In a surprise announcement last week, the National Security Agency (NSA) stated that it was ending the much criticized (and previously much defended) practice of collecting digital communications data that merely mentions a foreign surveillance target (0): “[The] NSA will no longer collect certain internet communications that merely mention a foreign intelligence target. This information is referred to in the Intelligence Community as ‘about’ communications in Section 702 ‘upstream’ internet surveillance. NSA will limit such collection to internet communications that are sent to and from a foreign target.” The normally secretive agency also revealed that it would (1) “delete the vast majority of previously acquired upstream internet communications as soon as practicable.”
As explained more fully in previous blogs, Section 702 grants (2) the US government the authority to target communications of foreign individuals, assumed to be outside the country, to gather vital intelligence. While forbidden to collect information on individuals in the US or from US citizens directly, the intelligence agencies can sweep up information about Americans “incidentally” caught up in the surveillance of foreigners. This “upstream” data stems for the vast number of emails and texts that the NSA is authorized to glean from the traffic of telecoms companies that own the backbone of the internet. In the upstream sweep, the NSA not only acquires email addresses to and from a suspected agent, but also references to an outside individual (possibly a US citizen) in the body of the communication. Thus the term “about” denotes a situation in which inclusion stems not from “to or from” addresses but merely from the mention of the individual in the text (3).
There are two plausible explanations for the sudden change. First, the NSA found itself in continuing conflict (4) with the Foreign Intelligence Surveillance Court (FISA), which oversees these vast data collection activities. In 2011, the FISA court had established special rules to protect the privacy of citizens whose domestic emails had been inadvertently caught up in the intelligence collections web. The specific problem had resulted from the practice of telecoms companies bundling foreign and domestic messages (with even one targeted address) together and transmitting them to the NSA as a group. NSA brought this issue to the attention of the FISA court and proposed that the bundled messages be placed in a special repository where analysts writing intelligence reports would not have access. The court granted this exception. But last year, the NSA discovered that some of their analysts had broken the rule and queried the material in ways that violated the agreement. They reported this to the court, which delayed a reauthorization (5) of its previous grant of authority. This sequence of events was one major factor in the NSA decision to forgo “about” surveillance.
However, the NSA’s sudden decision must be viewed in a larger context: the necessity to obtain congressional reauthorization of Section 702 by the end of 2017 — and the fact that this program has come under unceasing attack by privacy groups and their supporters in Congress. Earlier blogs have described and analyzed the more general debate of Section 702. Suffice it to add here that the “about” rules and NSA practices have been a particular focus of critics such as ACLU Attorney Patrick Toomey, who argues (6): “This kind of warrant-free, suspicion-free surveillance is exactly what the Fourth Amendment prohibits.” The NSA saw the handwriting on the wall, according to former NSA Director Michael Hayden (7): “Politically, they want to make 702, which is still the most productive source of information the NSA has ever had. . . more politically acceptable.” Sen. Ron Wyden (D-OR), the leading privacy advocate and NSA critic in the Senate, has also vowed to give a permanent statutory mandate (8) to the intelligence agency’s less formal administrative decision to forgo “about” collection.
Rep. Bob Goodlatte (R-VA), chairman of the House Judiciary Committee, has announced plans for a hearing (9) on Section 702 renewal next month. Despite NSA’s defense of the “about” change, there are still unanswered questions about the ultimate impact on the intelligence agency’s ability to collect vital digital information on foreign agents. A year ago, the NSA told (10) the Privacy and Civil Liberties Oversight Board that it was “largely unfeasible to limit ‘about’ collection without also eliminating a substantial portion of upstream ‘to/from’ collection, which would more dramatically hinder the government’s antiterrorism efforts.” Hayden, while noting the political imperatives, also points out that technological limitations on NSA ability to separate “about” from “to/from” have not changed — and the agency certainly will lose some collection capability (11): “This is not triggered by any technological change. . . NSA is going to lose some good coverage here.” But, “operationally, they are willing to pay the price.”
Despite the NSA’s current retreat, that “price” will be much debated as the deadline nears and the legislative process kicks into high gear.