[Infowarrior] - Matt Blaze on NSA surveillance

[Richard Forno]

The Metadata is the Message
Did the NSA's Warrantless Wiretap Program include large-scale domestic  
surveillance?

http://www.crypto.com/blog/metatapping/

Bell System Secrecy of Communications poster Warrantless wiretapping  
is back in the news, thanks largely to Michael Isikoff's cover piece  
in the December 22 issue of Newsweek. We now know that the principal  
source for James Risen and Eric Lichtblau's Pulitzer Prize winning  
article that broke the story three years ago in the New York Times was  
a Justice department official named Thomas M. Tamm. Most of the  
current attention, naturally, has focused on Tamm and on whether, as  
Newsweek's tagline put it, he's "a hero or a criminal". Having never  
in my life faced an ethical dilemma on the magnitude of Tamm's --  
weighing betrayal of one trust against the service of another -- I  
can't help but wonder what I'd have done in his shoes. Whistleblowing  
is inherently difficult, morally ambiguous territory. At best there  
are murky shades of gray, inevitably viewed through the myopic lenses  
of individual loyalties, fears, and ambitions, to say nothing of the  
prospect of life-altering consequences that might accompany exposure.  
Coupled with the high stakes of national security and civil liberties,  
it's hard not to think about Tamm in the context of another famously  
anonymous source, the late Mark Felt (known to a generation only as  
Watergate's "Deep Throat").

But an even more interesting revelation -- one ultimately far more  
troubling -- can be found in a regrettably less prominent sidebar to  
the main Newsweek story, entitled "Now we know what the battle was  
about", by Daniel Klaidman. Put together with other reports about the  
program, it lends considerable credence to claims that telephone  
companies (including my alma matter AT&T) provided the NSA with  
wholesale access to purely domestic calling records, on a scale beyond  
what has been previously acknowledged.

The sidebar casts new light on one of the more dramatic episodes to  
leak out of Washington in recent memory; quoting Newsweek:

     It is one of the darkly iconic scenes of the Bush Administration.  
In March 2004, two of the president's most senior advisers rushed to a  
Washington hospital room where they confronted a bedridden John  
Ashcroft. White House chief of staff Andy Card and counsel Alberto  
Gonzales pressured the attorney general to renew a massive domestic- 
spying program that would lapse in a matter of days. But others  
hurried to the hospital room, too. Ashcroft's deputy, James Comey,  
later joined by FBI Director Robert Mueller, stood over Ashcroft's bed  
to make sure the White House aides didn't coax their drugged and  
bleary colleague into signing something unwittingly. The attorney  
general, sick and pain-racked from a rare pancreatic disease, rose up  
from his bed, gathering what little strength he had, and firmly told  
the president's emissaries that he would not sign their papers.

     White House hard-liners would make one more effort -- getting the  
president to recertify the program on his own, relying on his powers  
as commander in chief. But in the end, with an election looming and  
the entire political leadership of the Justice Department poised to  
resign rather than carry out orders they thought to be illegal, Bush  
backed down. The rebels prevailed.

Like most people, I had assumed that the incident concerned the NSA's  
interception (without the benefit of court warrants) of the contents  
of telephone and Internet traffic between the US and foreign targets.  
That program is at best a legal gray area, the subject of several  
lawsuits, and the impetus behind Congress' recent (and I think quite  
ill-advised) retroactive grant of immunity to telephone companies that  
provided the government with access without proper legal authority.

But that, apparently, wasn't was this was about at all. Instead, again  
quoting Newsweek:

     Two knowledgeable sources tell NEWSWEEK that the clash erupted  
over a part of Bush's espionage program that had nothing to do with  
the wiretapping of individual suspects. Rather, Comey and others  
threatened to resign because of the vast and indiscriminate collection  
of communications data. These sources, who asked not to be named  
discussing intelligence matters, describe a system in which the  
National Security Agency, with cooperation from some of the country's  
largest telecommunications companies, was able to vacuum up the  
records of calls and e-mails of tens of millions of average Americans  
between September 2001 and March 2004. The program's classified code  
name was "Stellar Wind," though when officials needed to refer to it  
on the phone, they called it "SW." (The NSA says it has "no  
information or comment"; a Justice Department spokesman also declined  
to comment.)

While it may seem on the surface to involve little more than arcane  
and legalistic hairsplitting, that the battle was about records rather  
than content is actually quite surprising. And it raises new -- and  
rather disturbing -- questions about the nature of the wiretapping  
program, and especially about the extent of its reach into the  
domestic communications of innocent Americans.


The issue has to do with a peculiarity of US surveillance law. There  
are generally stricter requirements for wiretaps that intercept call  
content than for those that record only transactional data (who called  
whom and when). The legal rationale for this distinction is complex  
but has its origins in how wireline telephones worked and were used in  
the last century. There is a theory that while a telephone call's  
audio is intended only for other party, the numbers dialed have  
already been given voluntarily to a third party -- the phone company  
-- and thus are legally less "private". And there is a basic  
assumption about the kinds of privacy we value most. Being listened in  
on has been thought to be inherently more invasive than having one's  
calling records examined. So the government can obtain transactional  
records relatively easily, under a lower legal standard than what is  
required for a full content tap.

Modern computing and communications technology may make these  
assumptions less valid than they were when the legal theories of  
wiretapping were developed. As electronic communication pervades more  
of our daily lives, transaction records -- metadata -- can reveal  
quite a bit about us, indeed often much more than a few out-of-context  
conversations might. Aggregated into databases with other people's  
records (or perhaps everyone's records) and analyzed by powerful  
software, metadata by itself can paint a remarkably detailed picture  
of connections, relationships, and other patterns that could never be  
recovered simply from listening to the conversations themselves.  
Metadata can also be analyzed retrospectively, since calling records  
are now kept by phone companies for every customer, not just the  
suspects. And the very distinction between content and metadata defies  
easy translation into the Internet, where whether something is content  
or not can depend entirely on where in the network the question is  
being asked.

But that's beside the point here. Rightly or wrongly, current law  
treats metadata differently from content. In particular, it's legally  
simpler under the Foreign Intelligence Surveillance Act (FISA) for the  
government to obtain telephone records than it is to intercept actual  
telephone call audio. All that is required, in general, is an  
assertion that the specific records involved are likely to be germane  
to a investigation, a relatively undemanding standard to meet. Content  
taps, on the other hand, require evidence of probable cause and are  
subject to more judicial scrutiny.

So how could it have been on that night in 2004 that these officials  
were comfortable with the legality of intercepting trans-border call  
content without a FISA warrant -- something apparently expressly  
forbidden under the law -- and yet drew the line when it came to  
collecting call records? That would seem, based on longstanding  
principles of surveillance law, to get it backwards. What kind of  
records could have provoked such a reaction, and did their collection  
and use violate the privacy of ordinary Americans in ways that go  
beyond what is already known about the program?

The Newsweek sidebar raises more questions than it answers here, but  
piecing together various details from previous reports about the  
program suggests likely possibilities.

NSA mining of traffic metadata obtained directly from US telephone  
switches appears to have first been reported by the New York Times in  
December, 2005 (two weeks after they broke the story of the wiretap  
program itself). However, that article focused primarily on trans- 
border traffic on switches at the edge of the US, the very same  
traffic from which call audio was also being intercepted. So it seems  
unlikely that collecting call records exclusively from those switches  
would raise special concerns for officials who believed that they were  
permitted to collect the content without warrants.

Two years later, in 2007, the Times reported that the FBI had been  
asking US telephone companies for extended "community of interest"  
data about various terrorism suspects. That is, the FBI obtained not  
just calling records of their suspects, but also the calling patters  
of everyone they communicated with, even those not suspected of  
wrongdoing. However, there are several differences between the kind of  
large-scale metadata collection suggested by Newsweek and the FBI  
program described by the Times. In the Times article, the FBI used  
secret "National Security Letters" to obtain data from telephone  
companies about the communities of specific targets, which implies a  
more limited scope, involving far fewer people's records, than an NSA  
program of the kind described by Newsweek would have had.

However, still another Times piece, written by John Markoff in 2006,  
reported that law enforcement officers with subpoenas were sometimes  
been given restricted access to data mining software on AT&T's Daytona  
database of domestic and international call records. And an article by  
Leslie Cauley in USA Today later that year suggested that the NSA was  
mining domestic call detail records provided by several carriers. More  
specifically, the Electronic Frontier Foundation has alleged in a  
lawsuit that the NSA had been given relatively unrestricted access,  
without subpoenas, to all or most of the AT&T Daytona database as part  
of the warrantless wiretap program,

Notably, the large-scale domestic metadata collection that made Comey  
and Mueller so uneasy is strikingly consistent with the 2006 news  
reports and the EFF lawsuit's claims about NSA access to Daytona,  
since AT&T's call database captures a substantial fraction of US  
citizens' domestic, and not just international, traffic. If the NSA  
made use of unrestricted access to this database (and perhaps of  
analogous databases maintained by other carriers), this would be cause  
for precisely the kinds of legal concerns described by Newsweek. While  
the law puts fewer restrictions on metadata collection than on content  
tapping, it still requires that records requests be focused on  
specific targets, and definitely does not allow the NSA to have  
wholesale access to databases of every telephone user's domestic calls.

If this was indeed what was going on -- and the recent Newsweek  
sidebar seems to corroborate it -- it would represent a much more  
invasive reach into the private lives of innocent Americans by the NSA  
than previous reports about the program have been able to confirm. And  
if AT&T really provided the government with sweeping access to the  
calling records of all its customers, that would be a huge personal  
disappointment -- not only a violation of the law, but a betrayal of  
the fundamental privacy values instilled into me from my very first  
day at Bell Labs, and that, I had genuinely believed, were embedded in  
the core of the company's culture.

So I hope I'm wrong. But the very least, the Newsweek piece  
underscores the importance of investigating just what happened. We all  
deserve to know.