Close the NSA's Reagan-Era Collection Loophole

There are several ways to report on anxiety we ought have about the documents that Edward Snowden leaked and the others that the intelligence community has protectively and proactively disclosed. You can constantly question the National Security Agency’s motivations, or assume, a priori, malevolent motivations and then turn your conclusions about those motivations into a catalyst for inducing fear in your audience.  Or you can try and identify specific problems, describe their effects, and then propose ways to remedy them.

In the future, I will explore the merits of ending “secret law” and reforming the Foreign Intelligence Surveillance Court process. For now, I want to focus on NSA’s collection authorities. Under the FISA Amendments Act of 2008, NSA can collect a variety of intelligence from, to, or about a category the agency calls “U.S. persons.” 

NSA’s foreign intelligence gathering authorities are enumerated in an executive order, 12-333, signed by President Ronald Reagan. These “12-triple 3” prerogatives include everything NSA does outside the U.S. border. After 9/11, NSA expanded these authorities at the direction of the White House, but when Congress stepped in to codify them, it did so under an expansion of the Foreign Intelligence Surveillance Act, which governed NSA’s domestic surveillance and which has historically been subject to much tighter scrutiny.

Here is an example of a 12-333 breach: an analyst working on China’s nuclear infrastructure using XKEYSCORE , a global Internet analytical tool, and correlating data from repositories containing only foreign intelligence might query a database using an email that turns out to belong to an American scientist. The analyst’s product would therefore be “dirty.” But the analyst might not know she had used an email that belonged to an American until she sees that product -- other emails to Americans using American IP addresses and hosted on American servers.

This is a privacy violation. The intelligence and judiciary committees do get regular reports, in summary form, about compliance incidents that arise from the regular, non-FISA 12-333 collection. But NSA does not provide Congress with details of each case. NSA does, though not regularly, submit these issues to the FISA Court or the Justice Department, even though, according to NSA’s own statistics, these problems are more common than FISA violations

The solution to this is rather simple: Congress could acknowledge the 12-333 authorities in a law, and fund them only if they’re subject to a level of oversight that is appropriate. Or, lawmakers could amend the FISA law or the PATRIOT Act to require NSA to provide the same accounting  for over/under/mis-collects  -- terms of art NSA uses to refer to the aperture of their collection mechanisms -- using any of its authorities. The latter, I predict, will be done; the change is already being discussed by the executive branch and the intelligence committees.

Senators Ron Wyden, D-Ore., and Mark Udall, D-Colo., object to NSA’s newly acquired permission to analyze anything that is legally collected under the FISA authorities, including inadvertently collected U.S. persons data. Both senators have proposed an amendment to subject all U.S. persons’ data to an equal standard of legal review, including all of the incidental or accidentally acquired information. This would end the practice of running U.S. persons emails and phone numbers (already on an approved list of selectors -- a selector is a piece of identifying information -- against any American without an order.

To be clear, NSA hasn’t been randomly running your email or my phone number against the over-collected U.S. persons data; you or I would have already have had to find our way onto a list that is subject is to supervisory level approval. Still, the predicate half of the data is not sufficiently protected, and it ought to be. Again, this is a relatively new practice, so Congress could decide to forbid it entirely or it could pass the Wyden-Udall amendment. The “back-door loophole” would be closed.

The biggest, warranted objection to NSA collection relates to telephone records that companies give to NSA -- that is, all of them, and what NSA is able to do with those records. The concern is about subjecting a defined subset of phone records to “contact chaining,” which means automatically sweeping within the call records of Americans without any connection to anything wrongdoing, and without a court order. The intelligence community wants to be able to do this, and says it is extremely valuable. But it represents a direct, if not particularly gruesome, violation of Americans’ expectation of what the government should and should not see. That this analysis is done by computers, without any set of eyes, is only slightly mitigating. There are dozens of ways to square this circle, including the imposition of a special master, a guardian of the information, to hold the data along with automatic oversight protocols. Or perhaps the companies can do the call-chaining themselves, subject to some sort of court-supervised arrangement. Or, the practice could be written out of the law and NSA could be given much more selective access to phone records, albeit with a much expedited process to match the speed of its intelligence requirements. Several bills, including one introduced by Rep. Justin Amash, R-Mich., would require the government to narrow the scope of its requests for data, even down to the level of a specific investigation.

A whole second category of practicable fixes relates to the way NSA uses its technology. If every change in intelligence practice were subject to a review by a panel of specially cleared engineers and lawyers with a mission to assess the privacy impact of the changes, NSA might not face the very real problem of not knowing what it is doing.

A modest number of reforms can solve a lot of NSA’s fixable problems and begin to address the skepticism and mistrust that Americans rightly bear towards the most powerful information-collecting entity in the world.