, former officials said.

The ad hoc nature of the NSA program changed after the Bush administration came under criticism for its handling of a separate, warrantless NSA eavesdropping program.

President Bush acknowledged its existence in late 2005, calling it the Terrorist Surveillance Program, or TSP.

When Democrats retook control of Congress in 2006, promising to investigate the administration’s counterterrorism policies, Bush administration officials moved to formalize court oversight of the NSA programs, according to former U.S. officials.

Congress in 2006 also made changes to the Patriot Act that made it easier for the government to collect phone-subscriber data under the Foreign Intelligence Surveillance Act.

Those changes helped the NSA collection program become institutionalized, rather than one conducted only under the authority of the president, said people familiar with the program.

Along with the TSP, the NSA collection of phone company customer data was put under the jurisdiction of a secret court that oversees the Foreign Intelligence Surveillance Act, according to officials.

David Kris, a former top national security lawyer at the Justice Department, told a congressional hearing in 2009 that the government first used the so-called business records authority in 2004.

At the time he was urging the reauthorization of the business-records provisions, known as Section 215 of the Patriot Act, which Congress later approved.

The phone records allow investigators to establish a database used to run queries when there is “reasonable, articulable suspicion” that the records are relevant and related to terrorist activity, Ms. Feinstein said Thursday.

Director of National Intelligence James Clapper also issued a defense of the phone data surveillance program, saying it is governed by a “robust legal regime.” Under the court order, the data can only “be queried when there is a reasonable suspicion, based on specific facts, that the particular basis for the query is associated with a foreign terrorist organization.” When the data is searched, all information acquired is “subject to strict restrictions on handling” overseen by the Justice Department and the surveillance court, and the program is reviewed roughly every 90 days, he said. Another U.S. official said less than 1% of the records are accessed.

The database allows investigators to “map” individuals connected with that information, said Jeremy Bash, who until recently was chief of staff at the Pentagon and is a former chief counsel to the House Intelligence committee.

“We are trying to find a needle in a haystack, and this is the haystack,” Mr. Bash said, referring to the database.

Sen. Wyden on Thursday questioned whether U.S. officials have been truthful in public descriptions of the program. In March, Mr. Wyden noted, he questioned Mr. Clapper, who said the NSA did not “wittingly” collect any type of data pertaining to millions Americans. Spokesmen for Mr. Clapper didn’t respond to requests for comment.

For civil libertarians, this week’s disclosure of the court authorization for part of the NSA program could offer new avenues for challenges. Federal courts largely have rebuffed efforts that target NSA surveillance programs, in part because no one could prove the information was being collected. The government, under both the Bush and Obama administrations, has successfully used its state-secrets privilege to block such lawsuits.

Jameel Jaffer, the American Civil Liberties Union’s deputy legal director, said the fact the FISA court record has now become public could give phone-company customers standing to bring a lawsuit.

“Now we have a set of people who can show they have been monitored,” he said.

Updated June 7, 2013, 9:25 a.m. ET

By SIOBHAN GORMAN, EVAN PEREZ and JANET HOOK

—Danny Yadron and Jennifer Valentino-DeVries contributed to this article.

Find this story at 7 June 2013

Copyright 2012 Dow Jones & Company, Inc. All Rights Reserved

The Carlyle Group has spent years attempting to shed its image as a well-connected private equity firm leveraging Washington heavyweights in the defense sector. Instead, it nurtured a reputation as a financially sophisticated asset manager that buys and sells everything from railroads to oil refineries.

The recent disclosures involving National Security Agency surveillance on U.S. citizens by an employee of Booz Allen Hamilton, a Virginia consulting firm that is majority owned by Carlyle, has thrust two of Washington’s most prominent corporate entities uncomfortably into the limelight, bound by the thread of turning government secrets into profits.

Booz Allen employee Edward Snowden was fired Tuesday after he confessed to being the source of stories about NSA data collection programs. Federal investigators are examining how Snowden, who worked at an NSA facility in Hawaii and had also worked for the CIA, was able to gain access to sensitive information.

Carlyle declined to comment.

Booz Allen, based in Tysons Corner, has been a local fixture for years, employing thousands and providing management and consulting services to the government, particularly the defense and intelligence agencies. It even sponsored a local golf tournament — the Booz Allen Classic — between 2004 and 2006.

It also became a leader among the contractors supplying tens of thousands of intelligence analysts to the government in recent years, including technologists such as Snowden.

Those government contracts, and thousands more like them, in 2008 made Booz Allen a ripe acquisition target for Carlyle.

It paid $2.54 billion for Booz Allen as a deep recession took hold. Fearing the risks of taking on too much debt in the midst of a financial crisis, Carlyle put up 50 percent cash instead of its normal 30 percent. It borrowed the rest to buy the company, which was then privately held.

Upon the close of the deal, the less profitable international and commercial business was spun off to become Booz & Co., leaving Carlyle with a government-only company.

After the split, the new Booz Allen Hamilton established an incentive-based compensation structure that gave the remaining partners a stake in the firm’s success. In effect, said one person close to the deal who was not authorized to speak publicly, “you got to eat what you killed.”

The incentives helped spur profits.

“Everybody has a responsibility, depending on your title, to bring in a certain amount of business,” said William Loomis, managing director at financial services firm Stifel Nicolaus.

Booz Allen, which employs 24,500, had a net profit of $219 million on revenue of nearly $5.8 billion for the fiscal year ended March 31. For the same period ending in 2010, the year the company went public, the company earned $25 million on $5.1 billion in revenue.

George A. Price Jr., senior equity research analyst for aerospace, defense and government services at BB&T Capital Markets, said “they’ve got a great brand, they’ve focused over time on hiring top people, including bringing on people who have a lot of senior government experience.”

Carlyle has cashed in on the increased demand of Booz Allen’s services. As profits and revenue have grown, Booz Allen has borrowed money to pay dividends to shareholders, including Carlyle.

Carlyle collected nearly $550 million in dividends in 2009 alone. Last year, Booz Allen issued another special shareholder dividend valued at $765 million — most of which went to Carlyle investors.

Booz Allen went public in 2010, and Carlyle now owns 95.66 million shares — around 69 percent of the total shares outstanding — valued at about $1.66 billion at the current stock price.

As government contracting began to wane, Booz Allen has pursued commercial work and opened an office in Abu Dhabi in the United Arab Emirates. The contractor, for instance, is marketing cybersecurity and other services to Middle Eastern companies and governments.

The moves are at least partly in response to federal budget cutting, which has taken a toll on the business.

“We consider ourselves a well-run company, and in the past year we’ve become even better in managing our business in a difficult market for government contracting,” Booz Allen spokesman James Fisher said.

Price, the analyst, said the company has seen revenue and profit declines more recently. “They’re not immune from the current environment,” he said, adding that the cuts the company has made have “blunted” the effect.

Carlyle may ultimately reap as much as $3 billion on its initial nearly $1 billion investment. In the end, Booz Allen is shaping up to be one of the firm’s biggest home runs.

By Thomas Heath and Marjorie Censer, Published: June 12

Find this story at 12 June 2013

© The Washington Post Company

WASHINGTON: The explosive leak uncovering America’s vast surveillance program highlights the risks Washington takes by entrusting so much of its defense and spy work to private firms, experts said on Monday.

From analyzing intelligence to training new spies, jobs that were once performed by government employees are now carried out by paid contractors, in a dramatic shift that began in the 1990s amid budget pressures.

Edward Snowden, the 29-year-old man whose leak uncovered how spy agencies sift through phone records and Internet traffic, is among a legion of private contractors who make up nearly 30 percent of the workforce in intelligence agencies.

After the attacks of September 11, 2001, the use of contractors boomed, as government agencies turned to private firms in the global hunt for terror suspects, touting it as a cost-effective way to avoid a permanent increase in the number of civil servants.

As a “contractor alley” rose in the suburbs of northern Virginia outside Washington, the increasing reliance on contractors by the Pentagon and spy services has often been criticized as wasteful and possibly corrupt. But some former intelligence officers and experts warn that it also opens up the spy agencies to big security risks.

The contractors who wear a “green badge” to enter government offices may lack the ethos and discretion of career intelligence officers who wear the “blue badge,” according to John Schindler, a former analyst at the National Security Agency and counterintelligence officer. In a series of tweets, Schindler, who now teaches at the Naval War College, heaped scorn on Snowden for spilling secrets.

But he said it was not surprising the disclosure came from a “green badge” holder and suggested sensitive information technology jobs should not be contracted out. “Been telling my CI (counter intelligence) peeps for years that NSA & IC ( intelligence community) only 1 disgruntled, maladjusted IT dork away from disaster (esp IT contractor)…oh well,” he wrote.

Systems administrators are the 21st century equivalent of the Cold War-era “code clerks,” he said, as they may not hold a high rank but have access to vital information.

Most contractors are former military or intelligence officers, and America’s top spy chief, James Clapper, once worked at Booz Allen Hamilton, the same firm that employed Snowden. Another former national intelligence director, Michael McConnell, also worked at the firm before and after holding the director’s post.

Booz Allen has profited heavily from intelligence work, reportedly earning $1.3 billion or 23 percent of its total revenue from contracts with spy agencies. Former CIA director and defense secretary Robert Gates has voiced concern that too much sensitive work has been farmed out to private companies.

“You want somebody who’s really in it for a career because they’re passionate about it and because they care about the country and not just because of the money,” he told the Washington Post in 2010.

A special website lists job openings for those with security credentials, clearancejobs.com, with positions advertised such as “Intelligence Analyst 3/Targeter” for Northrop Grumman.

“The primary function of a Specialized Skills Officer is to collaborate with a team of intelligence professionals in support of HUMINT operations against priority targets,” said the notice for a workplace in McLean, Virgina.

But the threat of damaging leaks may have less to do with a dependence on contractors and more to do with a younger generation’s distrust of Washington, said James Lewis, a former senior official and cyber security expert at the Center for Strategic and International Studies.

Private contracting does not in and itself pose a serious threat to keeping secrets, Lewis told AFP. “It’s a risk because of the differing attitudes of generations,” he said. “People who haven’t been in the federal service for a long time, who have this view of government shaped by the popular culture are probably more inclined to do this.”

He noted that the most extensive leak of US classified documents came not from a contractor but a low-ranking soldier in the US Army, Private Bradley Manning, who is on trial on espionage charges after admitting to handing over hundreds of thousands of secret files to the WikiLeaks website.

AFP Jun 11, 2013, 04.52AM IST

Find this story at 11 June 2013

© 2013 Bennett, Coleman & Co. Ltd.

The top-secret Boundless Informant tool details and maps by country the voluminous amount of information it collects from computer and telephone networks

guardian.co.uk, Saturday 8 June 2013 20.11 BST

Find this story at 8 June 2013

Revealed: The NSA’s powerful tool for cataloguing global surveillance data – including figures on US collection

The color scheme ranges from green (least subjected to surveillance) through yellow and orange to red (most surveillance). Note the ‘2007’ date in the image relates to the document from which the interactive map derives its top secret classification, not to the map itself.

The National Security Agency has developed a powerful tool for recording and analysing where its intelligence comes from, raising questions about its repeated assurances to Congress that it cannot keep track of all the surveillance it performs on American communications.

The Guardian has acquired top-secret documents about the NSA datamining tool, called Boundless Informant, that details and even maps by country the voluminous amount of information it collects from computer and telephone networks.

The focus of the internal NSA tool is on counting and categorizing the records of communications, known as metadata, rather than the content of an email or instant message.

The Boundless Informant documents show the agency collecting almost 3 billion pieces of intelligence from US computer networks over a 30-day period ending in March 2013. One document says it is designed to give NSA officials answers to questions like, “What type of coverage do we have on country X” in “near real-time by asking the SIGINT [signals intelligence] infrastructure.”

An NSA factsheet about the program, acquired by the Guardian, says: “The tool allows users to select a country on a map and view the metadata volume and select details about the collections against that country.”

Under the heading “Sample use cases”, the factsheet also states the tool shows information including: “How many records (and what type) are collected against a particular country.”

A snapshot of the Boundless Informant data, contained in a top secret NSA “global heat map” seen by the Guardian, shows that in March 2013 the agency collected 97bn pieces of intelligence from computer networks worldwide.
The heat map reveals how much data is being collected from around the world. Note the ‘2007’ date in the image relates to the document from which the interactive map derives its top secret classification, not to the map itself.

Iran was the country where the largest amount of intelligence was gathered, with more than 14bn reports in that period, followed by 13.5bn from Pakistan. Jordan, one of America’s closest Arab allies, came third with 12.7bn, Egypt fourth with 7.6bn and India fifth with 6.3bn.

The heatmap gives each nation a color code based on how extensively it is subjected to NSA surveillance. The color scheme ranges from green (least subjected to surveillance) through yellow and orange to red (most surveillance).

The disclosure of the internal Boundless Informant system comes amid a struggle between the NSA and its overseers in the Senate over whether it can track the intelligence it collects on American communications. The NSA’s position is that it is not technologically feasible to do so.

At a hearing of the Senate intelligence committee In March this year, Democratic senator Ron Wyden asked James Clapper, the director of national intelligence: “Does the NSA collect any type of data at all on millions or hundreds of millions of Americans?”

“No sir,” replied Clapper.

Judith Emmel, an NSA spokeswoman, told the Guardian in a response to the latest disclosures: “NSA has consistently reported – including to Congress – that we do not have the ability to determine with certainty the identity or location of all communicants within a given communication. That remains the case.”

Other documents seen by the Guardian further demonstrate that the NSA does in fact break down its surveillance intercepts which could allow the agency to determine how many of them are from the US. The level of detail includes individual IP addresses.

IP address is not a perfect proxy for someone’s physical location but it is rather close, said Chris Soghoian, the principal technologist with the Speech Privacy and Technology Project of the American Civil Liberties Union. “If you don’t take steps to hide it, the IP address provided by your internet provider will certainly tell you what country, state and, typically, city you are in,” Soghoian said.

That approximation has implications for the ongoing oversight battle between the intelligence agencies and Congress.

On Friday, in his first public response to the Guardian’s disclosures this week on NSA surveillance, Barack Obama said that that congressional oversight was the American peoples’ best guarantee that they were not being spied on.

“These are the folks you all vote for as your representatives in Congress and they are being fully briefed on these programs,” he said. Obama also insisted that any surveillance was “very narrowly circumscribed”.

Senators have expressed their frustration at the NSA’s refusal to supply statistics. In a letter to NSA director General Keith Alexander in October last year, senator Wyden and his Democratic colleague on the Senate intelligence committee, Mark Udall, noted that “the intelligence community has stated repeatedly that it is not possible to provide even a rough estimate of how many American communications have been collected under the Fisa Amendments Act, and has even declined to estimate the scale of this collection.”

At a congressional hearing in March last year, Alexander denied point-blank that the agency had the figures on how many Americans had their electronic communications collected or reviewed. Asked if he had the capability to get them, Alexander said: “No. No. We do not have the technical insights in the United States.” He added that “nor do we do have the equipment in the United States to actually collect that kind of information”.

Soon after, the NSA, through the inspector general of the overall US intelligence community, told the senators that making such a determination would jeopardize US intelligence operations – and might itself violate Americans’ privacy.

“All that senator Udall and I are asking for is a ballpark estimate of how many Americans have been monitored under this law, and it is disappointing that the inspectors general cannot provide it,” Wyden told Wired magazine at the time.

The documents show that the team responsible for Boundless Informant assured its bosses that the tool is on track for upgrades.

The team will “accept user requests for additional functionality or enhancements,” according to the FAQ acquired by the Guardian. “Users are also allowed to vote on which functionality or enhancements are most important to them (as well as add comments). The BOUNDLESSINFORMANT team will periodically review all requests and triage according to level of effort (Easy, Medium, Hard) and mission impact (High, Medium, Low).”

Emmel, the NSA spokeswoman, told the Guardian: “Current technology simply does not permit us to positively identify all of the persons or locations associated with a given communication (for example, it may be possible to say with certainty that a communication traversed a particular path within the internet. It is harder to know the ultimate source or destination, or more particularly the identity of the person represented by the TO:, FROM: or CC: field of an e-mail address or the abstraction of an IP address).

“Thus, we apply rigorous training and technological advancements to combine both our automated and manual (human) processes to characterize communications – ensuring protection of the privacy rights of the American people. This is not just our judgment, but that of the relevant inspectors general, who have also reported this.”

She added: “The continued publication of these allegations about highly classified issues, and other information taken out of context, makes it impossible to conduct a reasonable discussion on the merits of these programs.”

Glenn Greenwald and Ewen MacAskill
guardian.co.uk, Tuesday 11 June 2013 14.00 BST
Additional reporting: James Ball in New York and Spencer Ackerman in Washington

Find this story at 11 June 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.

Analysts at the National Security Agency can now secretly access real-time user data provided by as many as 50 American companies, ranging from credit rating agencies to internet service providers, two government officials familiar with the arrangements said.

Several of the companies have provided records continuously since 2006, while others have given the agency sporadic access, these officials said. These officials disclosed the number of participating companies in order to provide context for a series of disclosures about the NSA’s domestic collection policies. The officials, contacted independently, repeatedly said that “domestic collection” does not mean that the target is based in the U.S. or is a U.S. citizen; rather, it refers only to the origin of the data.

The Wall Street Journal reported today that U.S. credit card companies had also provided customer information. The officials would not disclose the names of the companies because, they said, doing so would provide U.S. enemies with a list of companies to avoid. They declined to confirm the list of participants in an internet monitoring program revealed by the Washington Post and the Guardian, but both confirmed that the program existed.

“The idea is to create a mosaic. We get a tip. We vet it. Then we mine the data for intelligence,” one of the officials said.

In a statement, Director of National Intelligence James Clapper said that programs collect communications “pursuant to section 702 of the Foreign Intelligence Surveillance Act, ” and “cannot be used to intentionally target any U.S. citizen, any other U.S person, or anyone within the United States.”

He called the leaks “reprehensible” and said the program “is among the most important” sources of “valuable” intelligence information the government takes in.

One of the officials who spoke to me said that because data types are not standardized, the NSA needs several different collection tools, of which PRISM, disclosed today by the Guardian and the Washington Post, is one. PRISM works well because it is able to handle several different types of data streams using different basic encryption methods, the person said. It is a “front end” system, or software, that allows an NSA analyst to search through the data and pull out items of significance, which are then stored in any number of databases. PRISM works with another NSA program to encrypt and remove from the analysts’ screen data that a computer or the analyst deems to be from a U.S. person who is not the subject of the investigation, the person said. A FISA order is required to continue monitoring and analyzing these datasets, although the monitoring can start before an application package is submitted to the Foreign Intelligence Surveillance Court.

From the different types of data, including their credit card purchases, the locations they sign in to the internet from, and even local police arrest logs, the NSA can track people it considers terrorism or espionage suspects in near-real time. An internet geo-location cell is on constant standby to help analysts determine where a subject logs in from. Most of the collection takes place on subjects outside the U.S, but a large chunk of the world’s relevant communication passes through American companies with servers on American soil. So the NSA taps in locally to get at targets globally.

It is not clear how the NSA interfaces with the companies. It cannot use standard law enforcement transmission channels to do, since most use data protocols that are not compatible with that hardware. Several of the companies mentioned in the Post report deny granting access to the NSA, although it is possible that they are lying, or that the NSA’s arrangements with the company are kept so tightly compartmentalized that very few people know about it. Those who do probably have security clearances and are bound by law not to reveal the arrangement.

This arrangement allows the U.S. companies to “stay out of the intelligence business,” one of the officials said. That is, the government bears the responsibility for determining what’s relevant, and the company can plausibly deny that it subjected any particular customer to unlawful government surveillance. Previously, Congressional authors of the FAA said that such a “get out of jail free” card was insisted by corporations after a wave of lawsuits revealed the extent of their cooperation with the government.

It is possible, but not likely, that the NSA clandestinely burrows into servers on American soil, without the knowledge of the company in question, although that would be illegal.

The 2008 FISA Amendments Act allow the NSA to analyze, with court orders, domestic communications of all types for counter-terrorism, counter-espionage, counter-narcotics and counter-proliferation purposes. If the agency believes that both ends of the communication, or the circle of those communicating, are wholly within the U.S., the FBI takes over. If one end of the conversation is outside the U.S., the NSA keeps control of the monitoring. An administration official said that such monitoring is subject to “extensive procedures,” but as the Washington Post reported, however, it is often very difficult to segregate U.S. citizens and residents from incidental contact.

One official likened the NSA’s collection authority to a van full of sealed boxes that are delivered to the agency. A court order, similar to the one revealed by the Guardian, permits the transfer of custody of the “boxes.” But the NSA needs something else, a specific purpose or investigation, in order to open a particular box. The chairman of the Senate intelligence committee, Sen. Dianne Feinstein, said the standard was “a reasonable, articulatable” suspicion, but did not go into details.

Legally, the government can ask companies for some of these records under a provision of the PATRIOT Act called the “business records provision.” Initially, it did so without court cognizance. Now, the FISC signs off on every request.

Armed with what amounts to a rubber stamp court order, however, the NSA can collect and store trillions of bytes of electromagnetic detritus shaken off by American citizens. In the government’s eyes, the data is simply moving from one place to another. It does not become, in the government’s eyes, relevant or protected in any way unless and until it is subject to analysis. Analysis requires that second order.

And the government insists that the rules allowing the NSA or the FBI to analyze anything relating to U.S. persons or corporations are strict, bright-line, and are regularly scrutinized to ensure that innocents don’t get caught up in the mix. The specifics, however, remain classified, as do the oversight mechanisms in place.

The wave of disclosures about the NSA programs have significantly unsettled the intelligence community.

The documents obtained by the two newspapers are marked ORCON, or originator controlled, which generally means that the agency keeps a record of every person who accesses them online and knows exactly who might have printed out or saved or accessed a copy. The NSA in particular has a good record of protecting its documents.

The scope of the least suggest to one former senior intelligence official who now works for a corporation that provides data to the NSA that several people with top-level security clearances had to be involved.

The motive, I suspect, is to punch through the brittle legal and moral foundation that modern domestic surveillance is based upon. Someone, at a very high level, or several people, may have simply found that the agency’s zeal to collect information blinded it to the real-world consequences of such a large and unending program. The minimization procedures might also be well below the threshold that most Americans would expect.

Clapper said in his statement that the disclosures about the program “risk important protections for the security of Americans.”

June 6, 2013, at 8:02 PM

Ambinder is co-author of a new book about government secrecy and surveillance, Deep State: Inside the Government Secrecy Industry.

Find this story at 6 June 2013

© 2013 THE WEEK PUBliCATIONS, INC.

A slide depicting the top-secret PRISM program.

The National Security Agency has obtained direct access to the systems of Google, Facebook, Apple and other US internet giants, according to a top secret document obtained by the Guardian.

The NSA access is part of a previously undisclosed program called Prism, which allows officials to collect material including search history, the content of emails, file transfers and live chats, the document says.

The Guardian has verified the authenticity of the document, a 41-slide PowerPoint presentation – classified as top secret with no distribution to foreign allies – which was apparently used to train intelligence operatives on the capabilities of the program. The document claims “collection directly from the servers” of major US service providers.

Although the presentation claims the program is run with the assistance of the companies, all those who responded to a Guardian request for comment on Thursday denied knowledge of any such program.

In a statement, Google said: “Google cares deeply about the security of our users’ data. We disclose user data to government in accordance with the law, and we review all such requests carefully. From time to time, people allege that we have created a government ‘back door’ into our systems, but Google does not have a back door for the government to access private user data.”

Several senior tech executives insisted that they had no knowledge of Prism or of any similar scheme. They said they would never have been involved in such a program. “If they are doing this, they are doing it without our knowledge,” one said.

An Apple spokesman said it had “never heard” of Prism.

The NSA access was enabled by changes to US surveillance law introduced under President Bush and renewed under Obama in December 2012.

The program facilitates extensive, in-depth surveillance on live communications and stored information. The law allows for the targeting of any customers of participating firms who live outside the US, or those Americans whose communications include people outside the US.

It also opens the possibility of communications made entirely within the US being collected without warrants.

Disclosure of the Prism program follows a leak to the Guardian on Wednesday of a top-secret court order compelling telecoms provider Verizon to turn over the telephone records of millions of US customers.

The participation of the internet companies in Prism will add to the debate, ignited by the Verizon revelation, about the scale of surveillance by the intelligence services. Unlike the collection of those call records, this surveillance can include the content of communications and not just the metadata.

Some of the world’s largest internet brands are claimed to be part of the information-sharing program since its introduction in 2007. Microsoft – which is currently running an advertising campaign with the slogan “Your privacy is our priority” – was the first, with collection beginning in December 2007.

It was followed by Yahoo in 2008; Google, Facebook and PalTalk in 2009; YouTube in 2010; Skype and AOL in 2011; and finally Apple, which joined the program in 2012. The program is continuing to expand, with other providers due to come online.

Collectively, the companies cover the vast majority of online email, search, video and communications networks.

The extent and nature of the data collected from each company varies.

Companies are legally obliged to comply with requests for users’ communications under US law, but the Prism program allows the intelligence services direct access to the companies’ servers. The NSA document notes the operations have “assistance of communications providers in the US”.

The revelation also supports concerns raised by several US senators during the renewal of the Fisa Amendments Act in December 2012, who warned about the scale of surveillance the law might enable, and shortcomings in the safeguards it introduces.

When the FAA was first enacted, defenders of the statute argued that a significant check on abuse would be the NSA’s inability to obtain electronic communications without the consent of the telecom and internet companies that control the data. But the Prism program renders that consent unnecessary, as it allows the agency to directly and unilaterally seize the communications off the companies’ servers.

A chart prepared by the NSA, contained within the top-secret document obtained by the Guardian, underscores the breadth of the data it is able to obtain: email, video and voice chat, videos, photos, voice-over-IP (Skype, for example) chats, file transfers, social networking details, and more.

The document is recent, dating to April 2013. Such a leak is extremely rare in the history of the NSA, which prides itself on maintaining a high level of secrecy.

The Prism program allows the NSA, the world’s largest surveillance organisation, to obtain targeted communications without having to request them from the service providers and without having to obtain individual court orders.

With this program, the NSA is able to reach directly into the servers of the participating companies and obtain both stored communications as well as perform real-time collection on targeted users.

The presentation claims Prism was introduced to overcome what the NSA regarded as shortcomings of Fisa warrants in tracking suspected foreign terrorists. It noted that the US has a “home-field advantage” due to housing much of the internet’s architecture. But the presentation claimed “Fisa constraints restricted our home-field advantage” because Fisa required individual warrants and confirmations that both the sender and receiver of a communication were outside the US.

“Fisa was broken because it provided privacy protections to people who were not entitled to them,” the presentation claimed. “It took a Fisa court order to collect on foreigners overseas who were communicating with other foreigners overseas simply because the government was collecting off a wire in the United States. There were too many email accounts to be practical to seek Fisas for all.”

The new measures introduced in the FAA redefines “electronic surveillance” to exclude anyone “reasonably believed” to be outside the USA – a technical change which reduces the bar to initiating surveillance.

The act also gives the director of national intelligence and the attorney general power to permit obtaining intelligence information, and indemnifies internet companies against any actions arising as a result of co-operating with authorities’ requests.

In short, where previously the NSA needed individual authorisations, and confirmation that all parties were outside the USA, they now need only reasonable suspicion that one of the parties was outside the country at the time of the records were collected by the NSA.

The document also shows the FBI acts as an intermediary between other agencies and the tech companies, and stresses its reliance on the participation of US internet firms, claiming “access is 100% dependent on ISP provisioning”.

In the document, the NSA hails the Prism program as “one of the most valuable, unique and productive accesses for NSA”.

It boasts of what it calls “strong growth” in its use of the Prism program to obtain communications. The document highlights the number of obtained communications increased in 2012 by 248% for Skype – leading the notes to remark there was “exponential growth in Skype reporting; looks like the word is getting out about our capability against Skype”. There was also a 131% increase in requests for Facebook data, and 63% for Google.

The NSA document indicates that it is planning to add Dropbox as a PRISM provider. The agency also seeks, in its words, to “expand collection services from existing providers”.

The revelations echo fears raised on the Senate floor last year during the expedited debate on the renewal of the FAA powers which underpin the PRISM program, which occurred just days before the act expired.

Senator Christopher Coons of Delaware specifically warned that the secrecy surrounding the various surveillance programs meant there was no way to know if safeguards within the act were working.

“The problem is: we here in the Senate and the citizens we represent don’t know how well any of these safeguards actually work,” he said.

“The law doesn’t forbid purely domestic information from being collected. We know that at least one Fisa court has ruled that the surveillance program violated the law. Why? Those who know can’t say and average Americans can’t know.”

Other senators also raised concerns. Senator Ron Wyden of Oregon attempted, without success, to find out any information on how many phone calls or emails had been intercepted under the program.

When the law was enacted, defenders of the FAA argued that a significant check on abuse would be the NSA’s inability to obtain electronic communications without the consent of the telecom and internet companies that control the data. But the Prism program renders that consent unnecessary, as it allows the agency to directly and unilaterally seize the communications off the companies’ servers.

When the NSA reviews a communication it believes merits further investigation, it issues what it calls a “report”. According to the NSA, “over 2,000 Prism-based reports” are now issued every month. There were 24,005 in 2012, a 27% increase on the previous year.

In total, more than 77,000 intelligence reports have cited the PRISM program.

Jameel Jaffer, director of the ACLU’s Center for Democracy, that it was astonishing the NSA would even ask technology companies to grant direct access to user data.

“It’s shocking enough just that the NSA is asking companies to do this,” he said. “The NSA is part of the military. The military has been granted unprecedented access to civilian communications.

“This is unprecedented militarisation of domestic communications infrastructure. That’s profoundly troubling to anyone who is concerned about that separation.”

A senior administration official said in a statement: “The Guardian and Washington Post articles refer to collection of communications pursuant to Section 702 of the Foreign Intelligence Surveillance Act. This law does not allow the targeting of any US citizen or of any person located within the United States.

“The program is subject to oversight by the Foreign Intelligence Surveillance Court, the Executive Branch, and Congress. It involves extensive procedures, specifically approved by the court, to ensure that only non-US persons outside the US are targeted, and that minimize the acquisition, retention and dissemination of incidentally acquired information about US persons.

“This program was recently reauthorized by Congress after extensive hearings and debate.

“Information collected under this program is among the most important and valuable intelligence information we collect, and is used to protect our nation from a wide variety of threats.

“The Government may only use Section 702 to acquire foreign intelligence information, which is specifically, and narrowly, defined in the Foreign Intelligence Surveillance Act. This requirement applies across the board, regardless of the nationality of the target.”

Additional reporting by James Ball and Dominic Rushe

Glenn Greenwald and Ewen MacAskill
The Guardian, Friday 7 June 2013

Find this story at 7 June 2013

© 2013 Guardian News and Media Limited or its affiliated companies. All rights reserved.