{"id":44588,"date":"2014-07-14T12:00:15","date_gmt":"2014-07-14T11:00:15","guid":{"rendered":"https:\/\/www.transcend.org\/tms\/?p=44588"},"modified":"2015-05-05T21:33:41","modified_gmt":"2015-05-05T20:33:41","slug":"in-nsa-intercepted-data-innocent-bystanders-far-outnumber-the-names-targeted","status":"publish","type":"post","link":"https:\/\/www.transcend.org\/tms\/2014\/07\/in-nsa-intercepted-data-innocent-bystanders-far-outnumber-the-names-targeted\/","title":{"rendered":"NSA-Intercepted Data of Innocent Bystanders Far Outnumber Targeted Names"},"content":{"rendered":"

Files provided by Snowden show extent to which ordinary Web users are caught in the net.<\/em><\/p>\n

\"Target<\/a>

Target package prepared by the National Security Agency prior to the capture of Abu Hamza in January 2011<\/p><\/div>\n

July 5 2014 – <\/em>Ordinary Internet users, American and non-American alike, far outnumber legally targeted foreigners in the communications intercepted by the National Security Agency<\/a> from U.S. digital networks, according to a four-month investigation by The Washington Post.<\/p>\n

Nine of 10 account holders found in a large cache of intercepted conversations, which former NSA contractor Edward Snowden<\/a> provided in full to The Post, were not the intended surveillance targets but were caught in a net the agency had cast for somebody else.<\/p>\n

Many of them were Americans. Nearly half of the surveillance files, a strikingly high proportion, contained names, e-mail addresses or other details that the NSA marked as belonging to U.S. citizens or residents. NSA analysts masked, or \u201cminimized,\u201d more than 65,000 such references to protect Americans\u2019 privacy, but The Post found nearly 900 additional e-mail addresses, unmasked in the files, that could be strongly linked to U.S. citizens or U.S.residents.<\/p>\n

The surveillance files highlight a policy dilemma that has been aired only abstractly in public. There are discoveries of considerable intelligence value in the intercepted messages \u2014 and collateral harm to privacy on a scale that the Obama administration has not been willing to address.<\/p>\n

Among the most valuable contents \u2014 which The Post will not describe in detail, to avoid interfering with ongoing operations \u2014 are fresh revelations about a secret overseas nuclear project, double-dealing by an ostensible ally, a military calamity that befell an unfriendly power, and the identities of aggressive intruders into U.S. computer networks.<\/p>\n

\"A<\/a>

A breakdown of the cache of NSA-intercepted communications provided to the Washington Post by Edward Snowden<\/p><\/div>\n

Months of tracking communications across more than 50 alias accounts, the files show, led directly to the 2011 capture in Abbottabad of Muhammad Tahir Shahzad, a Pakistan-based bomb builder, and Umar Patek, a suspect in a 2002 terrorist bombing on the Indonesian island of Bali. At the request of CIA officials, The Post is withholding other examples that officials said would compromise ongoing operations.<\/p>\n

Many other files, described as useless by the analysts but nonetheless retained, have a startlingly intimate, even voyeuristic quality. They tell stories of love and heartbreak, illicit sexual liaisons, mental-health crises, political and religious conversions, financial anxieties and disappointed hopes. The daily lives of more than 10,000 account holders who were not targeted are catalogued and recorded nevertheless.<\/p>\n

In order to allow time for analysis and outside reporting, neither Snowden nor The Post has disclosed until now that he obtained and shared the content of intercepted communications. The cache Snowden provided came from domestic NSA operations under the broad authority granted by Congress in 2008 with amendments to the Foreign Intelligence Surveillance Act. FISA content is generally stored in closely controlled data repositories, and for more than a year, senior government officials have depicted it as beyond Snowden\u2019s reach.<\/p>\n

The Post reviewed roughly 160,000 intercepted e-mail and instant-message conversations, some of them hundreds of pages long, and 7,900 documents taken from more than 11,000 online accounts.<\/p>\n

The material spans President Obama\u2019s first term, from 2009 to 2012, a period of exponential growth for the NSA\u2019s domestic collection.<\/p>\n

Taken together, the files offer an unprecedented vantage point on the changes wrought by Section 702 of the FISA amendments<\/a>, which enabled the NSA to make freer use of methods that for 30 years had required probable cause and a warrant from a judge. One program, code-named PRISM<\/a>, extracts content stored in user accounts at Yahoo, Microsoft, Facebook, Google and five other leading Internet companies. Another, known inside the NSA as Upstream, intercepts data on the move as it crosses the U.S. junctions of global voice and data networks.<\/p>\n

No government oversight body, including the Justice Department, the Foreign Intelligence Surveillance Court, intelligence committees in Congress or the president\u2019s Privacy and Civil Liberties Oversight Board, has delved into a comparably large sample of what the NSA actually collects \u2014 not only from its targets but also from people who may cross a target\u2019s path.<\/p>\n

\"A<\/a>

A composite image of two of the more than 5,000 private photos among data collected by the National Security Agency from online accounts and network links in the United States. The images were included in a large cache of NSA intercepts provided by former agency contractor Edward Snowden. (Images obtained by The Washington Post)<\/p><\/div>\n

Among the latter are medical records sent from one family member to another, r\u00e9sum\u00e9s from job hunters and academic transcripts of schoolchildren. In one photo, a young girl in religious dress beams at a camera outside a mosque.<\/p>\n

Scores of pictures show infants and toddlers in bathtubs, on swings, sprawled on their backs and kissed by their mothers. In some photos, men show off their physiques. In others, women model lingerie, leaning suggestively into a webcam or striking risque poses in shorts and bikini tops.<\/p>\n

\u201cNone of the hits that were received were relevant,\u201d two Navy cryptologic technicians write in one of many summaries of nonproductive surveillance. \u201cNo additional information,\u201d writes a civilian analyst. Another makes fun of a suspected kidnapper, newly arrived in Syria before the current civil war, who begs for employment as a janitor and makes wide-eyed observations about the state of undress displayed by women on local beaches.<\/p>\n

By law, the NSA may \u201ctarget\u201d only foreign nationals located overseas unless it obtains a warrant based on probable cause from a special surveillance court. For collection under PRISM and Upstream rules, analysts must state a reasonable belief that the target has information of value about a foreign government, a terrorist organization or the spread of nonconventional weapons.<\/p>\n

Most of the people caught up in those programs are not the targets and would not lawfully qualify as such. \u201cIncidental collection\u201d of third-party communications is inevitable in many forms of surveillance, but in other contexts the U.S. government works harder to limit and discard irrelevant data. In criminal wiretaps, for example, the FBI is supposed to stop listening to a call if a suspect\u2019s wife or child is using the phone.<\/p>\n

There are many ways to be swept up incidentally in surveillance aimed at a valid foreign target. Some of those in the Snowden archive were monitored because they interacted directly with a target, but others had more-tenuous links.<\/p>\n

If a target entered an online chat room, the NSA collected the words and identities of every person who posted there, regardless of subject, as well as every person who simply \u201clurked,\u201d reading passively what other people wrote.<\/p>\n

\u201c1 target, 38 others on there,\u201d one analyst wrote. She collected data on them all.<\/p>\n

In other cases, the NSA designated as its target the Internet protocol, or IP, address of a computer server used by hundreds of people.<\/p>\n

The NSA treats all content intercepted incidentally from third parties as permissible to retain, store, search and distribute to its government customers. Raj De, the agency\u2019s general counsel, has testified that the NSA does not generally attempt to remove irrelevant personal content, because it is difficult for one analyst to know what might become relevant to another.<\/p>\n

The Obama administration declines to discuss the scale of incidental collection. The NSA, backed by Director of National Intelligence James R. Clapper Jr., has asserted that it is unable to make any estimate, even in classified form, of the number of Americans swept in. It is not obvious why the NSA could not offer at least a partial count, given that its analysts routinely pick out \u201cU.S. persons\u201d and mask their identities, in most cases, before distributing intelligence reports.<\/p>\n

If Snowden\u2019s sample is representative, the population under scrutiny in the PRISM and Upstream programs is far larger than the government has suggested. In a June 26 \u201ctransparency report,\u201d the Office of the Director of National Intelligence disclosed that 89,138 people were targets<\/a> of last year\u2019s collection under FISA Section 702. At the 9-to-1 ratio of incidental collection in Snowden\u2019s sample, the office\u2019s figure would correspond to nearly 900,000 accounts, targeted or not, under surveillance.<\/p>\n

\u2018He didn\u2019t get this data\u2019<\/p>\n

U.S. intelligence officials declined to confirm or deny in general terms the authenticity of the intercepted content provided by Snowden, but they made off-the-record requests to withhold specific details that they said would alert the targets of ongoing surveillance. Some officials, who declined to be quoted by name, described Snowden\u2019s handling of the sensitive files as reckless.<\/p>\n

In an interview, Snowden said \u201cprimary documents\u201d offered the only path to a concrete debate about the costs and benefits of Section 702 surveillance. He did not favor public release of the full archive, he said, but he did not think a reporter could understand the programs \u201cwithout being able to review some of that surveillance, both the justified and unjustified.\u201d<\/p>\n

\u201cWhile people may disagree about where to draw the line on publication, I know that you and The Post have enough sense of civic duty to consult with the government to ensure that the reporting on and handling of this material causes no harm,\u201d he said.<\/p>\n

In Snowden\u2019s view, the PRISM and Upstream programs have \u201ccrossed the line of proportionality.\u201d<\/p>\n

\u201cEven if one could conceivably justify the initial, inadvertent interception of baby pictures and love letters of innocent bystanders,\u201d he added, \u201ctheir continued storage in government databases is both troubling and dangerous. Who knows how that information will be used in the future?\u201d<\/p>\n

For close to a year, NSA and other government officials have appeared to deny, in congressional testimony and public statements, that Snowden had any access to the material.<\/p>\n

As recently as May, shortly after he retired as NSA director, Gen. Keith Alexander denied that Snowden could have passed FISA content to journalists.<\/p>\n

\u201cHe didn\u2019t get this data,\u201d Alexander told a New Yorker reporter. \u201cThey didn\u2019t touch \u2014\u201d<\/p>\n

\u201cThe operational data?\u201d the reporter asked.<\/p>\n

\u201cThey didn\u2019t touch the FISA data,\u201d Alexander replied. He added, \u201cThat database, he didn\u2019t have access to.\u201d<\/p>\n

Robert S. Litt, the general counsel for the Office of the Director of National Intelligence, said in a prepared statement that Alexander and other officials were speaking only about \u201craw\u201d intelligence, the term for intercepted content that has not yet been evaluated, stamped with classification markings or minimized to mask U.S. identities.<\/p>\n

\u201cWe have talked about the very strict controls on raw traffic, the training that people have to have, the technological lockdowns on access,\u201d Litt said. \u201cNothing that you have given us indicates that Snowden was able to circumvent that in any way.\u201d<\/p>\n

In the interview, Snowden said he did not need to circumvent those controls, because his final position as a contractor for Booz Allen at the NSA\u2019s Hawaii operations center gave him \u201cunusually broad, unescorted access to raw SIGINT [signals intelligence] under a special \u2018Dual Authorities\u2019 role,\u201d a reference to Section 702 for domestic collection and Executive Order 12333 for collection overseas. Those credentials, he said, allowed him to search stored content \u2014 and \u201ctask\u201d new collection \u2014 without prior approval of his search terms.<\/p>\n

\u201cIf I had wanted to pull a copy of a judge\u2019s or a senator\u2019s e-mail, all I had to do was enter that selector into XKEYSCORE,\u201d one of the NSA\u2019s main query systems, he said.<\/p>\n

The NSA has released an e-mail exchange acknowledging that Snowden took the required training classes for access to those systems.<\/p>\n

\u2018Minimized U.S. president\u2019<\/p>\n

At one level, the NSA shows scrupulous care in protecting the privacy of U.S. nationals and, by policy, those of its four closest intelligence allies \u2014 Britain, Australia, Canada and New Zealand.<\/p>\n

More than 1,000 distinct \u201cminimization\u201d terms appear in the files, attempting to mask the identities of \u201cpossible,\u201d \u201cpotential\u201d and \u201cprobable\u201d U.S. persons, along with the names of U.S. beverage companies, universities, fast-food chains and Web-mail hosts.<\/p>\n

Some of them border on the absurd, using titles that could apply to only one man. A \u201cminimized U.S. president-elect\u201d begins to appear in the files in early 2009, and references to the current \u201cminimized U.S. president\u201d appear 1,227 times in the following four years.<\/p>\n

Even so, unmasked identities remain in the NSA\u2019s files, and the agency\u2019s policy is to hold on to \u201cincidentally\u201d collected U.S. content, even if it does not appear to contain foreign intelligence.<\/p>\n

In one exchange captured in the files, a young American asks a Pakistani friend in late 2009 what he thinks of the war in Afghanistan. The Pakistani replies that it is a religious struggle against 44 enemy states.<\/p>\n

Startled, the American says \u201cthey, ah, they arent heavily participating .\u2009.\u2009. its like .\u2009.\u2009. in a football game, the other team is the enemy, not the other teams waterboy and cheerleaders.\u201d<\/p>\n

\u201cNo,\u201d the Pakistani shoots back. \u201cThe ther teams water boy is also an enemy. it is law of our religion.\u201d<\/p>\n

\u201chaha, sorry thats kind of funny,\u201d the American replies.<\/p>\n

When NSA and allied analysts really want to target an account, their concern for U.S. privacy diminishes. The rationales they use to judge foreignness sometimes stretch legal rules or well-known technical facts to the breaking point.<\/p>\n

In their classified internal communications, colleagues and supervisors often remind the analysts that PRISM and Upstream collection have a \u201clower threshold for foreignness \u2018standard of proof\u2019\u2009\u201d than a traditional surveillance warrant from a FISA judge, requiring only a \u201creasonable belief\u201d and not probable cause.<\/p>\n

One analyst rests her claim that a target is foreign on the fact that his e-mails are written in a foreign language, a quality shared by tens of millions of Americans. Others are allowed to presume that anyone on the chat \u201cbuddy list\u201d of a known foreign national is also foreign.<\/p>\n

In many other cases, analysts seek and obtain approval to treat an account as \u201cforeign\u201d if someone connects to it from a computer address that seems to be overseas. \u201cThe best foreignness explanations have the selector being accessed via a foreign IP address,\u201d an NSA supervisor instructs an allied analyst in Australia.<\/p>\n

Apart from the fact that tens of millions of Americans live and travel overseas, additional millions use simple tools called proxies to redirect their data traffic around the world, for business or pleasure. World Cup fans this month have been using a browser extension called Hola to watch live-streamed games that are unavailable from their own countries. The same trick is routinely used by Americans who want to watch BBC video. The NSA also relies routinely on locations embedded in Yahoo tracking cookies, which are widely regarded by online advertisers as unreliable.<\/p>\n

In an ordinary FISA surveillance application, the judge grants a warrant and requires a fresh review of probable cause \u2014 and the content of collected surveillance \u2014 every 90 days. When renewal fails, NSA and allied analysts sometimes switch to the more lenient standards of PRISM and Upstream.<\/p>\n

\u201cThese selectors were previously under FISA warrant but the warrants have expired,\u201d one analyst writes, requesting that surveillance resume under the looser standards of Section 702. The request was granted.<\/p>\n

\u2018I don\u2019t like people knowing\u2019<\/p>\n

She was 29 and shattered by divorce, converting to Islam in search of comfort and love. He was three years younger, rugged and restless. His parents had fled Kabul and raised him in Australia, but he dreamed of returning to Afghanistan.<\/p>\n

One day when she was sick in bed, he brought her tea. Their faith forbade what happened next, and later she recalled it with shame.<\/p>\n

\u201cwhat we did was evil and cursed and may allah swt MOST merciful forgive us for giving in to our nafs [desires]\u201d<\/p>\n

Still, a romance grew. They fought. They spoke of marriage. They fought again.<\/p>\n

All of this was in the files because, around the same time, he went looking for the Taliban.<\/p>\n

He found an e-mail address on its English-language Web site and wrote repeatedly, professing loyalty to the one true faith, offering to \u201ccome help my brothers\u201d and join the fight against the unbelievers.<\/p>\n

On May 30, 2012, without a word to her, he boarded a plane to begin a journey to Kandahar. He left word that he would not see her again.<\/p>\n

If that had been the end of it, there would not be more than 800 pages of anguished correspondence between them in the archives of the NSA and its counterpart, the Australian Signals Directorate.<\/p>\n

He had made himself a target. She was the collateral damage, placed under a microscope as she tried to adjust to the loss.<\/p>\n

Three weeks after he landed in Kandahar, she found him on Facebook.<\/p>\n

\u201cIm putting all my pride aside just to say that i will miss you dearly and your the only person that i really allowed myself to get close to after losing my ex husband, my dad and my brother.. Im glad it was so easy for you to move on and put what we had aside and for me well Im just soo happy i met you. You will always remain in my heart. I know you left for a purpose it hurts like hell sometimes not because Im needy but because i wish i could have been with you.\u201d<\/p>\n

His replies were cool, then insulting, and gradually became demanding. He would marry her but there were conditions. She must submit to his will, move in with his parents and wait for him in Australia. She must hand him control of her Facebook account \u2014 he did not approve of the photos posted there.<\/p>\n

She refused. He insisted:<\/p>\n

\u201clook in islam husband doesnt touch girl financial earnigs unless she agrees but as far as privacy goes there is no room\u2026.i need to have all ur details everything u do its what im supposed to know that will guide u whether its right or wrong got it\u201d<\/p>\n

Later, she came to understand the irony of her reply:<\/p>\n

\u201cI don\u2019t like people knowing my private life.\u201d<\/p>\n

Months of negotiations followed, with each of them declaring an end to the romance a dozen times or more. He claimed he had found someone else and planned to marry that day, then admitted it was a lie. She responded:<\/p>\n

\u201cNo more games. You come home. You won\u2019t last with an afghan girl.\u201d<\/p>\n

She begged him to give up his dangerous path. Finally, in September, she broke off contact for good, informing him that she was engaged to another man.<\/p>\n

\u201cWhen you come back they will send you to jail,\u201d she warned.<\/p>\n

They almost did.<\/p>\n

In interviews with The Post, conducted by telephone and Facebook, she said he flew home to Australia last summer, after failing to find members of the Taliban who would take him seriously. Australian National Police met him at the airport and questioned him in custody. They questioned her, too, politely, in her home. They showed her transcripts of their failed romance. When a Post reporter called, she already knew what the two governments had collected about her.<\/p>\n

Eventually, she said, Australian authorities decided not to charge her failed suitor with a crime. Police spokeswoman Emilie Lovatt declined to comment on the case.<\/p>\n

Looking back, the young woman said she understands why her intimate correspondence was recorded and parsed by men and women she did not know.<\/p>\n

\u201cDo I feel violated?\u201d she asked. \u201cYes. I\u2019m not against the fact that my privacy was violated in this instance, because he was stupid. He wasn\u2019t thinking straight. I don\u2019t agree with what he was doing.\u201d<\/p>\n

What she does not understand, she said, is why after all this time, with the case long closed and her own job with the Australian government secure, the NSA does not discard what it no longer needs.<\/p>\n

_________________________<\/p>\n

Jennifer Jenkins and Carol D. Leonnig contributed to this report.<\/em><\/p>\n

Barton Gellman writes for the national staff. He has contributed to three Pulitzer Prizes for The Washington Post, most recently the 2014 Pulitzer Prize for Public Service.<\/em><\/p>\n

Go to Original \u2013 washingtonpost.com<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Files provided by Snowden show extent to which ordinary Web users are caught in the net.<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[60],"tags":[],"class_list":["post-44588","post","type-post","status-publish","format-standard","hentry","category-whistleblowing-surveillance"],"_links":{"self":[{"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/posts\/44588","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/comments?post=44588"}],"version-history":[{"count":0,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/posts\/44588\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/media?parent=44588"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/categories?post=44588"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.transcend.org\/tms\/wp-json\/wp\/v2\/tags?post=44588"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}