Upstream Internet Surveillance Confusion

A Federal District Court judge today threw out the ACLU-led challenge to the NSA’s warrantless upstream surveillance of one-end-foreign Internet communications under the FISA Amendments Act, ruling that the plaintiffs, including Wikimedia Foundation, had not established standing. The case touched on an article that I wrote in August 2013, early in the post-Snowden leak era, that is worth commenting on because subsequent revelations have given us a better understanding of how upstream Internet surveillance under that statute works.

Back in the summer of 2013, I figured out that the NSA was not just collecting messages to and from targeted foreigners, but also those that were merely “about” such foreigners but between two other people. This turned out to be a side consequence of how “upstream” style surveillance – collection of e-mails and other text-based communications as they cross fiberoptic Internet switches – works: it grabs any message with a targeted selector, whether the selector was in the e-mail header (“To: [email protected]”) or in the e-mail body (“Hey when you get there, send a message to [email protected] so he knows it worked out.”) This feature is alien to phone wiretapping, and we had not before understood that the government was doing this.

In that article I also wrote what I had figured out at the time about how Upstream-style worked:


To conduct the surveillance, the N.S.A. is temporarily copying and then sifting through the contents of what is apparently most e-mails and other text-based communications that cross the border. The senior intelligence official, who, like other former and current government officials, spoke on condition of anonymity because of the sensitivity of the topic, said the N.S.A. makes a “clone of selected communication links” to gather the communications, but declined to specify details, like the volume of the data that passes through them.

In the ACLU/Wikimedia case, the plaintiffs cited this article to argue that the NSA had temporarily copied their communications, giving them standing. The judge today rejected that this had been shown to be true. He cited a passage in a July 2014 Privacy and Civil Liberties Oversight Board report about the FISA Amendments Act saying that my article put forth “a misunderstanding of a more complex reality.”

This echoed another judge’s ruling in February 2015, in an Electronic Frontier Foundation-led case, which threw out much of a lawsuit on behalf of AT&T customers against the National Security Agency based on state-secrets claims. It also focused on Upstream. The judge said that, based on his reading of classified documents, their description of how it works, which echoed the one I had written in 2013, was incorrect, but did not elaborate.

But we now understand better what is going on.

Last summer, working with ProPublica and some previously undisclosed Snowden documents, I helped write an article focused on AT&T’s role in facilitating NSA surveillance of Internet communications. Among other things, we figured out an important aspect: the NSA is not directly performing the copying and sifting. Rather its telecom partners do that on its behalf, using the selectors (and in some cases the equipment) the government supplied, and forwarding only those messages the NSA has legal authority to collect. So the NSA is not coming into direct possession of the fulltake data stream. As we wrote:

Many privacy advocates have suspected that AT&T was giving the N.S.A. a copy of all Internet data to sift for itself. But one 2012 presentation says the spy agency does not “typically” have “direct access” to telecoms’ hubs. Instead, the telecoms have done the sifting and forwarded messages the government believes it may legally collect.

“Corporate sites are often controlled by the partner, who filters the communications before sending to N.S.A.,” according to the presentation. This system sometimes leads to “delays” when the government sends new instructions, it added.

The companies’ sorting of data has allowed the N.S.A. to bring different surveillance powers to bear. Targeting someone on American soil requires a court order under the Foreign Intelligence Surveillance Act. When a foreigner abroad is communicating with an American, that law permits the government to target that foreigner without a warrant. When foreigners are messaging other foreigners, that law does not apply and the government can collect such emails in bulk without targeting anyone.

Privacy advocates, confronted with this complexity, argue that it doesn’t make any difference – if the telecoms are doing something they would not normally do because the government has asked or directed them to do it, then they are effectively N.S.A. agents at that moment and the Fourth Amendment still applies. Their argument, in other words, is that actually the description as I wrote it two years ago, when I didn’t yet understand the role of the telecoms, was nevertheless correct, as a legal matter.

That is an interesting argument. If a court ever lets a plaintiff gets to the merits, rather than throwing cases out on standing or on state-secrets grounds, it would be a central question to litigate.






A secret (for now) appeals court ruling in our targeted killing FOIA lawsuit

The U.S. Court of Appeals for the Second Circuit has issued what appears to be a significant ruling in the ongoing NYT/ACLU Freedom of Information Act lawsuit for legal memos related to targeted killings — but we can’t see it yet. The court has made certain redactions in its opinion, and the government now has 30 days to appeal whether additional parts should be withheld from public view.

This is the same case that previously dragged into the light the February 2010 and July 2010 Office of Legal Counsel memos about killing Anwar al-Awlaki, the U.S. citizen and radical Muslim cleric accused of helping orchestrate the Christmas 2009 underwear bombing attack by al-Qaeda in the Arabian Peninsula, and whom the U.S. killed in a drone strike in Yemen in September 2011. Litigation has continued over other legal memos about targeted killing operations more generally.

We’ll find out later this year what is going on.

UPDATE Oct. 23, 2015: A reader points out that, per the now-unsealed transcript of ex parte oral arguments in July, it may be that the dispute is over the release of (only) two and a half pages of a 2002 DOJ Office of Legal Counsel memo on targeted killings, although there was some sealed back-and-forth after that so maybe something more is involved.


On “Quotes” and Reconstructed Dialogue in Journalism

It bothers me to read, in your standard Bob Woodward style insider book or personal memoirs by retired officials, dialogue from private conversations that has quotation marks around it. To me, quotation marks are for verbatim comments. In reporting out behind-the-scenes stuff, we journalists can reconstruct approximate dialogue drawn from people’s memories (ideally, cross-referencing multiple witnesses) or scribbled meeting notes. But unless we were there, or someone recorded it, or there was a trained stenographer, what we’re doing is capturing the gist of what was said in approximate form – not quoting what was literally actually said. It’s different from a quotation from a document or from a public speech or from a direct interview.

I have to obey the New York Times‘ stylistic conventions when writing for the newspaper, but I had more flexibility in writing my own book, so I decided to use italicized text to be up front about when dialogue was reconstructed rather than verbatim. In places I drew on memories of conversations as recounted in officials’ memoirs or as reported in fellow journalists’ work, and I turned their fake quotes into italicized dialogue, too. I explain this in a note in the front, reproduced below.



Down to two weeks for “Power Wars” publication. Please pre-order a copy!

Previous blog post: What’s in “Power Wars?” Here’s the table of contents.

We’re asking a court to force the government to disclose more of its surveillance-related inspector general reports for public scrutiny

“Under FOIA, courts are not rendered mere bystanders whenever the executive branch declares something classified.” — NYT motion

Today, the New York Times filed a memorandum of law in support of its motion for summary judgment in another one of my Freedom of Information Act lawsuits. This case involves a series of inspector general reports about government surveillance programs. Some were heavily classified at the time they were completed, and some were entirely classified. One is a joint report by six agency inspectors general about the National Security Agency’s Stellarwind program, which was completely withheld from the public when completed in 2009. (The “NSA inspector general report” that Edward Snowden leaked was an early draft of the NSA inspector general’s contribution to this much larger report.) Several others are Justice Department inspector general reports about matters like the FBI’s use of national security letters, the FISA Amendments Act, and Section 215 of the Patriot Act.

The government responded to the lawsuit by reprocessing and turning over newly declassified (but still heavily redacted in places) versions of these reports, which brought lots of new information to light. Here are some of the revelations:

George W. Bush Made Retroactive N.S.A. ‘Fix’ After Hospital Room Showdown

Declassified Report Shows Doubts About Value of N.S.A.’s Warrantless Spying

F.B.I. Is Broadening Surveillance Role, Report Shows


But we think there is still more that they should be required to make public under FOIA, and so we’re challenging certain continued blacked-out passages. The Times’ lawyer is David McCraw, assisted by Jeremy Kutner and Tali Leinwand, and I thank them.