TableofContents

NSASecretsCopyrightIntroductionU.S.,British intelligenceminingdata fromnineU.S. InternetcompaniesinbroadsecretprogramFromobscuritytonotoriety,SnowdentookanunusualpathEdward Snowden,BradleyManning and the risk of the low-level, tech-savvyleakerU.S. surveillance architecture includes collection of revealing Internet,phonemetadataMetadata reveals secrets of social position, company hierarchy, terroristcellsNewdocumentsrevealparametersofNSA’ssecretsurveillanceprogramsPresident’ssurveillanceprogramworkedwithprivatesectortocollectdataafterSept.11,2001ForNSAchief, terrorist threat drivespassion to ‘collect it all, observerssayNSAbrokeprivacyrulesthousandsoftimesperyear,auditfindsFISAcourt:AbilitytopoliceU.S.spyingprogramlimitedNSAgatheredthousandsofAmericans’e-mailsbeforecourtorderedittoreviseitstacticsU.S. spy network’s successes, failures and objectives detailed in ‘blackbudget’summaryNSApayingU.S.companiesforaccesstocommunicationsnetworksTohuntOsamabinLaden, satelliteswatchedoverAbbottabad,Pakistan,andNavySEALsU.S. spy agencies mounted 231 offensive cyber-operations in 2011,documentsshow

Spyagenciesspendmillionstohuntforinsiderthreats,documentshowsTop-secretfilesshownewlevelsofdistrustofPakistanU.S.documentsdetailal-Qaeda’seffortstofightbackagainstdronesObamaadministrationhadNSArestrictionsreversedin2011DeclassifiedcourtdocumentshighlightNSAviolationsindatacollectionFISAcourtreleasesopinionupholdingNSAphoneprogramU.S.officialsdodgequestionsonscopeofsurveillanceNSAreportontheTorEncryptedNetworkDual-leadershiproleatNSAandCyberCommandstirsdebateNSA tries to regain industry’s trust toworkcooperatively against cyber-threatsEffortunderwaytodeclassifydocumentthatislegalfoundationforNSAphoneprogramNSAcollectsmillionsofe-mailaddressbooksgloballyDocuments reveal NSA’s extensive involvement in targeted killingprogramNSAinfiltrateslinkstoYahoo,Googledatacentersworldwide,SnowdendocumentssayNSAtrackingcellphonelocationsworldwide,SnowdendocumentsshowJudge:NSA’scollectingofphonerecordsisprobablyunconstitutionalMorefromtheWashingtonPostConnectwithDiversionBooks

NSASecrets

GovernmentSpyingintheInternetAge

TheWashingtonPost

Copyright

DiversionBooks

ADivisionofDiversionPublishingCorp.443ParkAvenueSouth,Suite1004

NewYork,NewYork10016

www.DiversionBooks.com

Copyright©2013byTheWashingtonPostAllrightsreserved,includingtherighttoreproducethisbookorportionsthereofinanyformwhatsoever.

Formoreinformation,emailinfo@diversionbooks.comFirstDiversionBookseditionDecember2013

ISBN:978-1-62681-212-3

Introduction

ByBartonGellmanDecember23,2013

Anundatedhandoutphotoby theNationalSecurityAgency (NSA)shows theNSAheadquarters inFortMeade,Maryland,USA.Asecretintelligenceprogramcalled‘Prism’runbytheNSAhasbeencollectingdata from millions of communication service subscribers through access to many of the top Internetcompanies,includingGoogle,Facebook,AppleandVerizon.(EPA/NationalSecurityAgency/Handout)

MOSCOW—Thefamiliarvoiceonthehotelroomphonedidnotwastewords.“Whattimedoesyourclocksay,exactly?”heasked.Hecheckedthereplyagainsthiswatchanddescribedaplacetomeet.“I’llseeyouthere,”hesaid.

EdwardJosephSnowdenemergedattheappointedhour,alone,blendingintoa light crowd of locals and tourists.He cocked his arm for a handshake, thenturnedhisshouldertoindicateapath.Beforelonghehadguidedhisvisitortoasecurespaceoutofpublicview.

Duringmorethan14hoursofinterviews,thefirsthehasconductedinpersonsince arrivinghere in June,Snowdendid not part the curtains or stepoutside.RussiagrantedhimtemporaryasylumonAug.1,butSnowdenremainsatargetofsurpassinginteresttotheintelligenceserviceswhosesecretshespilledonanepicscale.

Latethisspring,Snowdensuppliedthreejournalists,includingthisone,withcaches of top-secret documents from theNational Security Agency, where heworkedasacontractor.Dozensof revelations followed,and thenhundreds, asnewsorganizationsaroundtheworldpickedupthestory.Congresspressedforexplanations,newevidencerevivedold lawsuitsandtheObamaadministrationwasobligedtodeclassifythousandsofpagesithadfoughtforyearstoconceal.

Taken together, the revelations have brought to light a global surveillancesystemthatcastoffmanyofitshistoricalrestraintsaftertheattacksofSept.11,2001. Secret legal authorities empowered theNSA to sweep in the telephone,Internet and location records of whole populations. One of the leakedpresentationslidesdescribedtheagency’s“collectionphilosophy”as“Orderoneofeverythingoffthemenu.”

Sixmonthsafter thefirst revelationsappeared inTheWashingtonPostandBritain’sGuardiannewspaper,Snowdenagreedtoreflectat lengthontherootsandrepercussionsofhischoice.Hewasrelaxedandanimatedovertwodaysofnearlyunbrokenconversation, fueledbyburgers,pasta, icecreamandRussianpastry.

Snowdenofferedvignettes fromhis intelligencecareerand fromhis recentlife as “an indoor cat” inRussia.But he consistently steered the conversationbacktosurveillance,democracyandthemeaningofthedocumentsheexposed.

“For me, in terms of personal satisfaction, the mission’s already

accomplished,”hesaid.“Ialreadywon.Assoonasthejournalistswereabletowork,everythingthatIhadbeentryingtodowasvalidated.Because,remember,Ididn’twanttochangesociety.Iwantedtogivesocietyachancetodetermineifitshouldchangeitself.”

“All Iwantedwas for thepublic tobe able tohave a say inhow they aregoverned,”hesaid.“Thatisamilestoneweleftalongtimeago.Rightnow,allwearelookingatarestretchgoals.”

‘Goinginblind’Snowden is an orderly thinker, with an engineer’s approach to problem-

solving.Hehadcometobelievethatadangerousmachineofmasssurveillancewas growing unchecked. Closed-door oversight by Congress and the ForeignIntelligence Surveillance Court was a “graveyard of judgment,” he said,manipulatedbytheagencyitwassupposedtokeepincheck.Classificationruleserectedwallstopreventpublicdebate.

Topplingthosewallswouldbeaspectacularactoftransgressionagainstthenorms that prevailed inside them. Someone would have to bypass security,extract the secrets,makeundetected contactwith journalists andprovide themwithenoughprooftotellthestories.

TheNSA’s business is “information dominance,” the use of other people’ssecretstoshapeevents.At29,Snowdenupendedtheagencyonitsownturf.

“Yourecognizethatyou’regoinginblind,thatthere’snomodel,”Snowdensaid,acknowledgingthathehadnowaytoknowwhetherthepublicwouldsharehisviews.

“Butwhen youweigh that against the alternative,which is not to act,” hesaid,“yourealizethatsomeanalysisisbetterthannoanalysis.Becauseevenifyouranalysisprovestobewrong,themarketplaceofideaswillbearthatout.Ifyoulookatitfromanengineeringperspective,aniterativeperspective,it’sclearthatyouhavetotrysomethingratherthandonothing.”

By his own terms, Snowden succeeded beyond plausible ambition. TheNSA,accustomedtowatchingwithoutbeingwatched,facesscrutinyithasnotenduredsincethe1970s,orperhapsever.

The cascading effects have made themselves felt in Congress, the courts,popular culture, Silicon Valley and world capitals. The basic structure of theInternetitselfisnowinquestion,asBrazilandmembersoftheEuropeanUnionconsider measures to keep their data away from U.S. territory and U.S.technology giants including Google, Microsoft and Yahoo take extraordinarystepstoblockthecollectionofdatabytheirgovernment.

Formonths,ObamaadministrationofficialsattackedSnowden’smotivesandsaidtheworkoftheNSAwasdistortedbyselectiveleaksandmisinterpretations.

On Dec. 16, in a lawsuit that could not have gone forward without thedisclosures made possible by Snowden, U.S. District Judge Richard J. Leondescribed the NSA’s capabilities as “almost Orwellian” and said its bulkcollectionofU.S.domestictelephonerecordswasprobablyunconstitutional.

Thenext day, in theRooseveltRoom, anunusual delegationof executivesfromold telephone companies andyoung Internet firms toldPresidentObamathattheNSA’sintrusionintotheirnetworkswasathreattotheU.S.informationeconomy. The following day, an advisory panel appointed by Obamarecommendedsubstantialnewrestrictionson theNSA, includinganendto thedomesticcall-recordsprogram.

“Thisweekisaturningpoint,”saidtheGovernmentAccountabilityProject’sJesselynRadack,who is one of Snowden’s legal advisers. “It has been just acascade.”

‘Theyelectedme’OnJune22,theJusticeDepartmentunsealedacriminalcomplaintcharging

Snowdenwithespionageandfelonytheftofgovernmentproperty.Itwasadry

enumerationofstatutes,withoutatraceoftheangerpulsingthroughSnowden’sformerprecincts.

In the intelligenceandnational securityestablishments,Snowden iswidelyviewedasarecklesssaboteur,andjournalistsabettinghimlittlelessso.

AttheAspenSecurityForuminJuly,afour-starmilitaryofficerknownforhisevenkeelseethedthroughonemeetingalongsideareporterheknewtobeincontactwithSnowden.Beforewalkingaway,heturnedandpointedafinger.

“Wedidn’thaveanother9/11,”hesaidangrily,becauseintelligenceenabledwarfighters to find the enemy first. “Until you’ve got to pull the trigger, untilyou’vehadtoburyyourpeople,youdon’thaveaclue.”

ItiscommonlysaidofSnowdenthathebrokeanoathofsecrecy,aturnofphrasethatcapturesasenseofbetrayal.NSADirectorKeithB.AlexanderandDirectorofNationalIntelligenceJamesR.ClapperJr.,amongmanyothers,haveusedthatformula.

InhisinterviewwithThePost,Snowdennotedmatter-of-factlythatStandardForm 312, the classified-information nondisclosure agreement, is a civilcontract.Hesignedit,buthepledgedhisfealtyelsewhere.

“Theoathofallegianceisnotanoathofsecrecy,”hesaid.“Thatisanoathtothe Constitution. That is the oath that I kept that KeithAlexander and JamesClapperdidnot.”

Peoplewhoaccusehimofdisloyalty,hesaid,mistakehispurpose.“IamnottryingtobringdowntheNSA,IamworkingtoimprovetheNSA,”

hesaid.“IamstillworkingfortheNSArightnow.Theyaretheonlyoneswhodon’trealizeit.”

WhatentitledSnowden,now30,totakeonthatresponsibility?“Thatwholequestion—whoelectedyou?— inverts themodel,”he said.

“Theyelectedme.Theoverseers.”HenamedthechairmenoftheSenateandHouseintelligencecommittees.“Dianne Feinstein elected me when she asked softball questions” in

committee hearings, he said. “Mike Rogers elected me when he kept these

programshidden.…TheFISAcourtelectedmewhentheydecidedtolegislatefrom thebenchon things thatwere farbeyond themandateofwhat thatcourtwaseverintendedtodo.Thesystemfailedcomprehensively,andeachlevelofoversight,eachlevelofresponsibilitythatshouldhaveaddressedthis,abdicatedtheirresponsibility.”

“It wasn’t that they put it on me as an individual — that I’m uniquelyqualified, an angel descending from the heavens — as that they put it onsomeone,somewhere,”hesaid.“Youhavethecapability,andyourealizeeveryother[person]sittingaroundthetablehasthesamecapabilitybuttheydon’tdoit.Sosomebodyhastobethefirst.”

‘Front-pagetest’Snowdengrants thatNSAemployeesbyand largebelieve in theirmission

and trust the agency to handle the secrets it takes from ordinary people —deliberately,inthecaseofbulkrecordscollection,and“incidentally,”whenthecontentofAmericanphonecallsande-mailsaresweptintoNSAsystemsalongwithforeigntargets.

But Snowden also said acceptance of the agency’s operations was notuniversal. He began to test that propositionmore than a year ago, he said, inperiodic conversations with co-workers and superiors that foreshadowed hisemergingplan.

Beginning in October 2012, he said, he brought his misgivings to twosuperiorsintheNSA’sTechnologyDirectorateandtwomoreintheNSAThreatOperationsCenter’sregionalbaseinHawaii.Foreachofthem,and15otherco-workers, Snowden said he opened a data query tool calledBOUNDLESSINFORMANT,whichusedcolor-coded“heatmaps”todepictthevolumeofdataingestedbyNSAtaps.

Hiscolleagueswereoften“astonishedtolearnwearecollectingmoreintheUnitedStatesonAmericansthanweareonRussiansinRussia,”hesaid.Many

ofthemweretroubled,hesaid,andseveralsaidtheydidnotwanttoknowanymore.

“Iaskedthesepeople,‘Whatdoyouthinkthepublicwoulddoifthiswasonthefrontpage?’ ”hesaid.Henoted thatcriticshaveaccusedhimofbypassinginternal channels of dissent. “How is that not reporting it? How is that notraisingit?”hesaid.

By lastDecember,Snowdenwas contacting reporters, althoughhehadnotyetpassedalonganyclassifiedinformation.Hecontinuedtogivehiscolleaguesthe“front-pagetest,”hesaid,untilApril.

Asked about those conversations, NSA spokeswoman Vanee Vines sent aprepared statement to The Post: “After extensive investigation, includinginterviewswithhisformerNSAsupervisorsandco-workers,wehavenotfoundanyevidencetosupportMr.Snowden’scontentionthathebroughtthesematterstoanyone’sattention.”

Snowdenrecountedanothersetofconversationsthathesaidtookplacethreeyearsearlier,whenhewassentbytheNSA’sTechnologyDirectoratetosupportoperations at a listening post in Japan.As a system administrator, he had fullaccess to security and auditing controls. He said he saw serious flaws withinformationsecurity.

“I actually recommended theymove to two-man control for administrativeaccess back in 2009,” he said, first to his supervisor in Japan and then to thedirectorate’schiefofoperationsinthePacific.“Sure,awhistleblowercouldusethesethings,butsocouldaspy.”

Thatprecaution,whichrequiresasecondsetofcredentialstoperformriskyoperations such as copying files onto a removable drive, has been among theprincipalsecurityresponsestotheSnowdenaffair.

Vines, the NSA spokeswoman, said there was no record of thoseconversations,either.

U.S.‘wouldceasetoexist’Just before releasing the documents this spring, Snowden made a final

reviewoftherisks.Hehadovercomewhathedescribedatthetimeasa“selfishfear”oftheconsequencesforhimself.

“I said toyou theonly fear [left] is apathy— thatpeoplewon’t care, thattheywon’twantchange,”herecalledthismonth.

The documents leaked by Snowden compelled attention because theyrevealedtoAmericansahistorytheydidnotknowtheyhad.

Internal briefing documents reveled in the “Golden Age of ElectronicSurveillance.” Brawny cover names such as MUSCULAR, TUMULT andTURMOILboastedoftheagency’sprowess.

Withassistancefromprivatecommunicationsfirms,theNSAhadlearnedtocaptureenormousflowsofdataatthespeedoflightfromfiber-opticcablesthatcarriedInternetandtelephonetrafficovercontinentsandunderseas.Accordingto one document inSnowden’s cache, the agency’sSpecial SourceOperationsgroup,whichasearlyas2006wassaidtobeingesting“oneLibraryofCongressevery14.4seconds,”hadanofficialsealthatmighthavebeenparody:aneaglewithalltheworld’scablesinitsgrasp.

Each year, NSA systems collected hundreds of millions of e-mail addressbooks, hundreds of billions of cellphone location records and trillions ofdomesticcalllogs.

Most of that data, by definition and intent, belonged to ordinary peoplesuspectedofnothing.ButvastnewstoragecapacityandprocessingtoolsenabledtheNSAtousetheinformationtomaphumanrelationshipsonaplanetaryscale.Onlythisway,itsleadershipbelieved,couldtheNSAreachbeyonditsuniverseofknownintelligencetargets.

In the view of the NSA, signals intelligence, or electronic eavesdropping,wasamatteroflifeanddeath,“withoutwhichAmericawouldceasetoexistasweknowit,”accordingtoaninternalpresentationin thefirstweekofOctober

2001astheagencyrampedupitsresponsetotheal-QaedaattacksontheWorldTradeCenterandthePentagon.

Withstakessuchasthose,therewasnocapabilitytheNSAbelieveditshouldleaveonthetable.TheagencyfollowedordersfromPresidentGeorgeW.Bushto begin domestic collection without authority from Congress and the courts.When the NSA won those authorities later, some of them under secretinterpretationsoflawspassedbyCongressbetween2007and2012,theObamaadministrationwentfurtherstill.

Using PRISM, the cover name for collection of user data from Google,Yahoo,Microsoft,Apple and fiveotherU.S.-based companies, theNSAcouldobtainallcommunicationstoorfromanyspecifiedtarget.Thecompanieshadnochoicebuttocomplywiththegovernment’srequestfordata.

ButtheNSAcouldnotusePRISM,whichwasoverseenonceayearbythesurveillance court, for the collection of virtually all data handled by thosecompanies. To widen its access, it teamed up with its British counterpart,GovernmentCommunicationsHeadquarters,orGCHQ,tobreakintotheprivatefiber-opticlinksthatconnectedGoogleandYahoodatacentersaroundtheworld.

Thatoperation,whichused thecovernameMUSCULAR,tappedintoU.S.companydata fromoutsideU.S. territory.TheNSA, therefore, believed it didnotneedpermissionfromCongressorjudicialoversight.Datafromhundredsofmillions of U.S. accounts flowed over those Google and Yahoo links, butclassified rules allowed the NSA to presume that data ingested overseasbelongedtoforeigners.

‘Persistentthreat’Disclosure of the MUSCULAR project enraged and galvanized U.S.

technologyexecutives.Theybelieved theNSAhad lawfulaccess to their frontdoors—andhadbrokendownthebackdoorsanyway.

MicrosoftgeneralcounselBradSmithtooktohiscompany’sblogandcalled

theNSAan “advanced persistent threat”— theworst of all fightingwords inU.S. cybersecurity circles, generally reserved for Chinese state-sponsoredhackersandsophisticatedcriminalenterprises.

“Fortheindustryasawhole,itcausedeveryonetoaskwhetherweknewasmuch aswe thought,” Smith recalled in an interview. “It underscored the factthatwhilepeoplewereconfidentthattheU.S.governmentwascomplyingwithU.S. lawsforactivitywithinU.S. territory,perhaps therewere thingsgoingonoutside theUnited States… thatmade this bigger andmore complicated andmoredisconcertingthanweknew.”

They wondered, he said, whether the NSA was “collecting proprietaryinformationfromthecompaniesthemselves.”

Led by Google and then Yahoo, one company after another announcedexpensive plans to encrypt its data traffic over tens of thousands of miles ofcable. Itwasadirect— in somecases, explicit—blow toNSAcollectionofuserdatainbulk.IftheNSAwantedtheinformation,itwouldhavetorequestitorcircumventtheencryptiononetargetatatime.

As these projects are completed, the Internet will become a less friendlyplace for the NSA to work. The agency can still collect data from virtuallyanyone,butcollectingfromeveryonewillbeharder.

The industry’s response, Smith acknowledged, was driven by a businessthreat. U.S. companies could not afford to be seen as candy stores for U.S.intelligence.Buttheprincipleofthething,Smithsaid,“isfundamentallyaboutensuringthatcustomerdataisturnedovertogovernmentspursuanttovalidlegalordersandinaccordancewithconstitutionalprinciples.”

‘Warheadsonforeheads’Snowden has focused on much the same point from the beginning:

Individual targeting would cure most of what he believes is wrong with theNSA.

Sixmonthsago, a reporter askedhimbyencryptede-mailwhyAmericanswouldwanttheNSAtogiveupbulkdatacollectionifthatwouldlimitausefulintelligencetool.

“I believe the cost of frank public debate about the powers of ourgovernmentislessthanthedangerposedbyallowingthesepowerstocontinuegrowing in secret,” he replied, calling them “a direct threat to democraticgovernance.”

In the Moscow interview, Snowden said, “What the government wants issomething they never had before,” adding: “They want total awareness. Thequestionis,isthatsomethingweshouldbeallowing?”

Snowden likened theNSA’s powers to those used byBritish authorities inColonialAmerica,when“generalwarrants”allowedforanyonetobesearched.TheFISA court, Snowden said, “is authorizing generalwarrants for the entirecountry’smetadata.”

“Thelasttimethathappened,wefoughtawaroverit,”hesaid.Technology,ofcourse,hasenabledagreatdealofconsumersurveillanceby

privatecompanies,aswell.ThedifferencewiththeNSA’spossessionofthedata,Snowdensaid,isthatgovernmenthasthepowertotakeawaylifeorfreedom.

AttheNSA,hesaid,“therearepeopleintheofficewhojokeabout,‘Weputwarheadsonforeheads.’Twitterdoesn’tputwarheadsonforeheads.”

Privacy,asSnowdenseesit,isauniversalright,applicabletoAmericanandforeignsurveillancealike.

“I don’t carewhether you’re the pope orOsama binLaden,” he said. “Aslongasthere’sanindividualized,articulable,probablecausefortargetingthesepeopleaslegitimateforeignintelligence,that’sfine.Idon’tthinkit’simposingaridiculous burden by asking for probable cause. Because, you have tounderstand,when you have access to the tools theNSA does, probable causefallsoutoftrees.”

‘Everybodyknows’On June 29, Gilles de Kerchove, the European Union’s counterterrorism

coordinator,awoketoareportinDerSpiegelthatU.S.intelligencehadbrokenintoE.U.offices,includinghis,toimplantsurveillancedevices.

The 56-year-old Belgian, whosework is often classified, did not considerhimself naive. But he took the news personally, and more so when he heardunofficialexplanationsfromWashington.

“ ‘Everybody knows. Everybody does’ — Keith Alexander said that,” deKerchovesaidinaninterview.“Idon’tliketheideathattheNSAwillputbugsin my office. No. I don’t like it. No. Between allies? No. I’m surprised thatpeoplefindthatnoble.”

Comparable reactions, expressed less politely in private, accompaniedrevelations that the NSA had tapped the cellphones of German ChancellorAngelaMerkel and Brazilian President Dilma Rousseff. The blowback roiledrelationswithboth allies, amongothers.Rousseff canceleda statedinnerwithObamainSeptember.

When it comes to spying on allies, by Snowden’s lights, the news is notalwaysaboutthetarget.

“It’sthedeceptionofthegovernmentthat’srevealed,”Snowdensaid,notingthat the Obama administration offered false public assurances after the initialreports about NSA surveillance in Germany “The U.S. government said: ‘WefollowGerman laws inGermany.Wenever targetGermancitizens.’And thenthestorycomesoutandit’s:‘Whatareyoutalkingabout?You’respyingonthechancellor.’Youjustliedtotheentirecountry,infrontofCongress.”

Inprivate,U.S.intelligenceofficialsstillmaintainthatspyingamongfriendsis routine for all concerned, but they are giving greater weight to the risk ofgettingcaught.

“Therearemany thingswedo in intelligence that, if revealed,wouldhavethepotentialforallkindsofblowback,”ClappertoldaHousepanelinOctober.

‘Theywillmakemistakes’U.S.officialssayitisobviousthatSnowden’sdisclosureswilldograveharm

tointelligencegathering,exposingmethodsthatadversarieswilllearntoavoid.“We’re seeingal-Qaedaand relatedgroups start to look forways to adjust

how they communicate,” said Matthew Olsen, director of the NationalCounterterrorismCenterandaformergeneralcounselattheNSA.

Otherofficials,whodeclined to speakon the recordaboutparticulars, saidtheyhadwatchedsomeoftheirsurveillancetargets,ineffect,changingchannels.Thatevidencecanbereadanotherway,theyacknowledged,giventhattheNSAmanagedtomonitortheshift.

Clapperhassaidrepeatedlyinpublicthattheleaksdidgreatdamage,butinprivate he has taken a more nuanced stance. A review of early damageassessmentsinpreviousespionagecases,hesaidinoneclosed-doorbriefingthisfall,foundthatdireforecastsofharmwereseldomborneout.

“People must communicate,” he said, according to one participant whodescribed the confidentialmeeting on the condition of anonymity. “Theywillmakemistakes,andwewillexploitthem.”

According to senior intelligence officials, two uncertainties feed theirgreatestconcerns.OneiswhetherRussiaorChinamanagedtotaketheSnowdenarchive from his computer, a worst-case assumption for which three officialsacknowledgedthereisnoevidence.

Inapreviousassignment,Snowden taughtU.S. intelligencepersonnelhowto operate securely in a “high-threat digital environment,” using a trainingscenario inwhichChinawas thedesignated threat.Hedeclined to discuss thewhereaboutsofthefiles,buthesaidthatheisconfidenthedidnotexposethemto Chinese intelligence inHongKong. And he said he did not bring them toRussia.

“There’snothingonit,”hesaid,turninghislaptopscreentowardhisvisitor.“Myharddriveiscompletelyblank.”

Theotherbigquestion ishowmanydocumentsSnowden took.TheNSA’s

incoming deputy director,RickLedgett, said onCBS’s “60Minutes” recentlythat thenumbermayapproach1.7million, ahugeandunexplained spikeoverpreviousestimates.LedgettsaidhewouldfavortryingtonegotiateanamnestywithSnowdeninexchangefor“assurancesthattheremainderofthedatacouldbesecured.”

Obama’s national security adviser, Susan E. Rice, later dismissed thepossibility.

“Thegovernmentknowswheretofindusiftheywanttohaveaproductiveconversationaboutresolutionsthatdon’tinvolveEdwardSnowdenbehindbars,”said the American Civil Liberties Union’s Ben Wizner, the central figure onSnowden’slegalteam.

Some news accounts have quoted U.S. government officials as sayingSnowdenhasarrangedfortheautomatedreleaseofsensitivedocumentsifheisarrested or harmed. There are strong reasons to doubt that, beginning withSnowden’s insistence, to this reporter and others, that he does not want thedocumentspublishedinbulk.

IfSnowdenwerefoolenoughtoriga“deadman’sswitch,”confidantssaid,hewouldbeinvitinganyonewhowantsthedocumentstokillhim.

AskedaboutsuchamechanismintheMoscowinterview,Snowdenmadeaface anddeclined to reply.Later, he sent an encryptedmessage. “That soundsmorelikeasuicideswitch,”hewrote.“Itwouldn’tmakesense.”

‘It’snotaboutme’By temperamentandcircumstance,Snowden isa reticentman, reluctant to

discussdetailsabouthispersonallife.Overtwodayshisguardneverdropped,butheallowedafewfragmentsto

emerge.Heisan“ascetic,”hesaid.Helivesofframennoodlesandchips.Hehasvisitors,andmanyofthembringbooks.Thebookspileup,unread.TheInternetisanendlesslibraryandawindowontheprogressofhiscause.

“Ithasalwaysbeenreallydifficulttogetmetoleavethehouse,”hesaid.“Ijustdon’thavealotofneeds.…Occasionallythere’sthingstogodo,thingstogo see, people to meet, tasks to accomplish. But it’s really got to be goal-oriented,youknow.Otherwise,aslongasIcansitdownandthinkandwriteandtalk to somebody, that’smoremeaningful tome thangoingoutand lookingatlandmarks.”

In hope of keeping focus on the NSA, Snowden has ignored attacks onhimself.

“Letthemsaywhattheywant,”hesaid.“It’snotaboutme.”FormerNSAandCIAdirectorMichaelV.Haydenpredicted thatSnowden

will waste away in Moscow as an alcoholic, like other “defectors.” To this,Snowdenshrugged.Hedoesnotdrinkatall.Neverhas.

ButSnowdenknowshispresencehereiseasyammunitionforcritics.HedidnotchooserefugeinMoscowasafinaldestination.HesaidthatoncetheU.S.governmentvoidedhis passport as he tried to changeplanes en route toLatinAmerica,hehadnootherchoice.

Itwouldbeodd ifRussian authoritiesdidnotkeepan eyeonhim,butnoretinueaccompaniedSnowdenandhisvisitorsawnooneelsenearby.Snowdenneither tried to communicate furtivelynor asked thathisvisitordo so.HehashadcontinuousInternetaccessandhastalkedtohisattorneysandtojournalistsdaily,fromhisfirstdayinthetransitloungeatSheremetyevoairport.

“There isnoevidenceatall for theclaim that Ihave loyalties toRussiaorChina or any country other than the United States,” he said. “I have norelationship with the Russian government. I have not entered into anyagreementswiththem.”

“IfIdefectedatall,”Snowdensaid,“Idefectedfromthegovernmenttothepublic.”

JulieTatecontributedtothisreport.

U.S.,BritishintelligenceminingdatafromnineU.S.Internetcompaniesinbroad

secretprogram

ByBartonGellmanandLauraPoitrasJune6,2013

TheNationalSecurityAgencyandtheFBIaretappingdirectlyintothecentralservers of nine leading U.S. Internet companies, extracting audio and videochats,photographs,e-mails,documents,andconnectionlogsthatenableanalyststo track foreign targets, according to a top-secret document obtained by TheWashingtonPost.

Theprogram, code-namedPRISM,has not beenmadepublic until now. Itmay be the first of its kind. The NSA prides itself on stealing secrets andbreakingcodes,anditisaccustomedtocorporatepartnershipsthathelpitdivertdatatrafficorsidestepbarriers.ButtherehasneverbeenaGoogleorFacebookbefore,anditisunlikelythattherearerichertrovesofvaluableintelligencethantheonesinSiliconValley.

EquallyunusualisthewaytheNSAextractswhatitwants,accordingtothedocument:“CollectiondirectlyfromtheserversoftheseU.S.ServiceProviders:Microsoft,Yahoo,Google,Facebook,PalTalk,AOL,Skype,YouTube,Apple.”

London’s Guardian newspaper reported Friday that GCHQ, Britain’sequivalent of theNSA, also has been secretly gathering intelligence from thesameinternetcompaniesthroughanoperationsetupbytheNSA.

AccordingtodocumentsobtainedbyTheGuardian,PRISMwouldappeartoallowGCHQtocircumventtheformallegalprocessrequiredinBritaintoseekpersonalmaterial suchasemails,photosandvideos froman internetcompanybasedoutsideofthecountry.

PRISMwas launchedfromtheashesofPresidentGeorgeW.Bush’ssecretprogram of warrantless domestic surveillance in 2007, after news mediadisclosures,lawsuitsandtheForeignIntelligenceSurveillanceCourtforcedthepresidenttolookfornewauthority.

Congress obliged with the Protect America Act in 2007 and the FISAAmendmentsActof2008,whichimmunizedprivatecompaniesthatcooperatedvoluntarilywithU.S. intelligence collection. PRISM recruited its first partner,Microsoft, and began six years of rapidly growing data collection beneath thesurfaceofa roilingnationaldebateonsurveillanceandprivacy.Late lastyear,whencriticsinCongresssoughtchangesintheFISAAmendmentsAct,theonlylawmakerswhoknewaboutPRISMwereboundbyoathsofofficetoholdtheirtongues.

The court-approvedprogram is focusedon foreign communications traffic,which often flows through U.S. servers even when sent from one overseaslocation to another. Between 2004 and 2007, Bush administration lawyerspersuaded federal FISA judges to issue surveillance orders in a fundamentallynew form. Until then the government had to show probable cause that aparticular“target”and“facility”werebothconnectedtoterrorismorespionage.

Infourneworders,whichremainclassified,thecourtdefinedmassivedatasets as “facilities” and agreed to certify periodically that the government hadreasonable procedures in place to minimize collection of “U.S. persons” datawithoutawarrant.

InastatementissuelateThursday,DirectorofNationalIntelligenceJamesR.Clapper said “information collected under this program is among the mostimportantandvaluableforeign intelligence informationwecollect,and isusedtoprotectournationfromawidevarietyofthreats.Theunauthorizeddisclosure

of informationabout this importantandentirely legalprogramis reprehensibleandrisksimportantprotectionsforthesecurityofAmericans.”

Clapper added that there were numerous inaccuracies in reports aboutPRISMbyThePostandtheGuardiannewspaper,buthedidnotspecifyany.

Jameel Jaffer,deputy legaldirectorof theAmericanCivilLibertiesUnion,said:“Iwouldjustpushbackontheideathatthecourthassignedoffonit,sowhyworry?Thisisacourtthatmeetsinsecret,allowsonlythegovernmenttoappearbeforeit,andpublishesalmostnoneofitsopinions.Ithasneverbeenaneffectivecheckongovernment.”

SeveralcompaniescontactedbyThePostsaidtheyhadnoknowledgeoftheprogram, did not allow direct government access to their servers and assertedthattheyrespondedonlytotargetedrequestsforinformation.

“We do not provide any government organization with direct access toFacebookservers,”saidJoeSullivan,chiefsecurityofficerforFacebook.“WhenFacebook is asked for data or information about specific individuals, wecarefully scrutinize any such request for compliance with all applicable laws,andprovideinformationonlytotheextentrequiredbylaw.”

“We have never heard of PRISM,” said Steve Dowling, a spokesman forApple. “We do not provide any government agencywith direct access to ourservers,andanygovernmentagencyrequestingcustomerdatamustgetacourtorder.”

It is possible that the conflict between thePRISMslides and the companyspokesmenistheresultofimprecisiononthepartoftheNSAauthor.InanotherclassifiedreportobtainedbyThePost,thearrangementisdescribedasallowing“collectionmanagers[tosend]contenttaskinginstructionsdirectlytoequipmentinstalled at company-controlled locations,” rather than directly to companyservers.

Government officials and the document itself made clear that the NSAregardedthe identitiesof itsprivatepartnersasPRISM’smostsensitivesecret,fearing that the companieswouldwithdraw from the program if exposed. “98

percent of PRISM production is based on Yahoo, Google and Microsoft; weneedtomakesurewedon’tharmthesesources,”thebriefing’sauthorwroteinhisspeaker’snotes.

An internalpresentationof41briefing slidesonPRISM,datedApril2013and intended for senior analysts in theNSA’sSignals IntelligenceDirectorate,described thenewtoolas themostprolificcontributor to thePresident’sDailyBrief,whichcitedPRISMdatain1,477itemslastyear.Accordingtotheslidesand other supporting materials obtained by The Post, “NSA reportingincreasinglyreliesonPRISM”asitsleadingsourceofrawmaterial,accountingfornearly1in7intelligencereports.

Thatisaremarkablefigureinanagencythatmeasuresannualintakeinthetrillionsofcommunications.ItisallthemorestrikingbecausetheNSA,whoselawfulmissionisforeignintelligence,isreachingdeepinsidethemachineryofAmericancompaniesthathosthundredsofmillionsofAmerican-heldaccountsonAmericansoil.

The technology companies, whose cooperation is essential to PRISMoperations, include most of the dominant global players of Silicon Valley,accordingto thedocument.Theyare listedonaroster thatbears their logosinorderofentryintotheprogram:“Microsoft,Yahoo,Google,Facebook,PalTalk,AOL, Skype, YouTube, Apple.” PalTalk, although much smaller, has hostedtraffic of substantial intelligence interest during the Arab Spring and in theongoingSyriancivilwar.

Dropbox, the cloud storage and synchronization service, is described as“comingsoon.”

Sens. RonWyden (D-Ore.) andMarkUdall (D-Colo.),who had classifiedknowledge of the program asmembers of the Senate Intelligence Committee,wereunable to speakof itwhen theywarned inaDec.27,2012, floordebatethat the FISA Amendments Act had what both of them called a “back-doorsearchloophole”forthecontentofinnocentAmericanswhoweresweptupinasearchforsomeoneelse.

“Asitiswritten,thereisnothingtoprohibittheintelligencecommunityfromsearchingthroughapileofcommunications,whichmayhavebeenincidentallyor accidentallybeen collectedwithout awarrant, todeliberately search for thephonecallsore-mailsofspecificAmericans,”Udallsaid.

Wyden repeatedly asked the NSA to estimate the number of Americanswhose communications had been incidentally collected, and the agency’sdirector, Lt. Gen. Keith B. Alexander, insisted there was no way to find out.Eventually InspectorGeneral I. CharlesMcCullough IIIwroteWyden a letterstatingthatitwouldviolatetheprivacyofAmericansinNSAdatabankstotrytoestimatetheirnumber.

Rootsinthe’70sPRISMisanheir,inonesense,toahistoryofintelligenceallianceswithas

many as 100 trusted U.S. companies since the 1970s. The NSA calls theseSpecialSourceOperations,andPRISMfallsunderthatrubric.

The Silicon Valley operation works alongside a parallel program, code-namedBLARNEY, that gathers up “metadata”— technical information aboutcommunications trafficandnetworkdevices—as it streamspastchokepointsalong thebackboneof theInternet.BLARNEY’s top-secretprogramsummary,set down in the slides alongside a cartoon insignia of a shamrock and aleprechaunhat,describesitas“anongoingcollectionprogramthatleveragesIC[intelligencecommunity]andcommercialpartnershipstogainaccessandexploitforeignintelligenceobtainedfromglobalnetworks.”

But the PRISM program appears to more nearly resemble the mostcontroversialof thewarrantlesssurveillanceorders issuedbyPresidentGeorgeW. Bush after the al-Qaeda attacks of Sept. 11, 2001. Its history, in whichPresidentObamapresidedoverexponentialgrowthinaprogramthatcandidateObamacriticized,showshowfundamentallysurveillancelawandpracticehave

shifted away from individual suspicion in favor of systematic,mass collectiontechniques.

The Obama administration points to ongoing safeguards in the form of“extensive procedures, specifically approved by the court, to ensure that onlynon-U.S. persons outside the U.S. are targeted, and that minimize theacquisition, retention and dissemination of incidentally acquired informationaboutU.S.persons.”

AnditistruethatthePRISMprogramisnotadragnet,exactly.Frominsideacompany’sdatastreamtheNSAiscapableofpullingoutanythingitlikes,butundercurrentrulestheagencydoesnottrytocollectitall.

AnalystswhousethesystemfromaWebportalatFortMeade,Md.,keyin“selectors,” or search terms, that are designed to produce at least 51 percentconfidenceinatarget’s“foreignness.”Thatisnotaverystringenttest.TrainingmaterialsobtainedbyThePostinstructnewanalyststomakequarterlyreportsofany accidental collection of U.S. content, but add that “it’s nothing to worryabout.”

Evenwhen the systemworks just as advertised,withnoAmerican singledout for targeting, theNSAroutinelycollectsagreatdealofAmericancontent.That isdescribedas“incidental,”and it is inherent incontactchaining,oneofthe basic tools of the trade. To collect on a suspected spy or foreign terroristmeans,atminimum,thateveryoneinthesuspect’sinboxoroutboxissweptin.Intelligence analysts are typically taught to chain throughcontacts two“hops”outfromtheirtarget,whichincreases“incidentalcollection”exponentially.Thesamemathexplainstheaphorism,fromtheJohnGuareplay,thatnooneismorethan“sixdegreesofseparation”fromanyotherperson.

A‘directive’Inexchangeforimmunityfromlawsuits,companiessuchasYahooandAOL

areobligedtoaccepta“directive”fromtheattorneygeneralandthedirectorof

nationalintelligencetoopentheirserverstotheFBI’sDataInterceptTechnologyUnit,whichhandlesliaisontoU.S.companiesfromtheNSA.In2008,Congressgave the Justice Department authority for a secret order from the ForeignSurveillanceIntelligenceCourttocompelareluctantcompany“tocomply.”

Inpractice,thereisroomforacompanytomaneuver,delayorresist.Whenaclandestineintelligenceprogrammeetsahighlyregulatedindustry,saidalawyerwith experience inbridging thegaps, neither sidewants to risk a public fight.Theengineeringproblemsare so immense, in systemsof suchcomplexityandfrequentchange,thattheFBIandNSAwouldbehardpressedtobuildinbackdoorswithoutactivehelpfromeachcompany.

Appledemonstratedthatresistanceispossiblewhenitheldoutformorethanfiveyears,forreasonsunknown,afterMicrosoftbecamePRISM’sfirstcorporatepartner inMay2007.Twitter,whichhas cultivated a reputation for aggressivedefenseofitsusers’privacy,isstillconspicuousbyitsabsencefromthelistof“privatesectorpartners.”

Google,liketheothercompanies,deniedthatitpermitteddirectgovernmentaccesstoitsservers.

“Google cares deeply about the security of our users’ data,” a companyspokesman said. “Wediscloseuserdata togovernment in accordancewith thelaw,andwereviewallsuchrequestscarefully.Fromtimetotime,peopleallegethat we have created a government ‘back door’ into our systems, but Googledoesnothavea‘backdoor’forthegovernmenttoaccessprivateuserdata.”

Microsoftalsoprovidedastatement:“Weprovidecustomerdataonlywhenwe receive a legally binding order or subpoena to do so, and never on avoluntarybasis.Inadditionweonlyevercomplywithordersforrequestsaboutspecific accounts or identifiers. If the government has a broader voluntarynationalsecurityprogramtogathercustomerdatawedon’tparticipateinit.”

Yahooalsoissuedadenial.“Yahoo! takes users’ privacy very seriously,” the company said in a

statement.“Wedonotprovidethegovernmentwithdirectaccesstoourservers,

systems,ornetwork.”Like market researchers, but with far more privileged access, collection

managers in the NSA’s Special Source Operations group, which oversees thePRISMprogram,aredrawntothewealthofinformationabouttheirsubjectsinonlineaccounts.Formuchthesamereason,civillibertariansandsomeordinaryusersmaybetroubledbythemenuavailabletoanalystswhoholdtherequiredclearancesto“task”thePRISMsystem.

Therehas been “continued exponential growth in tasking toFacebook andSkype,” according to the PRISM slides.With a few clicks and an affirmationthat the subject is believed to be engaged in terrorism, espionage or nuclearproliferation,ananalystobtainsfullaccesstoFacebook’s“extensivesearchandsurveillance capabilities against the variety of online social networkingservices.”

According to a separate “User’sGuide forPRISMSkypeCollection,” thatservicecanbemonitored foraudiowhenoneendof thecall isaconventionaltelephone and for any combination of “audio, video, chat, and file transfers”whenSkypeusersconnectbycomputeralone.Google’sofferingsincludeGmail,voiceandvideochat,GoogleDrivefiles,photolibraries,andlivesurveillanceofsearchterms.

Firsthandexperiencewith these systems, andhorror at their capabilities, iswhat drove a career intelligence officer to provide PowerPoint slides aboutPRISM and supporting materials to TheWashington Post in order to exposewhat he believes to be a gross intrusion on privacy. “They quite literally canwatchyourideasformasyoutype,”theofficersaid.

Poitras isadocumentary filmmakerandMacArthurFellow.JulieTate,RobertO’HarrowJr.,CeciliaKangandEllenNakashimacontributedtothisreport.

AdditionalContent:TheNSAproblem?Toomuchdata.

NSAleak:Sourcebelievesexposure,consequencesinevitable(VIDEO)AnexcerptfromNSA’sWikipedia

Fromobscuritytonotoriety,Snowdentookanunusualpath

ByEllenNakashimaJune9,2013

EdwardSnowdensaidtheinternet“isaTVwatchingyou.”(PhotocourtesyofTheGuardian)

Edward Snowden, the 29-year-old National Security Agency contractor whoadmitted thathewasbehind recent leaksofclassified intelligence,hasvaultedfromobscuritytointernationalnotoriety,joiningtheranksofhigh-profileleakerssuchasDanielEllsbergofPentagonPapersfame.

The fact that Snowden stepped forward to acknowledge his leaks to TheWashingtonPost and theGuardiannewspapers rather thanwait for theFBI tofindhimimpressedotherswhohavedisclosedgovernmentsecrets.

“Iconsideritamagnificentactofcivildisobedience,”saidThomasDrake,aformerNSAofficialwhowasprosecutedforleakingclassifiedinformationtoajournalistbutwoundupservingnoprisontimeafterthegovernment’scasefellapart.“He’sawhistleblower.”

Ellsberg was similarly impressed. He said in an interview: “There’s noAmerican official or former official that I admire more at this point. There’sneverbeenamoreimportantdisclosuretotheAmericanpeoplethantheleak[bySnowden]—andIincludethePentagonPapersinthat....He’sclearlyreadytogivehislifeorhisfreedomfortheinterestsofhiscountry.”

OthersviewSnowden’sleaksofNSAandotherdocumentstotheThePostand theGuardian as a breachof his oath to protect classified information thatmayhaveharmednationalsecurity.

“Thegovernmentisnotgoingtoholdbackonthiscase,”saidMichaelVatis,a former associate deputy attorney general for national security in theClintonadministration.“Thisisahugeone.”

Vatis, now a partner at Steptoe & Johnson in Washington, asserted thatSnowden’sbreachwasnot comparable toEllsberg’sbecauseEllsberg revealedhowthegovernmentwaslyingabouttheprospectsforsuccessandthescaleofcasualtiesintheVietnamWar.

Snowden’s leak, Vatis said, revealed details of electronic surveillanceprogramsoperatingwithin the law, authorizedbyCongress andoverseenby afederalcourt.OneprogramrelatedtoNSA’sgatheringofrecordsofcustomersofU.S. telephone companies for counterterrorism purposes. Another involvesNSA’s collection of the communications of foreigners through U.S. Internetcompanies.

Snowden said he was motivated by his belief that the government,particularly the ultra-secret NSA, had built an enterprise “that allows it tointerceptalmosteverything”inawaythatviolatesprivacyrights.

Hisrevelationsof the innerworkingsof the twoprogramshavereignitedadebate over whether the government’s secret surveillance programs are

sufficientlyprotectiveofcivillibertiesandprivacyinthenameofprotectingthecountryagainstterrorism.

Since the attacks of Sept. 11, 2001, the NSA has been at the forefront incollecting electronic information worldwide as part of the nation’scounterterrorism efforts. The material exposed by Snowden provided anunprecedented look at the scopeof the surveillance carriedout by the agency.PresidentObamadefendedthesurveillanceasessentialtoU.S.securityandsaidhewelcomesanextendeddebate.

“AsfarasI’mabletojudge,thepublicpolicyvalue[ofhisleaks]farexceedsthepotentialriskinvolvedtonationalsecurity,”saidStevenAftergood,directorof the Federation ofAmerican Scientists’ Project onGovernment Secrecy. “Ithastriggeredanintensepublicdebate.Thesestorieshavereallyenrichedpublicdiscourse.”

AftergoodsaidSnowden’sleaksweretargetedandselective,unlikethoseofArmyPfc.BradleyE.Manning,theformerArmyintelligenceanalystontrialfororchestrating the leak of more than 700,000 government documents to theantisecrecyWikiLeaksWebsite.

“There were lots of records put out by WikiLeaks that had no particularsignificanceotherthanthefactthattheyarerestricted,”Aftergoodsaid.“Itwasan antisecrecy campaign. This [Snowden’s action] seemed to aim at a muchlarger target — namely, the scope of intelligence surveillance activity andgovernmentoverreachingandviolationofpolicy.”

Snowdenisthefirstleakertostepforwardandpubliclyadmithisactbeforehe was even named by the government. “There’s a certain dignity in that,”Aftergoodsaid.“Amongleakers,asamongotherswhodefyacceptednorms,thatistheexception,nottherule.”

Ellsberg surrendered to authorities in 1971 after it became known that anarrestwarranthadbeenissuedforhim.Hesaidhewantedtotakeresponsibilityforhisactions.ButunlikeSnowden,hesaid,itdidnotoccurtohimtoflee-inSnowden’s case, toHongKong. “But his being inHongKong gives him the

chance to speakout openly in away that he couldnot dohere, to explainhismotives,”Ellsbergsaid.

U.S.officials andnational securityexperts,however, say the leaker shouldbeprosecuted.

“Taking a very sensitive classified program that targets foreign persons onforeignlands,andputtingjustenoughouttheretobedangerous,isdangeroustous. It’s dangerous to our national security.And it violates the oathwhich thatpersontook,”Rep.MikeRogers(R-Mich.),chairmanoftheHouseintelligencecommittee, said in a television interview Sunday.Dianne Feinstein (D-Calif.),hisSenatecounterpart,agreedthattheleaksdemandedprosecution.

Themost likely statute under which Snowdenwould be prosecuted is the1917 Espionage Act, a law used to prosecute Manning, Drake and Ellsberg.Provisions under that law make it a crime to disclose national defenseinformationtopersonsunauthorizedtoreceiveitandtotransmitclassifieddataoncommunicationintelligence.

AdditionalContent:AtimelineofEdwardSnowden’slife

TrackingEdwardSnowden,fromaMarylandclassroomtoaHongKonghotel

EdwardSnowden,BradleyManningandtheriskofthelow-level,tech-savvyleaker

ByGregMillerJune11,2013

Inthespanofthreeyears,theUnitedStateshasdevelopedtwogapingholesinitsnationalsecurityhull,puncturescausedbyleakerswhoworkedatthelowestlevels of the nation’s intelligence ranks but gained access to large caches ofclassifiedmaterial.

The parallels between Edward Snowden, who has declared himself thesourceofleaksonNationalSecurityAgencysurveillanceprograms,andBradleyManning, a U.S. Army private on trial for sending hundreds of thousands ofsecretfilestotheWikiLeaksWebsite,gobeyondgenerationalties.

BothenlistedintheArmyduringthewarinIraqonlytolatersaytheyweredisillusionedbythatconflict.Neitherhasacollegedegreeorextensiveacademictraining in computer science. And yet both were technically savvy, able tonavigatesensitivecomputernetworksandsmuggleclassifiedfiles.

The back-to-back breaches — seen by many as the most significant indecades—haveforcedU.S.intelligenceofficialstoexaminewhetherthecasesareisolatedinscopeorpartofanewcategoryofexposureemergingattheedgesofclassifiedU.S.networks.

U.S.officialssaidcounterintelligenceteamsarealreadylookingbeyondthedetailsoftheSnowdencaseatanyvulnerabilitiesithasexposed.

“At this point, we’re still looking at this as an anomaly,” a senior U.S.intelligenceofficialsaid.ButhesaidadamageassessmentorderedbyDirector

ofNationalIntelligenceJamesR.ClapperJr.isbroadinscope,focusedlargelyontheimplicationsofacaseinwhichhighlysensitivematerialsweresomehowwithinthegraspofacontractorwhomovedthroughaseriesoflow-rankingjobsfortheCIAandtheNSA.

SnowdenandManningboth tookadvantageofaccess tocomputersystemsthat expanded exponentially in the aftermath of the attacks of Sept. 11, 2001,partlyinanefforttomakecriticalinformationavailableacrossagencies.

SincethedisclosuresbyWikiLeaksin2010,thePentagonhastakenstepstobetter protect its classified networks. It has banned the use of thumb drivesunlessspecialpermissionisgiven,mandatedthatusershavespecialsmartcardsthatauthenticatetheiridentitiesandrequiredanalyststoreviewcomputerlogstoidentifysuspiciousbehavioronthenetwork.

Despite suchmeasures, it remains impossible to guarantee security on anyclassified network. Since going public, Snow den has attributed his extensiveaccesstohisroleasanordinarysystemsadministratorfortheNSA,althoughheoffered few specific details about where he found or how he removed suchsensitivefiles.

Inane-mailtoaWashingtonPostreporterlastmonth,hesaidhewanted“toembolden others to step forward,” suggesting that he hoped his leak wouldtriggerfollow-updisclosures.

Among the files he obtained were a secret order issued by the ForeignIntelligence Surveillance Court and 41 briefing slides on a highly classifiedprogram,calledPRISM, inwhichmainstream technologycompanies includingMicrosoft, Google and Facebook have given the NSA extensive access to e-mails,videosandothercontent.

The records releasedbySnowdenare fewer innumberbutmore sensitiveandofhigherlevelsofclassificationthantheU.S.diplomaticcablesandmilitaryreportsManningsent toWikiLeaksafterhedownloadedthemwhileservinginIraq.

SnowdenhaspraisedManningbutalsosoughttodifferentiatehimselffrom

hispredecessor.Inparticular,Snowdenhasindicatedthathesoughttobemoreresponsible, withholding records he had that might put U.S. intelligenceoperatives in jeopardy, unlike Manning, who is accused of turning overthousandsofpages,someofwhichcontainedthenamesofinformants.

Buttheirmotivationsandbackgroundshaveextensiveoverlaps.Bothenteredthe military or government jobs during an era of massive hiring binges,controversial wars and repeated disclosures of alleged abuses by the U.S.military,theCIAandtheNSA.

Both have said they wanted to call attention to abuses by the U.S.government, although critics have called them traitors who acted out of anexaggeratedsenseofself-importance.

Manning was gifted with computers and had begun learning the C++programminglanguagebythetimehewas8.Heneverfoundapathtocollegeand instead enlisted in the Army, where he was groomed for a career as anintelligenceanalyst.

Snowden’splanstopursueaSpecialForcescareerwerederailed,hesaid,byleg injuries he sustained during training that ended hismilitary stint after justthreemonths.

It is less clear how Snowden came by his computer skills. But, as withManning, his technology savvy appears to have helped him obtain a string ofjobsthatenabledhimtosnooponandeventuallystealsensitivefiles.

Theiractionsandmotivationsbearlittleresemblancetohigh-profilesecuritybreaches of the 1980s and ‘90s. The best-known cases involved mid-careerofficials such as theCIA’sAldrichAmes and the FBI’sRobertHanssen,whowere convicted of selling secrets to the Soviet and Russian governments forfinancialgain.

TheclosestparallelforSnowdenandManningmaybeDanielEllsberg,whoin 1971was theNewYork Times’ and TheWashington Post’s source for thePentagon Papers, a secret assessment of the Vietnam War that eroded thecredibility of U.S. government’s more-optimistic public claims about the

conflict.EllsberginrecentdayshaspraisedSnowdenanddescribedthematerialSnowden disclosed as more significant than the documents he leaked fourdecadesago.

There are differences, however. Ellsberg was a senior military analystworkingatthePentagonwhohadadirectroleindraftingthePentagonPapers.The document was largely a record of U.S. decision-making rather than ablueprintofongoingoperations.Draftswereundoubtedlystoredinsafes,notonnetworkswheretheymightbereadbylow-levelemployeesatdistantmilitaryorintelligenceoutposts.

A former senior NSA official recalled procedures in the 1970s that werearchaic but secure. “When hot documents would go around they’d be in adouble-sealed envelope, and some person would wait while you read it, re-envelopeitandleave,”theformerofficialsaid.“Bycontrast,nowyoubringituponyourcomputerscreen.”

SomeU.S.officialsquestionwhetherthereisagenerationalgapinviewsonprivacyandgovernmenttransparency.ManningandSnowden,whoareintheir20s,grewupwithtechnologyandtheInternetasfixturesintheirlives.

“We are recruiting Americans from a culture that has a deeper desire forabsolutetransparencythananypreviouscohortofpeopleenteringtheservice,”saidMichaelV.Hayden,formerCIAandNSAdirector.“Theyarecomingfromaculture inwhich, formany, transparency is an absolutegood, and it appearsthatinthesetwocasesitinfluencedthesepeople.”

Snowden appears to have left fewer online footprints than many of hisgeneration,withnoevidenceofFacebookorTwitteraccounts.InhiscommentstoThePost,heindicatedthatwasinpartbecauseofwhathehadlearned.

TheInternet“isaTVthatwatchesyou,”hesaid,atechnology“governmentsare abusing … to extend their powers beyond what is necessary andappropriate.”

EllenNakashimacontributedtothisreport.

U.S.surveillancearchitectureincludescollectionofrevealingInternet,phone

metadata

ByBartonGellmanJune15,2013

OnMarch 12, 2004, acting attorney general James B. Comey and the JusticeDepartment’s top leadership reached the brink of resignation over electronicsurveillanceordersthattheybelievedtobeillegal.

PresidentGeorgeW.Bushbackeddown,haltingsecretforeign-intelligence-gathering operations that had crossed into domestic terrain. That morningmarkedthebeginningoftheendofSTELLARWIND,thecovernameforasetof four surveillance programs that brought Americans and American territorywithinthedomainoftheNationalSecurityAgencyforthefirsttimeindecades.It was also a prelude to new legal structures that allowed Bush and thenPresidentObamatoreproduceeachofthoseprogramsandexpandtheirreach.

What exactly STELLARWIND did has never been disclosed in anunclassified form.Which parts of it did Comey approve?Which did he shutdown?Whatbecameof theprogramswhen thecrisispassedandComey,nowObama’sexpectednomineeforFBIdirector,returnedtoprivatelife?

Authoritative new answers to those questions, drawing upon a classifiedNSAhistoryofSTELLARWINDandinterviewswithhigh-rankingintelligenceofficials, offer the clearest map yet of the Bush-era programs and the NSA’scontemporaryU.S.operations.

STELLARWIND was succeeded by four major lines of intelligencecollection in the territorialUnitedStates, together capableof spanning the fullrange of modern telecommunications, according to the interviews anddocuments.

Foreigners,notAmericans,are theNSA’s“targets,”as the lawdefines thatterm. But the programs are structured broadly enough that they touch nearlyevery American household in some way. Obama administration officials andcareer intelligence officers say Americans should take comfort that privacyprotectionsarebuilt intothedesignandoversight,but theyarenotpreparedtodiscussthedetails.

The White House, the NSA and the Office of the Director of NationalIntelligence declined to comment on the record for this article. A seniorintelligenceofficialagreedtoanswerquestionsifnotidentified.

“We have rich oversight across three branches of government. I’ve got an[inspectorgeneral]here,afairlyrobustlegalstaffhere. . .andthere’stheJusticeDepartment’snationalsecuritydivision,”theofficialsaid.“Forthosethingsdoneundercourtjurisdiction,thecourtsareintrusiveinmybusiness,appropriatelyso,and there are two congressional committees. It’s a belts-and-suspenders-and-Velcroapproach,andinsidethere’srichauditing.”

But privacy advocates, such as Sen. Ron Wyden (D-Ore.), said theintelligence committee on which he serves needs “straight answers” to dovigorousoversight.

Headded:“Thetypicalpersonsays,‘IfIamlaw-abidingandthegovernmentisout therecollecting lotsof informationaboutme—whoIcall,whenIcall,whereIcallfrom’. . .Ithinkthetypicalpersonisgoingtosay,‘Thatsuresoundslikeitcouldhavesomeeffectonmyprivacy.’ ”

Twoofthefourcollectionprograms,oneeachfortelephonyandtheInternet,processtrillionsof“metadata”recordsforstorageandanalysisinsystemscalledMAINWAY and MARINA, respectively. Metadata includes highly revealinginformation about the times, places, devices and participants in electronic

communication, but not its contents. The bulk collection of telephone callrecords from Verizon Business Services, disclosed this month by the BritishnewspapertheGuardian,isonesourceofrawintelligenceforMAINWAY.

Theothertwotypesofcollection,whichoperateonamuchsmallerscale,areaimedatcontent.Oneof themintercepts telephonecallsandroutes thespokenwordstoasystemcalledNUCLEON.

For Internet content, the most important source collection is the PRISMprojectreportedonJune6byTheWashingtonPostandtheGuardian.Itdrawsfrom data held by Google, Yahoo,Microsoft and other Silicon Valley giants,collectivelytherichestdepositoriesofpersonalinformationinhistory.

FormerNSAcontractorEdwardSnowden,29,whounmaskedhimselfasthesource behind the PRISM and Verizon revelations, said he hoped for asystematicdebateaboutthe“dangertoourfreedomandwayoflife”posedbyasurveillanceapparatus“keptincheckbynothingmorethanpolicy.”

Forwelloveraweek,hehashadhiswish.Startlingdisclosureshavepouredout of the nation’s largest and arguably tightest-lipped spy agency at anunprecedentedpace.Snowden’sdisclosureshaveopenedanationalconversationabout the limits of secret surveillance in a free society and anoutcry overseasagainstU.S.espionage.

Thedebatehasfocusedontwoof thefourU.S.-basedcollectionprograms:PRISM,forInternetcontent,andthecomprehensivecollectionoftelephonecallrecords,foreignanddomestic,thattheGuardianrevealedbypostingaclassifiedorder from the Foreign Intelligence Surveillance Court to Verizon BusinessServices.

The Post has learned that similar orders have been renewed every threemonthsforotherlargeU.S.phonecompanies,includingBellSouthandAT&T,sinceMay24,2006.Onthatday,thesurveillancecourtmadeafundamentalshiftin its approach to Section 215 of the Patriot Act, which permits the FBI tocompel production of “business records” that are relevant to a particularterrorisminvestigationandtosharethoseinsomecircumstanceswiththeNSA.

Henceforth,thecourtruled,itwoulddefinetherelevantbusinessrecordsastheentiretyofatelephonecompany’scalldatabase.

TheBushadministration,bythen,hadbeentaking“bulkmetadata”fromthephone companies under voluntary agreements for more than four years. Thevolume of information overwhelmed theMAINWAY database, according to aclassifiedreportfromtheNSAinspectorgeneralin2009.Theagencyspent$146million in supplemental counterterrorism funds to buy new hardware andcontractsupport—andtomakeunspecifiedpaymentstothephonecompaniesfor“collaborativepartnerships.”

When the NewYork Times revealed the warrantless surveillance of voicecalls, inDecember 2005, the telephone companies got nervous. One of them,unnamed in the report, approached the NSA with a request. Rather thanvolunteerthedata,ataprice,the“providerpreferredtobecompelledtodosobyacourtorder,”thereportsaid.Othercompaniesfollowedsuit.Thesurveillancecourt order that recast themeaningof business records “essentiallygaveNSAthesameauthoritytocollectbulktelephonymetadatafrombusinessrecordsthatithad”underBush’sassertedauthorityalone.

TelephonemetadatawasnottheissuethatsparkedarebellionattheJusticeDepartment,firstbyJackGoldsmithoftheOfficeofLegalCounselandthenbyComey, who was acting attorney general because John D. Ashcroft was inintensivecarewithacutegallstonepancreatitis.ItwasInternetmetadata.

AtBush’sdirection,inorderspreparedbyDavidAddington,thecounseltoVicePresidentRichardB.Cheney,theNSAhadbeensiphoninge-mailmetadataandtechnicalrecordsofSkypecallsfromdatalinksownedbyAT&T,SprintandMCI,whichlatermergedwithVerizon.

For reasons unspecified in the report, Goldsmith and Comey becameconvincedthatBushhadnolawfulauthoritytodothat.

MARINAandthecollectiontoolsthatfeeditareprobablytheleastknownofthe NSA’s domestic operations, even among experts who follow the subjectclosely. Yet they probably capture information about more American citizens

than any other, because the volume of e-mail, chats and other Internetcommunicationsfarexceedsthevolumeofstandardtelephonecalls.

The NSA calls Internet metadata “digital network information.”Sophisticatedanalysisofthoserecordscanrevealunknownassociatesofknownterrorism suspects. Depending on the methods applied, it can also exposemedical conditions, political or religious affiliations, confidential businessnegotiationsandextramaritalaffairs.

Whatpermitstheformerandpreventsthelatterisacomplexsetofpoliciesthatthepublicisnotpermittedtosee.“Youcoulddoanalysesthatgiveyoumoreinformation, but the law and procedures don’t allow that,” a senior U.S.intelligencelawyersaid.

In theurgent aftermathofSept. 11, 2001,withmore attacks thought tobeimminent, analystswanted to use “contact chaining” techniques to buildwhatthe NSA describes as network graphs of people who represented potentialthreats.

The legal challenge for the NSA was that its practice of collecting highvolumesofdatafromdigitallinksdidnotseemtomeeteventherelativelylowrequirements of Bush’s authorization, which allowed collection of Internetmetadata“forcommunicationswithatleastonecommunicantoutsidetheUnitedStates or forwhich no communicantwas known to be a citizen of theUnitedStates,”theNSAinspectorgeneral’sreportsaid.

LawyersfortheagencycameupwithaninterpretationthatsaidtheNSAdidnot“acquire” thecommunications,a termwith formalmeaning insurveillancelaw,untilanalystsransearchesagainstit.TheNSAcould“obtain”metadatainbulk,theyargued,withoutmeetingtherequiredstandardsforacquisition.

Goldsmith andComeydidnotbuy that argument, andahigh-rankingU.S.intelligenceofficialsaidtheNSAdoesnotrelyonittoday.

Assoonassurveillancedata“touchesus,we’vegot it,whateververbsyouchoose to use,” the official said in an interview. “We’re not saying there’s amagicformulathatletsushaveitwithouthavingit.”

WhenComey finally ordered a stop to the program,Bush signed an orderrenewingitanyway.Comey,Goldsmith,FBIDirectorRobertS.MuellerIIIandmost of the senior Bush appointees in the Justice Department began draftinglettersofresignation.

Then-NSADirectorMichaelV.Haydenwasnotamongthem.Accordingtothe inspectorgeneral’s classified report,Cheney’s lawyer,Addington, placed aphonecalland“GeneralHaydenhadtodecidewhetherNSAwouldexecutetheAuthorization without the Attorney General’s signature.” He decided to goalong.

Thefollowingmorning,whenMuellertoldBushthatheandComeyintendedtoresign,thepresidentreversedhimself.

Threemonthslater,onJuly15,thesecretsurveillancecourtallowedtheNSAto resumebulkcollectionunder the court’sownauthority.Theopinion,whichremains highly classified, was based on a provision of electronic surveillancelaw, known as “pen register, trap and trace,” that was written to allow lawenforcement officers to obtain the phone numbers of incoming and outgoingcallsfromasingletelephoneline.

When theNSA aims for foreign targetswhose communications crossU.S.infrastructure, it expects to sweep in someAmerican content “incidentally” or“inadvertently,” which are terms of art in regulations governing the NSA.Contact chaining, because it extends to the contacts of contacts of targets,inevitablycollectsevenmoreAmericandata.

Current NSA director Keith B. Alexanderand Director of NationalIntelligenceJamesR.ClapperJr.haveresolutelyrefusedtoofferanestimateofthenumberofAmericanswhosecallsore-mailshavethusmadetheirwayintocontentdatabasessuchasNUCLEON.

The agency and its advocates maintain that its protection of that data issubject to rigorous controls and oversight by Congress and courts. For thepublic,itcomesdowntoaquestionofunverifiabletrust.

“The constraints that I operate under are much more remarkable than the

powers that I enjoy,” said the senior intelligence official who declined to benamed.

When asked why the NSA could not release an unclassified copy of its“minimization procedures,” which are supposed to strip accidentally collectedrecords of their identifying details, the official suggested a reporter submit afreedom-of-informationrequest.

As for bulk collection of Internetmetadata, the question that triggered thecrisisof2004,anotherofficialsaidtheNSAisnolongerdoingit.Whenpressedonthatquestion,hesaidhewasspeakingonlyofcollectionsunderauthorityofthesurveillancecourt.

“I’mnotgoingtosaywe’renotcollectinganyInternetmetadata,”headded.“We’re not using this program and these kinds of accesses to collect Internetmetadatainbulk.”

JulieTateandEllenNakashimacontributedtothisreport.

AdditionalContent:ElectronicsurveillanceunderPresidentsBushandObama:Atimelineof

surveillanceintheUnitedStatesfrom2001to2013

Metadatarevealssecretsofsocialposition,companyhierarchy,terroristcells

ByEllenNakashimaJune15,2013

Upstream program. This slide shows PRISM as only one part of the NSA’s system for electroniceavesdropping.The“Upstream”programcollectsfromthefiber-opticcablenetworksthatcarrymuchoftheworld’s Internet and phone data. The underlying map depicts the undersea cables that connect NorthAmericatotherestoftheworld.

Thegeneral’smistressthoughtshewasbeingcleverbyusinganonymouse-mailaccountsandsendingmessagesusinghotelWiFinetworks.Butmetadata—inthiscase the Internetprotocoladdressespointing tonetwork locations—gaveheraway.

TheIPaddressesofthenetworksPaulaBroadwellloggedintothispastfallto send threatening messages to a woman she perceived as a rival for theaffection of Gen. DavidH. Petraeus traced back to the hotels. There, recordscorresponding to the dates the e-mailswere sent revealed one common guest:Broadwell.

PetraeusresignedasCIAdirectorover theaffair,and theepisodehassincereceded from the public’s attention. But it is instructive as one simple butpowerfulwayinwhichmetadata—ordataaboutcommunications—canrevealsomuchaboutwhoweare,wherewegoandwhomweassociatewith.

Metadata is so rich with clues that entities from Google and eBay to theworld’s largest spy agency, the National Security Agency, are collecting andmining this deceptively innocuous information: e-mail addresses to and from,times of e-mails, phone numbers dialed and received, lengths of calls, uniquedeviceserialnumbers.

Aweekandahalfago,U.S.officialsacknowledgedforthefirsttimethattheNSA since 2006 has been amassing a database ofmetadata on the phone-callrecordsoftensofmillionsofU.S.customers.

And, according to new documents obtained by TheWashington Post, theNSAuntil2011gatherede-mailandotherdigitalmetadatafrommajorInternetdatalinks,presumablytodetectandthwartterroristplots.

But the government has resisted explaining its legal justification forgatheringsuchmassiveamountsofdata,whichholdthepotentialtopermitvastintrusionsintothepersonallivesofAmericans.

“Whenyoucangetitallinoneplaceandanalyzethepatterns,youcanlearnanenormousamountabout thebehaviorofpeople,” saidDaniel J.Weitzner,a

principal research scientist at MIT’s Computer Science and ArtificialIntelligenceLaboratory.

Analystscangaincluestosleeppatterns(whenpeopleareasleep,theysendnoe-mailsandmakenocalls),religion(basedonlocationsofcallsmadeortheabsence of communications on theSabbath) or even social position (based onhowoftenpeoplegetcallsande-mailsandhowquicklytheyreceiveresponses).

In2007,researchersatColumbiaUniversitywereabletoidentifythesenior-most company officers at the bankrupt EnronCorp. by studying individual e-mail volume and average response time in 620,000 company e-mails. Thehighest-rankingofficersgotthemoste-mailandthequickestresponses.

Similarly,federalagentsusesoftwareandsocial-networkanalysistomapoutterroristcellsandcriminalgroups.They look, for instance,atwhocallswhommostfrequently,inatechniqueknownas“linkanalysis.”

“It’s remarkable how just the phone-call data can give you at least apreliminarypictureofhowtheorganizationoperatesandwhoitsmembersare,”saidJasonWeinstein,a formerdeputyassistantattorneygeneral for theJusticeDepartment’s criminaldivision. “It’sbynomeans thewholepicture,but it’s acriticalpieceofthepuzzletosolvethemostseriouscrimespeoplecancommit.”

Sometimes, metadata patterns can be tip-offs — a driver or courier in aterroristcellorcriminalgroupmaybetheonetoreceiveshortphonecallsfromseveraldifferentoperativesjustbeforeandafteranoperation.

Cellular-towerlocationdatacanhelpplacecriminalsatthesceneiftheyareusingtheirphonesjustbeforetheycommitarobbery,murderorattack.

“Everyday,lawenforcementofficersareusingthisdatatoplacesuspectsatthesceneofmurdersandothercrimes,”saidWeinstein,nowapartneratSteptoe&Johnson.

Dataaboutacommunicationmaybe justas revealingas thecontent itself,said Christopher Soghoian, principal technologist with the American CivilLibertiesUnion.

“Ifyoucallanabortionclinicandmakeanappointment,thefactthatyou’re

makingtheappointmentisfarmoresensitivethanwhattimeyourappointmentis,” he said. “If you’re callingAlcoholicsAnonymous or a suicide counselor,whatyou’resayingwillcertainlybesensitive.Butthefactthatyou’recallingAlAnonorasuicidecounselorisextremelysensitive,too.”

Under U.S. law, it’s easier for the government to obtain metadata thancontent. Authorities generally need to show probable cause for a wiretap orinterceptofcommunications.

Telephone records, but not e-mail metadata, can be obtained by lawenforcementagencieswithoutanykindofcourtorder.

Weitzner said metadata is “arguably more revealing because it’s actuallymucheasiertoanalyzethepatternsinalargeuniverseofmetadataandcorrelatethemwithreal-worldeventsthanitistogothroughasemanticanalysisofallofsomeone’se-mailandallofsomeone’stelephonecalls,ifyoucouldgetthat.

“Metadataisobjective:Icalledyou.Youcalledme.”CellphonedatahelpedItalianauthorities identifyCIAagentswhoabducted

an Egyptian cleric suspected of terrorist involvement in Milan in 2003. Theinvestigatorspulledtherecordsandidentifiedtheagentsbytheiraliases,wheretheyhadstayedandwhomtheyhadcalled—includingeachother.Similarly,in2011,Hezbollahidentifiedahalf-dozenCIAinformantsthroughanalysisoftheircellphonerecordsandcallingpatterns.

Critical as metadata is, Weinstein said, it does not give you the subject’swords and thoughts. “Only the content,” he said, “will provide you with theevidenceyouneedthattheconversationsareaboutterrorismorothercrimes.”

NewdocumentsrevealparametersofNSA’ssecretsurveillanceprograms

ByEllenNakashima,BartonGellmanandGregMillerJune20,2013

President Obama said after the disclosures that NSA domestic activities “do not involve listening topeople’sphonecalls,donotinvolvereadingtheemailsofU.S.citizens.”(MarvinJoseph/TheWashingtonPost)

The National Security Agency may keep the e-mails and telephone calls ofcitizens and legal residents if the communications contain “significant foreign

intelligence”orevidenceofacrime,accordingtoclassifieddocumentsthatlayoutproceduresfortargetingforeignersandforguardingAmericans’privacy.

Newlydiscloseddocumentsdescribeaseriesofstepstheworld’slargestspyagencyissupposedtotaketokeepAmericansfrombeingcaughtinitsmassivesurveillancenet.TheysuggestthattheNSAhaslatitudetokeepandusecitizens’communicationsundercertainconditions.

Thepapers,madeavailabletoTheWashingtonPostandBritain’sGuardiannewspaper,arethefirstpublicwrittendocumentationofproceduresgoverningafar-reaching NSA surveillance program authorized by Congress in 2008 togatherthee-mailsandphonecallsoftargetswhoaresupposedtobeforeignerslocatedoverseas.

In recent days, the Obama administration has defended the program ascriticaltonationalsecurity,sayingithashelpedfoilmorethan50terroristplotsintheUnitedStatesandabroad.

PresidentObamasaidafterthedisclosuresthatNSAdomesticactivities“donotinvolvelisteningtopeople’sphonecalls,donotinvolvereadingthee-mailsofU.S.citizensorU.S.residents,absentfurtheractionbyafederalcourt,thatisentirely consistent with what we would do, for example, in a criminalinvestigation.”

The new documents show that the NSA collects, processes, retains anddisseminates the contentsofAmericans’phonecalls ande-mailsunder awiderangeofcircumstances.

NSADirectorKeithB.Alexanderdescribedtheprogramas“limited,focusedand subject to rigorous oversight.” Testifying before Congress, he said “thedisciplined operation” of this and a related surveillance program “protects theprivacyandcivillibertiesoftheAmericanpeople.”

AspokesmanfortheOfficeoftheDirectorofNationalIntelligencedeclinedtocommentonthedocumentsThursday.

Privacy advocates expressed concern aboutwhat they viewed as rules thatleave much wiggle room for NSA analysts to monitor Americans’

communications.“These documents confirm what we have feared all along, that the NSA

believes it can collect Americans’ international communications with little, ifany, restriction,” said Alex Abdo, a staff lawyer with the American CivilLibertiesUnion.“Itsproceduresallowittotargetforsurveillanceessentiallyanyforeignerlocatedabroad—whetherornotthey’resuspectedofanywrongdoing,letaloneterrorism.”

Administration officials say the surveillance program does not targetAmericans anywhere without a warrant. Still, said Gregory Nojeim, seniorcounselfortheCenterforDemocracyandTechnology,“there’salotofleewayto use ‘inadvertently’ acquired domestic communications,” for instance, forcriminalinquiries.

Andtherulesshowthatthecommunicationsoflawyersandtheirclientsmaybe retained if they contain foreign intelligence information, althoughdisseminationmustbeapprovedbytheNSAgeneralcounsel.

Congress authorized the collection program amid a great debate about thedegree to which the government was expanding its surveillance authoritywithoutsufficientprotectionforAmericans’privacy.

AuthorizedbySection702oftheamendedForeignIntelligenceSurveillanceAct (FISA), the program did away with the traditional individual warrant foreach foreign suspectwhose communicationswould be collected in theUnitedStates. In its place, the FISA court, which oversees domestic surveillance forforeign intelligence purposes andwhose proceedings are secret, would certifythe government’s procedures to target people overseas and ensure citizens’privacy.

Itissuesacertificate,goodforoneyear,thatallowstheNSAtoorderaU.S.Internet or phone company to turn over over e-mails, phone calls and othercommunications related to a series of foreign targets, none ofwhich the courtapprovedindividually.

“What’smost striking about the targeting procedures is the discretion they

conferon theNSA,”saidElizabethGoitein,co-directorof theBrennanCenterforJustice’sLibertyandNationalSecurityprogram.

In figuring out whether a target is “reasonably believed” to be locatedoverseas, for example, the agency looks at the “totality of the circumstances”relating to a person’s location. In the absence of that specific information, “aperson reasonably believed to be located outside the United States or whoselocation is not known will be presumed to be a non-United States person,”accordingtorulesonthetargetingofsuspects.

Nonetheless, thedocuments contain a seriesof steps theNSAmay take todetermineaforeigner’slocation.Agencyanalystsexamineleadsthatmaycomefromother agencies, including fromhuman sources.They conduct research inNSAdatabases,scrutinizeInternetprotocoladdressesandtarget“Internet linksthatterminateinaforeigncountry.”

“WhenNSAproposes to direct surveillance at a target, it does so becauseNSAhasalreadylearnedsomethingaboutthetarget,”accordingtothetargetingrules.Often,thatleadcomesfromtheCIAoralawenforcementagency.

TheNSAuseswhateverdetailsarecontainedinthatleadtomakeaninitialassessmentofwhetheritisbeingaskedtoeavesdroponanoverseastarget.Butthe agency then takes other steps depending on the circumstances, such asscanningdatabases “towhichNSAhas access but did not originate” for cluesaboutlocation.

TopreventU.S.citizensandlegalresidentsfrombeingtargeted,NSAkeepsa database of phone numbers and e-mail addresses associated with peoplethoughttobelivinginthecountry.Newrequestsarecomparedtorecordsonthelist.Matchesaresignalstoputthesurveillanceonhold.

The NSA then goes through a sequence of potential additional checks,according to the document. It may look at area codes and the ordinary datapackets that accompany e-mails as they cross the Internet. And it may checkcontact lists associated with e-mail accounts, as well as massive “knowledgedatabases”thatcontainCIAintelligencereports.

Afteritbeginsinterceptingcallsore-mails,theNSAissupposedtocontinuetolookforsigns that thepersonit ismonitoringhasenteredtheUnitedStates,whichwouldpromptahaltinsurveillanceandpossiblyanotificationtotheFBI.

The document on “minimization” spells out rules for protecting privacy,someofwhichhavebeendescribedpublicly.Therulesprotectnotjustcitizens,butforeignersintheUnitedStates.

If domestic communications lack significant foreign intelligenceinformation, they must be promptly destroyed. Communications concerningAmericansmaynotbekeptmorethanfiveyears.

If a target who was outside the United States enters the country, themonitoringmuststopimmediately.

AdditionalContent:TheNSAslideyouhaven’tseen

President’ssurveillanceprogramworkedwithprivatesectortocollectdataafter

Sept.11,2001

ByRobertO’HarrowJr.andEllenNakashimaJune27,2013

LEFT:FirefightersfightfiresinsidethePentagonthedayafteraplanehititonSept.11,2001.(PhotobyTracyA.Woodward/TheWashingtonPost).RIGHT:FirefightersunfurlalargeflagonthePentagonthedayaftertheattack.(PhotobyJohnMcDonnell/TheWashingtonPost)

In the days after the Sept. 11, 2001, terror attacks, American telephonecompanies offered the National Security Agency access to domestic callingrecordsandtheirownanalysisofcallingpatterns,atop-secretdocumentshows.

Atfirst,theNSAcouldnotacceptthehelpbecauseitdidnothavethelegalauthority tocollectdatadomestically.That changedonOct.4,whenPresidentGeorgeW.BushgavehisapprovalforwhatbecameknowninclassifiedcirclesasthePresident’sSurveillanceProgram,orPSP.

The NSA immediately began cultivating an array of “private sectorpartners,” including telephone companies, Internet service providers andWebservices,accordingtoa top-secretreportbytheNSAinspectorgeneral’sofficeobtainedbyTheWashingtonPost.

“PrivatesectorpartnersbegantosendtelephonyandInternetcontenttoNSAinOctober2001.TheybegantosendtelephonyandInternetmetadatatoNSAasearlyasNovember2001,”theIGreportsaid.

The57-pagedocument,aworkingdraftdatedMarch24,2009,offersashorthistoryofoneof themostsweepingdomesticsurveillanceefforts inAmericanhistory.ItwasfirstpostedbytheGuardiannewspaperinEngland.

Thedocumentcontainsnewinformationabouthowthedecade-longprogramcame to be, includingdetails about legalmatters, funding and the fact that 60lawmakerswerebriefedaboutit.Thereportalsocontainsmuchthathasalreadybeen disclosed by The Post and theGuardian, based on documents leaked byformerNSAcontractorEdwardSnowden.

Itdepictsaprogramfashionedvirtuallyfromscratchinatimeofcrisis,byahandfulofindividuals,includingGen.MichaelHayden,theheadoftheNSAandVicePresidentDickCheney.Giventhecodename“StellarWind,”thePSPwasaset of four surveillance programs that brought Americans and U.S. territorywithin the domain of the NSA for the first time in decades. The PSP, whichinitiallyoperatedoutsidetherestrictionsoftheForeignIntelligenceSurveillanceAct,waseventuallyputunderfullFISAcourtcontrolby2007.

The report also offers new fodder for critics of domestic spying about theproperlimitsondomesticintelligence.InrecentinterviewswithThePost,someformerseniorNSAofficialssaidtheyhadmisgivingsatthetime.

“Itwas not something that I feltwe needed to do or should do,” said oneformerNSAofficialwhospokeontheconditionofanonymityinordertodiscusstop-secretmatters. “I thought therewas away to do it,whichwas to put thisunder FBI control, using FBI authorities, and just let the FBI use our [NSA]tools.Iwasjustthinking,whatkindofprecedentdoesthisset?”

The NSA inspector general’s office issued the classified report under amandate from theFISAAmendmentsActof2008.The report also shows thatNSAofficialsbelievedthattherewerenoconstitutionallimitsonthecollectionofdigitalmetadata,includingsuchdetailsastheorigin,destinationandtimingofcallsande-mails.

More significantly, the inspector general’s report underscores the NSA’sfundamentalrelianceonprivate-sectorcompanies.

“AccordingtoGeneral[KeithB.]Alexander,GeneralHayden’sreplacementasDirector ofNSA/CSS, if the relationshipswith these companieswere everterminated, the U.S. SIGINT system would be irrevocably damaged, becauseNSAwouldhavesacrificedAmerica’shomefieldadvantageastheprimaryhubforworldwidetelecommunications,”thereportsaid.

Hayden,nowasecurityconsultant,wasoutof thecountryandunavailableforcomment.

The four programs under the PSP involved the collection of Internet andtelephonemetadataandcontent.TheInternetmetadataprogram“wasterminatedin 2011 because it didn’t have the operational impact that we needed,”Alexander said Thursday while speaking at a cyber conference in Baltimore.AlexandersaidthattheadministrationandCongresssupportedtheshutdownandthe“datawaspurged.”

GregNojeim, senior counsel and civil liberties specialist at theCenter forDemocracy andTechnology (CDT), said such a programwas not supposed tohappenunderFISA.

“Thedocumentshowsthatthepresidentauthorized,andtheNSAconducted,the very electronic surveillance that Congress enacted FISA to preclude,”Nojeimsaid.“Nocourtorders.Nofindingofprobablecause.Infact,theFISAcourtdoesn’tevengetbriefedaboutituntilfourmonthslater.DueprocessunderthisprogramatinceptionwasjustahandshakebetweentheheadoftheNSAandthevicepresident’scounsel.”

Theprogramwasbornatatimewhenthenationwasexperiencingitsmost

acutesecuritycrisissincethePearlHarborattacks60yearsearlier.InthehoursafterSept.11,2001,theNSAscrambledtodeterminehowtouseitssurveillancetools within a legal framework that tightly proscribed domestic intelligencecollection.

“GeneralHaydenwasoperating inauniqueenvironment inwhich itwasawidelyheldbeliefthatadditionalattacksonU.S.soilwereimminent,”thereportsaid.

NSAofficialsfound“collectiongaps”thatleftthecountryvulnerable.“NSAbelieved that the FISA process was unable to accommodate the number ofterroristtargetsorthespeedwithwhichtheychangedtheircommunication,”thereport said, adding that the average wait for FISA approval was four to sixweeks.

Three days after the attacks, Hayden approved the targeting of terrorist-associated foreign telephone numbers on communication links between theUnitedStatesandforeigncountries,thereportsaid.

On Oct. 2, Hayden briefed members of the House Permanent SelectCommittee on Intelligence andSenateSelectCommittee on Intelligence abouthisdecisiontoallowexpandeddatacollection.

ThepresidentissuedamemoonOct.4thatauthorized“specifiedelectronicsurveillance” for a “limited period” to detect and thwart terrorism inside theUnited States. The order delegated authority to the secretary of defense, whopassedontheauthoritytoHayden.

Under the initial authorization, as long as theNSA had probable cause tothinkoneof thepeoplecommunicatingwas inAfghanistanorwasengaged inplanning an act of international terrorism, the agency could collectcommunicationsdataoutsidetheFISAprocess.“Themajorityofknownterroristemailaddresses thatNSAhas trackedarehostedonU.S.-basedproviders,” thereportsaid.

Days later, the PSP’s metadata analysis center was a round-the-clockoperationwith20analystsandsoftwaredevelopers.Manyofthemwere“former

Russian traffic analysts,” the report said.Within a week, 90 NSA employeeswerecleartoviewthePSPmaterial.

The“PSPcontentcollection”ultimatelytargeted3,018peopleintheUnitedStatesfromOct.4,2001,toJan.17,2007,thereportsaid.Targetingofforeignnationals was broadened beyond Afghanistan shortly after the initialauthorization.Ofthetargets,34,646,or92percent,wereforeign.

Thereportnotes:“NSAleadershipconsideredselectorsfortargetslocatedintheUnitedStates tobe extremely sensitive.As such, processeswere set up toensurestrictcompliancewiththetermsoftheAuthorization.”

ButthesweepofthePSPwentbeyondcontentandincludedthecollectionofvastamountsofmetadata.Amongthelegalassumptionswasthat“metadatawasnotconstitutionallyprotected”andnotassensitiveascontent.

“Nevertheless, processes were set up to document requests for metadataanalysis and justifications for conducting such analysis under Programauthority,”thereportsaid.

Thereportdoesnotspecifyhowmuchmetadatawascollected,butitpointedoutthat37billionminutesintelephoneconversationsoriginatedorendedintheUnitedStatesin2003alone.

“NSA determined that under the Authorization it could gain access toapproximately81%of the international calls into andout of theUnitedStatesthroughthreecorporatepartners,”thereportsaid.

BartonGellman,CarolLeonnig,KimbriellKellyandSariHorwitzcontributedtothisreport.

ForNSAchief,terroristthreatdrivespassionto‘collectitall,observerssay

ByEllenNakashimaandJobyWarrickJuly14,2013

NSA chief Keith Alexander has vigorously defended the agency’s data collection program. (BillO’Leary/TheWashingtonPost)

In late 2005, as Iraqi roadside bombings were nearing an all-time peak, theNationalSecurityAgency’snewlyappointedchiefbeganpitchingaradicalplanforhaltingtheattacksthatwerekillingorwoundingadozenAmericansaday.

At the time,more than 100 teams ofU.S. analystswere scouring Iraq forsnippetsofelectronicdatathatmightleadtothebomb-makersandtheirhiddenfactories. But the NSA director, Gen. Keith B. Alexander, wanted more thanmeresnippets.Hewantedeverything:EveryIraqitextmessage,phonecallande-mailthatcouldbevacuumedupbytheagency’spowerfulcomputers.

“Rather than look for a single needle in the haystack, his approach was,‘Let’s collect the whole haystack,’ ” said one former senior U.S. intelligenceofficialwhotrackedtheplan’simplementation.“Collectitall,tagit,storeit.. . .Andwhateveritisyouwant,yougosearchingforit.”

The unprecedented data collection plan, dubbed Real Time RegionalGateway, would play a role in breaking up Iraqi insurgent networks andsignificantlyreducingthemonthlydeathtollfromimprovisedexplosivedevicesby late 2008. It also encapsulated Alexander’s controversial approach tosafeguardingAmericansfromwhatheseesasahostofimminentthreats,fromterrorismtodevastatingcyberattacks.

Inhiseightyearsatthehelmofthecountry’selectronicsurveillanceagency,Alexander,61,hasquietlypresidedoverarevolutioninthegovernment’sabilitytoscoopupinformationinthenameofnationalsecurity.And,ashedidinIraq,Alexanderhaspushedhard for everythinghe canget: tools, resources and thelegal authority to collect and store vast quantities of raw information onAmericanandforeigncommunications.

His successeshavewonaccolades frompolitical leadersof bothparties aswell as fromcounterterrorismand intelligenceprofessionalswhosay theNSAchief’seffortshavehelpedfoildozensofterroristattacks.Hisapproachalsohas

drawnattackfromcivilrightsgroupsandabipartisangroupoflawmakers.OneDemocrat who confronted Alexander at a congressional hearing last monthaccused the NSA of crossing a line by collecting the cellphone records ofmillionsofAmericans.

“Whatauthorizationgaveyouthegroundsforacquiringmycellphonedata?”demandedSen.JeffMerkley(D-Ore.),wavinghismobilephoneatthefour-stargeneral.

Newdetailsofthespyagency’svastreachwerebroughttolightlastmonthbyformerNSAcontractorEdwardSnowden,wholeakedclassifiedinformationongovernmentprogramsthatsweepup“metadata”onphonecallsande-mailsbyAmericans. Those revelations in turn have spotlighted the role played byAlexander, the NSA’s avuncular leader and, by all accounts, a driving forcebehindapost-Sept.11,2001,questtotransformanagencyinundatedbythedatarevolutionintoonethatcanexploitittodefendthenation.

As portrayed by supporters, Alexander is animated by a spymaster’sawarenessofserious,overlappingthreatsarrayedagainsttheUnitedStates.Theyinclude foreign and homegrown terrorists. They also include a host ofadversarieswhoareconstantlyprobingthecountry’scyberdefenses,lookingforopportunities to steal secrets or unleash mayhem by shutting down criticalinfrastructure. Like many national security officials of his generation,Alexander’s sensibilitieswere shapedbya seriesofpainful intelligence lapsesleadinguptotheSept.11attacks.

To some of Alexander’s most vociferous critics, Snowden’s disclosuresconfirm their imageof anagencyandadirector soenamoredof technologicalprowessthattheyhavesacrificedprivacyrights.

“He is absolutely obsessed and completely driven to take it all, wheneverpossible,” said Thomas Drake, a former NSA official and whistleblower. The

continuationofAlexander’spolicies,Drakesaid,wouldresultinthe“completeeviscerationofourcivilliberties.”

Alexander frequently points out that collection programs are subject tooversight by Congress as well as the U.S. Foreign Intelligence SurveillanceCourt,althoughtheproceedingsofbothbodiesareshroudedinsecrecy.Butevenhis defenders sayAlexander’s aggressiveness has sometimes taken him to theouteredgeofhislegalauthority.

Some in Congress complain that Alexander’s NSA is sometimes slow toinform the oversight committees of problems, particularly when the agency’seavesdroppersinadvertentlypickupcommunicationsthatfalloutsidetheNSA’slegalmandates.Othersareuncomfortablewiththeextraordinarilybroadpowersvested in the NSA chief. In 2010, he became the first head of U.S. CyberCommand,setuptodefendDefenseDepartmentnetworksagainsthackersand,when authorized, conduct attacks on adversaries. Pentagon officials andAlexander say the command’s mission is also to defend the nation againstcyberattacks.

“Heistheonlymaninthelandthatcanpromoteaproblembyvirtueofhisintelligencehatandthenpromoteasolutionbyvirtueofhismilitaryhat,”saidoneformerPentagonofficial,voicingaconcernthatthelinesgoverningthetwoauthorities are not clearly demarcated and that Alexander can evade effectivepublic oversight as a result. The former official spoke on the condition ofanonymitytobeabletotalkfreely.

Alexander himself has expressed unease about secrecy constraints that hesaysprohibithimfromfullyexplainingwhattheNSAdoes.ButjustasinIraq,he remains fiercely committed to the belief that “we need to get it all,” saidTimothyEdgar,aformerprivacyofficerattheOfficeoftheDirectorofNationalIntelligenceandattheWhiteHouse.

“Hecertainlybelievesyouneedtocollecteverythingyoucanunderthelaw,”Edgarsaid,“andthatincludespushingforprettyaggressiveinterpretationsofthelaw.”

Alexander maintained in a speech last month that he is mindful to “doeverythingyoucantoprotectcivillibertiesandprivacy.”

Hethenaddedawarning:“Everyonealsounderstands,”hesaid,“thatifwegiveupacapabilitythatiscriticaltothedefenseofthisnation,peoplewilldie.”

The NSA’s 5,000-acre campus at Fort Meade in suburbanMaryland containsmore than 1,300 heavily guarded buildings and an array of computers andgadgetry sometimesdescribedas“themostwonderfulelectronic toybox in theworld.” But even before his arrival there in 2005 as director, Alexander wasregardedasaleadingapostleforharnessingtechnology’sawesomepowerintheserviceofnationalsecurity.

In the mid-1990s, he had pioneered work in battlefield visualization —helpingthesoldierseeonalaptopscreenwherefriendlyandenemyforceswereonadetailedterrainmap.HelaterledthepushfortechnologicalinnovationasheadoftheArmy’sIntelligenceandSecurityCommand.

At the NSA, he has presided over the agency’s physical expansion whilemoving quickly to speed up the collection, analysis and sharing of massiveamountsofrawdata.

In the process, theWest Point graduate has risen to become arguably themostpowerfulU.S.generalmostAmericanshaveneverheardof—orat leastnotuntiltheSnowdenaffairpropelledhimintothepublicspotlight.Herunsthenation’s largest, costliest and most secretive intelligence agency — anorganizationwhoseveryexistencewasnotofficiallyacknowledged in itsearlyyears.TheNSAholdsprimacyoverallelectroniceavesdroppingoverseas,fromroutinespyingonforeigngovernmentstosweepingupcommunicationsbetweenterrorists overseas. Most of it is now done through hacking into networks inothercountries.

Threeyearsago,Alexander’sresponsibilitiesballoonedwithhisappointmenttoleadthePentagon’sU.S.CyberCommand.

Even close allies have fretted about the concentration of so muchresponsibility—nottomentioninfluence—inasingleindividual.Someworrythatthejobwastailoredtotheskillsofonemanandnottothemissionitself.

“Wheredoyou find anotherperson likeGeneralAlexanderwhopossessestheintelqualificationstorunNSAandtheoperationalexperiencetocommand”the military’s cyber operations, said retired Lt. Gen. Robert J. Elder, wholaunchedtheAirForce’sfirstcybercommandin2007.

NoonequestionsAlexander’squalificationsforthedualrole.Withatrioofmaster’sdegreesinelectronicwarfare,physicsandnationalsecuritystrategy,theSyracuse,N.Y.,nativeisendowedwithtechnicalsmartsandambitionaswellasafolksy,evengoofy,charmthatcandisarmcritics.

Heroutinelymakesreferences—inspeechesandinpersonwithcolleagues—tohisfourdaughtersandhis14,soon-to-be15,grandchildren,includinghowtheyoungest,atoddler,SkypeswithGrandma.

In January, he was on a cybersecurity panel in Munich when someonebrought up Twitter’s announcement that 250,000 of its accounts had beenhacked. “I didn’t do it,” Alexander said. “I was here. I have an alibi.” Then,turningtoafellowpanelist,anofficialfromtheChinesetechcompanyHuawei,hequipped:“Doyou?”

Lastsummer,Alexanderwadedintothelion’sdenwhen,wearingjeansandablackT-shirt,hedeliveredakeynoteaddressattheDefConhackersconventioninLasVegasandmugged for thecameras.At the time,he told thecrowd that“thestorythatwe[attheNSA]havemillionsorhundredsofmillionsofdossiersonpeopleisabsolutelyfalse.”

ThatlineirkedlawmakerswhowereawareoftheNSA’ssecretcollectionofphonedata.Andthisyear,afterSnowden’srevelations,DefConorganizerssaidfederalofficialswerenotwelcomeattheevent.

Alexander’soutsizecommitment tohismissionhaspropelledhimtoseeknew

capabilitieswithanimpatiencethathassometimesrankledsuperiors,whilealsoraisingconcernsaboutprivacyandhowfarhewantstopushintooffensiveusesof cybertools. Alexander has argued for covert action authority, which istraditionallythedomainoftheCIA,individualsfamiliarwiththemattersay.

HehasbeencreditedasakeysupporterofthedevelopmentofStuxnet,thecomputerworm that infected Iran’smain uranium enrichment facility in 2009and 2010 and is the most aggressive known use to date of offensivecyberweaponry.U.S.officialshaveneverpubliclyacknowledgedinvolvementinwhat has been described by experts as the first known, industrial-scalecyberattackonasovereignnation,onethat isestimatedtohavesetbackIran’suraniumproductionbyasmuchasayear.

Alexanderalsopushedhardforexpandedauthority tosee intoU.S.privatesectornetworkstohelpdefendthemagainstforeigncyberattacks.

Quietconcernsalsohavebeenvoicedbysomeoftheprivatecompaniesthatwouldpotentiallybenefitfromgovernmentprotectionagainstcyberattack.

At a private meeting with financial industry officials a few years ago,Alexander spoke about the proliferation of computer malware aimed atsiphoning data from networks, including those of banks. The meeting wasdescribedbyaparticipantwhospokeontheconditionofanonymitybecausethediscussionwasofftherecord.

Hisproposedsolution:Privatecompaniesshouldgivethegovernmentaccesstotheirnetworkssoitcouldscreenouttheharmfulsoftware.TheNSAchiefwasoffering to serve as an all-knowing virus-protection service, but at the cost,industry officials felt, of an unprecedented intrusion into the financialinstitutions’databases.

Thegroupoffinancialindustryofficials,sittingaroundatableattheOfficeoftheDirectorofNationalIntelligence,werestunned,immediatelygraspingtheprivacyimplicationsofwhatAlexanderwaspolitelybuturgentlysuggesting.Asagroup,theydemurred.

“He’s an impressive person,” the participant said, recalling the group’s

collective reaction to Alexander. “You feel very comfortable with him. Heinstillsahighdegreeoftrust.”

Buthewasproposingsomethingtheythoughtwashigh-risk.“Folksintheroomlookedateachotherlike,‘Wow.That’skindofwild.’ ”

NSAbrokeprivacyrulesthousandsoftimesperyear,auditfinds

ByBartonGellmanAugust15,2013

TheNationalSecurityAgencyhasbrokenprivacyrulesoroversteppeditslegalauthoritythousandsoftimeseachyearsinceCongressgrantedtheagencybroadnew powers in 2008, according to an internal audit and other top-secretdocuments.

Most of the infractions involve unauthorized surveillance ofAmericans orforeignintelligencetargetsintheUnitedStates,bothofwhicharerestrictedbystatute and executive order. They range from significant violations of law to

typographicalerrorsthatresultedinunintendedinterceptionofU.S.e-mailsandtelephonecalls.

The documents, provided earlier this summer to TheWashington Post byformerNSAcontractorEdwardSnowden,includealevelofdetailandanalysisthat is not routinely shared with Congress or the special court that overseessurveillance.Inoneofthedocuments,agencypersonnelareinstructedtoremovedetailsandsubstitutemoregenericlanguageinreportstotheJusticeDepartmentandtheOfficeoftheDirectorofNationalIntelligence.

In one instance, the NSA decided that it need not report the unintendedsurveillanceofAmericans.Anotableexamplein2008wastheinterceptionofa“large number” of calls placed from Washington when a programming errorconfusedtheU.S.areacode202for20,theinternationaldialingcodeforEgypt,accordingtoa“qualityassurance”reviewthatwasnotdistributedtotheNSA’soversightstaff.

In another case, the Foreign Intelligence Surveillance Court, which hasauthority over some NSA operations, did not learn about a new collectionmethod until it had been in operation for many months. The court ruled itunconstitutional.

TheObamaadministrationhasprovidedalmostnopublicinformationaboutthe NSA’s compliance record. In June, after promising to explain the NSA’srecord in“as transparentawayaswepossiblycan,”DeputyAttorneyGeneralJamesColedescribedextensivesafeguardsandoversightthatkeeptheagencyincheck.“Everynowandthen,theremaybeamistake,”Colesaidincongressionaltestimony.

The NSA audit obtained by The Post, dated May 2012, counted 2,776incidentsinthepreceding12monthsofunauthorizedcollection,storage,accessto or distribution of legally protected communications.Mostwere unintended.Many involved failures of due diligence or violations of standard operatingprocedure.Themostseriousincidentsincludedaviolationofacourtorderand

unauthorized use of data about more than 3,000 Americans and green-cardholders.

In a statement in response to questions for this article, the NSA said itattempts to identify problems “at the earliest possible moment, implementmitigation measures wherever possible, and drive the numbers down.” ThegovernmentwasmadeawareofThePost’s intention topublish thedocumentsthataccompanythisarticleonline.

“We’re a human-run agency operating in a complex environment with anumber of different regulatory regimes, so at times we find ourselves on thewrongsideoftheline,”aseniorNSAofficialsaidinaninterview,speakingwithWhiteHousepermissionontheconditionofanonymity.

“Youcanlookatitasapercentageofourtotalactivitythatoccurseachday,”hesaid.“Youlookatanumberinabsolutetermsthatlooksbig,andwhenyoulookatitinrelativeterms,itlooksalittledifferent.”

There is no reliable way to calculate from the number of recordedcompliance issues how many Americans have had their communicationsimproperlycollected,storedordistributedbytheNSA.

ThecausesandseverityofNSAinfractionsvarywidely.Onein10incidentsis attributed to a typographical error in which an analyst enters an incorrectqueryandretrievesdataaboutU.Sphonecallsore-mails.

But the more serious lapses include unauthorized access to interceptedcommunications,thedistributionofprotectedcontentandtheuseofautomatedsystemswithoutbuilt-insafeguardstopreventunlawfulsurveillance.

The May 2012 audit, intended for the agency’s top leaders, counts onlyincidents at the NSA’s Fort Meade headquarters and other facilities in theWashington area. Three government officials, speaking on the condition ofanonymitytodiscussclassifiedmatters,saidthenumberwouldbesubstantiallyhigherifitincludedotherNSAoperatingunitsandregionalcollectioncenters.

Senate IntelligenceCommitteeChairmanDianneFeinstein (D-Calif.),whodidnotreceiveacopyofthe2012audituntilThePostaskedherstaffaboutit,

saidinastatementlateThursdaythatthecommittee“canandshoulddomoretoindependently verify that NSA’s operations are appropriate, and its reports ofcomplianceincidentsareaccurate.”

Despite the quadrupling of the NSA’s oversight staff after a series ofsignificantviolationsin2009,therateofinfractionsincreasedthroughout2011andearly2012.AnNSAspokesmandeclinedtodisclosewhetherthetrendhascontinuedsincelastyear.

Onemajorproblemislargelyunpreventable,theauditsays,becausecurrentoperations relyon technology thatcannotquicklydeterminewhethera foreignmobilephonehasenteredtheUnitedStates.

Inwhatappears tobeoneof themostseriousviolations, theNSAdivertedlarge volumes of international data passing through fiber-optic cables in theUnitedStates into a repositorywhere thematerial couldbe stored temporarilyforprocessingandselection.

The operation to obtainwhat the agency called “multiple communicationstransactions”collectedandcommingledU.S.and foreigne-mails,according toan article in SSONews, a top-secret internal newsletter of theNSA’s SpecialSourceOperations unit.NSA lawyers told the court that the agency could notpracticablyfilteroutthecommunicationsofAmericans.

In October 2011, months after the program got underway, the ForeignIntelligence Surveillance Court ruled that the collection effort wasunconstitutional. The court said that the methods used were “deficient onstatutoryandconstitutionalgrounds,”accordingtoatop-secretsummaryoftheopinion,anditorderedtheNSAtocomplywithstandardprivacyprotectionsorstoptheprogram.

JamesR.ClapperJr.,thedirectorofnationalintelligence,hasacknowledgedthat the court found the NSA in breach of the Fourth Amendment, whichprohibitsunreasonablesearchesandseizures,buttheObamaadministrationhasfoughtaFreedomofInformationlawsuitthatseekstheopinion.

Generally,theNSArevealsnothinginpublicaboutitserrorsandinfractions.

Theunclassifiedversionsoftheadministration’ssemiannualreportstoCongressfeature blacked-out pages under the headline “Statistical Data Relating toComplianceIncidents.”

Members of Congress may read the unredacted documents, but only in aspecial secure room, and they are not allowed to take notes. Fewer than 10percentoflawmakersemployastaffmemberwhohasthesecurityclearancetoreadthereportsandprovideadviceabouttheirmeaningandsignificance.

The limited portions of the reports that can be read by the publicacknowledge“asmallnumberofcomplianceincidents.”

UnderNSAauditingguidelines,theincidentcountdoesnotusuallydisclosethenumberofAmericansaffected.

“Whatyoureallywant toknow,Iwould think, ishowmanyinnocentU.S.personcommunicationsare,one,collectedatall,and two,subject toscrutiny,”saidJulianSanchez,aresearchscholarandclosestudentoftheNSAattheCatoInstitute.

ThedocumentsprovidedbySnowdenofferonlyglimpsesofthosequestions.Somereportsmakeclearthatanunauthorizedsearchproducednorecords.Butasingle“incident”inFebruary2012involvedtheunlawfulretentionof3,032filesthatthesurveillancecourthadorderedtheNSAtodestroy,accordingtotheMay2012audit.Eachfilecontainedanundisclosednumberoftelephonecallrecords.

OneofthedocumentsshedsnewlightonastatementbyNSADirectorKeithB.Alexanderlastyearthat“wedon’tholddataonU.S.citizens.”

Some Obama administration officials, speaking on the condition ofanonymity,havedefendedAlexanderwithassertions that theagency’s internaldefinitionof“data”doesnotcover“metadata”suchasthetrillionsofAmericancallrecordsthattheNSAisnowknowntohavecollectedandstoredsince2006.Those records include the telephone numbers of the parties and the times anddurations of conversations, among other details, but not their content or thenamesofcallers.

The NSA’s authoritative definition of data includes those call records.

“Signals Intelligence Management Directive 421,” which is quoted in secretoversightandauditingguidelines,statesthat“rawSIGINTdata. . .includes,butisnot limited to,unevaluatedand/orunminimized transcripts,gists, facsimiles,telex, voice, and some forms of computer-generated data, such as call eventrecordsandotherDigitalNetworkIntelligence(DNI)metadataaswellasDNImessagetext.”

In the case of the collection effort that confused calls placed fromWashingtonwiththoseplacedfromEgypt,itisunclearwhattheNSAmeantbya“largenumber”ofinterceptedcalls.Aspokesmandeclinedtodiscussthematter.

TheNSAhasdifferentreportingrequirementsforeachbranchofgovernmentandeachofitslegalauthorities.The“202”collectionwasdeemedirrelevanttoanyofthem.“TheissuepertainedtoMetadataONLYsotherewerenodefectstoreport,”accordingtotheauthorofthesecretmemofromMarch2013.

The large number of database query incidents, which involve previouslycollected communications, confirms long-standing suspicions that the NSA’svast data banks — with code names such as MARINA, PINWALE andXKEYSCORE—houseaconsiderablevolumeofinformationaboutAmericans.Ordinarily the identities of people in the United States are masked, butintelligence“customers”mayrequestunmasking,eitheronecaseatatimeorinstandingorders.

In dozens of cases, NSA personnel made careless use of the agency’sextraordinary powers, according to individual auditing reports. One team ofanalysts inHawaii, forexample, askeda systemcalledDISHFIRE to findanycommunications that mentioned both the Swedish manufacturer Ericsson and“radio”or“radar”—aquerythatcouldjustaseasilyhavecollectedonpeopleintheUnitedStatesasontheirPakistanimilitarytarget.

TheNSA uses the term “incidental” when it sweeps up the records of anAmerican while targeting a foreigner or a U.S. person who is believed to beinvolved in terrorism. Official guidelines for NSA personnel say that kind ofincident,pervasiveundercurrentpractices, “doesnotconstitutea . . .violation”

and“doesnothavetobereported”totheNSAinspectorgeneralforinclusioninquarterly reports to Congress. Once added to its databases, absent otherrestrictions,thecommunicationsofAmericansmaybesearchedfreely.

In one required tutorial, NSA collectors and analysts are taught to fill outoversight forms without giving “extraneous information” to “our FAAoverseers.” FAA is a reference to the FISAAmendments Act of 2008, whichgrantedbroadnewauthoritiestotheNSAinexchangeforregularauditsfromtheJusticeDepartmentand theOfficeof theDirectorofNational IntelligenceandperiodicreportstoCongressandthesurveillancecourt.

Using real-world examples, the “Target Analyst Rationale Instructions”explain how NSA employees should strip out details and substitute genericdescriptionsoftheevidenceandanalysisbehindtheirtargetingchoices.

“I realize you can read thosewords a certainway,” said the high-rankingNSAofficialwhospokewithWhiteHouseauthority,but the instructionswerenot intended to withhold information from auditors. “Think of a book ofindividual recipes,”hesaid.Each target“hasa short, concisedescription,”butthatis“notasubstituteforthefullrecipethatfollows,whichouroverseersalsohaveaccessto.”

JulieTateandCarolD.Leonnigcontributedtothisreport.

AdditionalContent:NSAreportonprivacyviolationsinthefirstquarterof2012

FirstdirectevidenceofillegalsurveillancefoundbytheFISAcourtWhat’sa‘violation’?

Whattosay,andnottosay,to‘ouroverseers’

FISAcourt:AbilitytopoliceU.S.spyingprogramlimited

ByCarolLeonnigAugust15,2013

Theleaderofthesecretcourtthatissupposedtoprovidecriticaloversightofthegovernment’svast spyingprograms said that its ability todo so is limitedandthat it must trust the government to report when it improperly spies onAmericans.

ThechiefjudgeoftheForeignIntelligenceSurveillanceCourtsaidthecourtlacksthetoolstoindependentlyverifyhowoftenthegovernment’ssurveillancebreaks thecourt’s rules thataim toprotectAmericans’privacy.Without takingdrasticsteps,italsocannotchecktheveracityofthegovernment’sassertionsthattheviolationsitsstaffmembersreportareunintentionalmistakes.

“The FISC is forced to rely upon the accuracy of the information that isprovidedtotheCourt,”itschief,U.S.DistrictJudgeReggieB.Walton,saidinawrittenstatementtoTheWashingtonPost.“TheFISCdoesnothavethecapacityto investigate issues of noncompliance, and in that respect the FISC is in thesame position as any other court when it comes to enforcing [government]compliancewithitsorders.”

Walton’s comments came in response to internal government recordsobtainedbyThePostshowingthatNationalSecurityAgencystaffmembers inWashingtonoversteppedtheirauthorityonspyprogramsthousandsoftimesperyear.Therecordsalsoshowthatthenumberofviolationshasbeenontherise.

The court’s description of its practical limitations contrasts with repeatedassurancesfromtheObamaadministrationandintelligenceagencyleaders thatthecourtprovidescentralchecksandbalancesonthegovernment’sbroadspyingefforts.They have said thatAmericans should feel comfortable that the secretintelligence court provides robust oversight of government surveillance andprotectstheirprivacyfromrogueintrusions.

PresidentObamaandothergovernmentleadershaveemphasizedthecourt’soversight role in the wake of revelations this year that the government isvacuuming up “metadata” on Americans’ telephone and Internetcommunications.

“Wealsohavefederaljudgesthatwe’veputinplacewhoarenotsubjecttopolitical pressure,” Obama said at a news conference in June. “They’ve gotlifetime tenure as federal judges, and they’re empowered to look over ourshoulderat theexecutivebranchtomakesurethat theseprogramsaren’tbeingabused.”

Privacyadvocatesandothersingovernmenthavevoicedconcernsabouttheabilityofoverseerstopolicesecretprogramsofimmenselegalandtechnologicalcomplexity.Severalmembersof theHouseandSenate intelligencecommitteestold The Post last week that they face numerous obstacles and constraints inquestioningspyagencyofficialsabouttheirwork.

In 2009, for example, a Justice Department review uncovered a majoroperationalglitchthathadledtoaseriesofsignificantviolationsofthecourt’sorderandnotifiedthecourt,accordingtorecordsthatweredeclassifiedJuly31bytheOfficeoftheDirectorofNationalIntelligence.

The government described the problem as one of “over-collection” ofmetadatarecordsforU.S.phonecalls.

InSeptember2009,NSADirectorKeithB.AlexandermadeapresentationtotheFISAcourtabouttheagency’sefforttoremedytheproblem.

“FISACourt placed several restrictions on aspects of the business recordscollection program until the compliance processes were improved to its

satisfaction,”thememostated.The public summaries of the violations do not say how long the problem

went undetected and unreported to the court, or what information wasimproperlygatheredbytheagency’sautomatedcollectionsystems.

“The problems generally involved the implementation of highlysophisticated technology in a complex and ever-changing communicationsenvironmentwhich, insomeinstances, results in theautomated toolsoperatingin amanner thatwas not completely consistentwith the specific terms of theCourt’s orders,” according to unredacted portions of a December 2009memoprovidedtotheSenateandHouseintelligencecommittees.

Twopeoplefamiliarwiththe2009flawsaidthattheagencywascollectingmore“fields”ofinformationfromthecustomerrecordsoftelephonecompaniesthan thecourthadapproved.TheNSAdeclined toanswerquestionsabout theevent.

Oneseniorintelligenceofficial,whowasauthorizedbytheWhiteHousetospeak on the condition of anonymity, described the 2009 incident as a “majorevent”thatpromptedtheagencytodramaticallyincreaseitscompliancestaff.

“Weuncoveredsomedisconnectsbetweenusandouroverseers,disconnectsbetweenwhatwehadputindocumentation,thewaywehaddescribedthingsindocumentation,”theofficialsaid.

Althoughtheviolationwasunintentional,theofficialsaid,“itwasn’talwaystheeasiestofdiscussions”withthecourt.

The agency paused, “got ourselves with our overseers back into fairterritory,” and has since made “substantial improvement” in compliance, theofficialsaid.

Privacyadvocatessaytheyfearthatsomeviolationsareneverreportedtothecourt.

In January 2008, the NSA appeared to have mistakenly collected data onnumerousphonecalls from theWashingtonarea code202, thinking theywereforeignphonecallsfromEgypt,whosecountrycodeis20.Accordingtoa2013

“qualityassurance”reviewoftheincident,acommunicationsswitchmisreadthecodingof the calls andpresumed theywere international.TheNSAhasbroadauthority that is not subject to the FISA court to collect and monitor foreigncommunicationsundercertaincircumstances.

Thedescriptionofthe2008problemsuggeststhattheinadvertentcollectionofU.S.phonecallswasnotreportedtotheFISAcourt.

“However,theissuepertainedtoMetadataONLYsotherewerenodefectstoreport,”thereviewstated.

UnderFISArules,thegovernmentisrequiredtoimmediatelynotifythecourtifitbelievesithasviolatedanyofitsordersonsurveillance.

Thegovernmentdoesnottypicallyprovidethecourtwithcase-specificdetailaboutindividualcompliancecases,suchasthenamesofpeopleitlaterlearneditwasimproperlysearchinginitsmassivephoneore-maildatabases,accordingtothetwopeoplefamiliarwiththecourt’swork.

In contrast to the dozens of staff available to Congress’s intelligence andjudiciary committees, the FISA court has five lawyers to review complianceviolationreports.

Astafflawyercanelevateaconcernaboutasignificantcomplianceissuetoajudge on the court, according to a letter Walton recently sent to the Senatedescribingthecourt’srole.

Thecourtcanalwaysdemandandobtainmoredetailsaboutcases,butit isunclear how often that occurs. In the past, while grappling with rules forimplementing the surveillance programs, judges on the court have requested avisittoNSAheadquarterstoinspecttheoperations,theofficialssaid.

Lastweek, thepresident said thathe recognizes that someAmericansmaylacktrustintheoversightprocess—inwhichthesecretcourtapprovestherulesfor collecting Americans’ communications — and that he will work withCongressonreforms,whichcouldincludeaprivacyadvocatetothecourt.

“Inotherwords, it’snot enough formeaspresident tohave confidence inthese programs,” Obama said in his news conference. “The American people

needtohaveconfidenceinthem,aswell.”

BartonGellman,PeterWallstenandAliceCritescontributedtothisreport.

NSAgatheredthousandsofAmericans’e-mailsbeforecourtorderedittoreviseits

tactics

ByEllenNakashimaAugust21,2013

Sen.RonWyden(D-Ore.)got theOfficeof theDirectorofNational Intelligence toacknowledge inJuly2012that theNSA’ssurveillancehadat leastonceviolatedtheConstitution.(PhotobyMelinaMara/TheWashingtonPost)

For several years, the National Security Agency unlawfully gathered tens ofthousandsof e-mails andother electronic communicationsbetweenAmericansas part of a now-revised collection method, according to a 2011 secret courtopinion.

The redacted85-pageopinion,whichwasdeclassifiedbyU.S. intelligenceofficialsonWednesday,statesthat,basedonNSAestimates,thespyagencymayhave been collecting as many as 56,000 “wholly domestic” communicationseachyear.

In a strongly worded opinion, the chief judge of the Foreign IntelligenceSurveillance Court expressed consternation at what he saw as a pattern ofmisleading statements by the government and hinted that the NSA possiblyviolatedacriminallawagainstspyingonAmericans.

“For the first time, the government has now advised the court that thevolume and nature of the information it has been collecting is fundamentallydifferentfromwhatthecourthadbeenledtobelieve,”JohnD.Bates, thenthesurveillancecourt’schiefjudge,wroteinhisOct.3,2011,opinion.

The court, which meets in secret, oversees the Foreign IntelligenceSurveillanceAct, the lawauthorizingsuchsurveillance in theUnitedStates. Ithas been criticized by some as a “rubber stamp” for the government, but theopinionmakesclearthecourtdoesnotseeitselfthatway.

Bates’sfrustrationwiththegovernment’slackofcandorextendedbeyondtheprogramatissuetootherNSAsurveillanceefforts.

“The court is troubled that the government’s revelations regarding NSA’sacquisition of Internet transactions mark the third instance in less than threeyears in which the government has disclosed a substantial misrepresentationregarding the scopeof amajor collectionprogram,”Bateswrote in a scathingfootnote.

The Washington Post reported last week that the court had ruled thecollectionmethodunconstitutional.ThedeclassifiedopinionshedsnewlightonthevolumeofAmericans’communicationsthatwereobtainedbytheNSAand

the nature of the violations, as well as the FISA court’s interpretation of theprogram.

ThereleasemarksthefirsttimethegovernmenthasdisclosedaFISAcourtopinion in response toaFreedomof InformationAct lawsuit.The lawsuitwasbroughtayearagobytheElectronicFrontierFoundation,aprivacygroup.

“It’sunfortunate it tookayearof litigationandthemostsignificant leakinAmerican history to finally get them to release this opinion,” said foundationstaffattorneyMarkRumold,“butI’mhappythattheadministrationisbeginningtotakethisdebateseriously.”

The pressure to release the opinion was heightened by a series of recentrevelations about government surveillance based on documents leaked to TheWashingtonPost andBritain’sGuardiannewspaper by formerNSAcontractorEdwardSnowden.

Over the past 21 / 2 months, those revelations have reignited a nationaldebateon thebalancebetweenprivacy and security, andPresidentObamahaspromisedtoassuageconcernsaboutgovernmentoverreach,inpartthroughmoretransparency.

The document was released along with several others related to acontroversial collection program approved byCongress in 2008 under Section702oftheFISAAmendmentsAct.Throughthatprogram,theNSAmaytargetforcollectionthee-mailsandphonecallsofforeigners“reasonablybelieved”tobeoverseas.

Under Section 702, the NSA collects more than 250 million Internetcommunicationseachyear,theopinionsaid.Thevastmajority—91percent—areobtainedfromInternetproviderssuchasGoogle,YahooandAOLthroughaprogramcode-namedPRISM.

Atissueherewasthelessvoluminous“upstream”collectionthattakesplaceascommunicationsflowacrossInternethubs—notfromserviceproviderssuchas Google. Under that program, the NSA diverted international data passingthrough fiber-optic cables in the United States into a repository where the

material could be stored temporarily for processing and for the selection offoreigncommunications,ratherthandomesticones.Butinpractice,becauseoftechnological difficulties, the NSA was unable to filter out the “whollydomestic”communicationsbetweenAmericans.

OfficialsstressedthatitwastheNSAthatbroughtthecollectionmethodtothecourt’sattentionaspartofitsregularreportingprocess.“Thiswasnotinanyrespect an intentional or wholesale breach of privacy of American persons,”RobertS.LittIII,thegeneralcounselfortheOfficeoftheDirectorofNationalIntelligence,toldreportersWednesday.

Still, Bates noted that it was not until May 2011 — several years afterSection 702 was approved — that the NSA told the court that its upstreamcollectionofInternetcommunicationsmaycontainentireInternet“transactions”not related to the target. Inotherwords, the agencymaybe collecting e-mailsbetweentwoAmericansorpeopleinsidetheUnitedStatesinviolationofFISA.

InJune2011,theNSAinformedBatesthatanInternettransactionmaybeasingle communication or it may include “multiple discrete communications,”includingthosethatarenotto,fromoraboutatarget.Thatmeansinsteadofonee-mail, a stringofAmericans’e-mailscouldbe inadvertentlypickedup.“Thatrevelation fundamentally alters the Court’s understanding of the scope of thecollectionconductedpursuanttoSection702,”Batessaid.

“By expanding its Section 702 acquisitions to include the acquisition ofInternet transactions through its upstream collection, NSA has, as a practicalmatter, circumvented the spirit of [the law],” Bates wrote. “NSA’s knowingacquisitionoftensofthousandsofwhollydomesticcommunicationsthroughitsupstreamcollectionisacauseofconcernforthecourt.”

HeorderedthecollectiontostopuntiltheNSAcouldproposeanacceptableremedy. In November 2011, Bates signed an order approving the fix, whichincludedanewtechnicalmeanstosegregatetransactionsmostlikelytocontainU.S.persons’communicationsandreducingtheretentionperiodfromfivetotwoyears.

In April 2012, the NSA decided to conduct a purge of all upstream datacollectedsinceSection702’sinceptionin2008,seniorintelligenceofficialssaid.They could not estimate the quantity, but one official said it was “lots.” Saidanother:“Itwouldhavebeeneverything.”

ThenewlyreleasedopinionalsoreflectsBates’sfrustrationwiththecourt’sinability to independentlyverify theNSA’sassertions,asentimentunderscoredin a recent statementmade to The Post by the current chief judge,ReggieB.Walton.

Because of the “sheer volume” of transactions acquired by theNSA, “anymeaningfulreviewoftheentirebodyofthetransactions”wasnotfeasible,Bateswrote. “As a result, the court cannot know for certain the exact number” ofwhollydomesticcommunicationsbutwasreliantontheNSA’ssamplesofdata.“Even if the court accepts the validity of conclusions derived from statisticalanalyses, therearesignificanthurdles inassessingNSA’supstreamcollection,”hewrote.

Healsostatedinafootnotethatthegovernment’srevelationsaboutthescopeof the NSA’s upstream collection “implicate” a law that criminalizesunauthorizedelectronicsurveillance.Hesaidthathewouldaddressthatissueinaseparateorder.

In another footnote, he alsonoted that inMarch2009 the court concludedthat its authorization of the NSA’s bulk collection of Americans’ phone-callrecordswas“premisedonaflaweddepictionofhowtheNSA”usesthedata.Healsowrote: “Thismisperception by theFISC existed from the inception of itsauthorizedcollectioninMay2006,buttressedbyrepeatedinaccuratestatementsmade in the government’s submissions, anddespite a government-devised andcourt-mandatedoversightregime.”

In that program, which was disclosed through a document leaked bySnowdentotheGuardian,theNSAamassesadatabaseofhundredsofmillionsof Americans’ phone-call records. That includes numbers dialed and the timeanddurationofcalls—alsoknownasmetadata—butnocontent.

Bates continued: “Contrary to the government’s repeated assurances,NSAhadbeenroutinelyrunningqueriesofthemetadatausingqueryingtermsthatdidnotmeet the required standard. . . . TheCourt concluded that this requirementhadbeen‘sofrequentlyandsystematicallyviolatedthatitcanfairlybesaidthatthiscriticalelementoftheoverall. . .regimehasneverfunctionedeffectively.’ ”

TheElectronicFrontierFoundationsuedafterSen.RonWyden(D-Ore.)gottheOfficeoftheDirectorofNationalIntelligencetoacknowledgeinJuly2012thattheNSA’ssurveillancehadatleastonceviolatedtheConstitution.

“TheFISACourthasnotedthatthiscollectionviolatesthespiritofthelaw,butthegovernmenthasfailedtoaddressthisconcerninthetwoyearssincethisruling was issued,” Wyden said Wednesday. “This ruling makes it clear thatFISA Section 702, as written, is insufficient to adequately protect the civillibertiesandprivacyrightsoflaw-abidingAmericansandshouldbereformed.”

U.S.spynetwork’ssuccesses,failuresandobjectivesdetailedin‘blackbudget’

summary

ByBartonGellmanandGregMillerAugust29,2013

U.S.spyagencieshavebuiltanintelligence-gatheringcolossussincetheattacksof Sept. 11, 2001, but remain unable to provide critical information to thepresidentonarangeofnationalsecuritythreats,accordingtothegovernment’stop-secretbudget.

The $52.6 billion “black budget” for fiscal 2013, obtained by TheWashingtonPostfromformerintelligencecontractorEdwardSnowden,mapsabureaucratic and operational landscape that has never been subject to publicscrutiny. Although the government has annually released its overall level ofintelligencespendingsince2007, ithasnotdivulgedhowituses themoneyorhowitperformsagainstthegoalssetbythepresidentandCongress.

The178-pagebudgetsummaryfortheNationalIntelligenceProgramdetailsthe successes, failures andobjectives of the 16 spy agencies thatmakeup theU.S.intelligencecommunity,whichhas107,035employees.

The summary describes cutting-edge technologies, agent recruiting andongoingoperations.ThePostiswithholdingsomeinformationafterconsultationwithU.S.officialswhoexpressedconcernsabouttherisktointelligencesourcesandmethods.SensitivedetailsaresopervasiveinthedocumentsthatThePostispublishingonlysummarytablesandchartsonline.

“TheUnitedStates hasmade a considerable investment in the IntelligenceCommunitysincetheterrorattacksof9/11,atimewhichincludeswarsinIraqand Afghanistan, the Arab Spring, the proliferation of weapons of massdestructiontechnology,andasymmetricthreatsinsuchareasascyber-warfare,”Director of National IntelligenceJames R. Clapper Jr. wrote in response toinquiriesfromThePost.

“Our budgets are classified as they could provide insight for foreignintelligence services to discern our top national priorities, capabilities andsourcesandmethodsthatallowustoobtaininformationtocounterthreats,”hesaid.

Amongthenotablerevelationsinthebudgetsummary:

SpendingbytheCIAhassurgedpastthatofeveryotherspyagency,with$14.7 billion in requested funding for 2013. The figure vastly exceedsoutside estimates and is nearly 50 percent above that of the NationalSecurityAgency,whichconductseavesdroppingoperationsandhas longbeenconsideredthebehemothofthecommunity.The CIA and the NSA have begun aggressive new efforts to hack intoforeign computer networks to steal information or sabotage enemysystems, embracing what the budget refers to as “offensive cyberoperations.”Long before Snowden’s leaks, the U.S. intelligence community worriedabout“anomalousbehavior”byemployeesandcontractorswithaccesstoclassified material. The NSA planned to ward off a “potential insidercompromise of sensitive information” by reinvestigating at least 4,000peoplethisyearwhoholdhigh-levelsecurityclearances.U.S.intelligenceofficialstakeanactiveinterestinfriendsaswellasfoes.Pakistan is described in detail as an “intractable target,” andcounterintelligence operations “are strategically focused against [the]priority targets of China, Russia, Iran, Cuba and Israel.” The latter is aU.S.allybuthasahistoryofespionageattemptsagainsttheUnitedStates.In words, deeds and dollars, intelligence agencies remain fixed on

terrorism as the gravest threat to national security, which is listed firstamongfive“missionobjectives.”Counterterrorismprogramsemployoneinfourmembersoftheintelligenceworkforceandaccountforone-thirdoftheintelligenceprogram’sspending.ThegovernmentsofIran,ChinaandRussiaaredifficult topenetrate,butNorthKorea’smaybe themostopaque.Thereare five“critical”gaps inU.S. intelligence about Pyongyang’s nuclear and missile programs, andanalysts know virtually nothing about the intentions of North KoreanleaderKimJongUn.

Formallyknownas theCongressionalBudget Justification for theNationalIntelligence Program, the “top-secret” blueprint represents spending levelsproposed to the House and Senate intelligence committees in February 2012.CongressmayhavemadechangesbeforethefiscalyearbeganonOct1.ClapperisexpectedtoreleasetheactualtotalspendingfigureafterthefiscalyearendsonSept.30.

Thedocumentdescribesaconstellationofspyagenciesthattrackmillionsofsurveillance targets and carry out operations that include hundreds of lethalstrikes.Theyareorganizedaroundfivepriorities:combatingterrorism,stoppingthespreadofnuclearandotherunconventionalweapons,warningU.S. leadersabout critical events overseas, defending against foreign espionage, andconductingcyber-operations.

Inanintroduction,ClappersaidthethreatsfacingtheUnitedStates“virtuallydefyrank-ordering.”Hewarnedof“hardchoices”astheintelligencecommunity—sometimesreferredtoasthe“IC”—seekstoreininspendingafteradecadeofoftendouble-digitbudgetincreases.

The current budget proposal envisions that spending will remain roughlylevelthrough2017andamountstoacaseagainstsubstantialcuts.

“NeverbeforehastheICbeencalledupontomastersuchcomplexityandsomanyissuesinsucharesource-constrainedenvironment,”Clapperwrote.

AnespionageempireThe summary provides a detailed look at how the U.S. intelligence

community has been reconfigured by the massive infusion of resources thatfollowed the2001attacks.TheUnitedStateshasspentmore than$500billiononintelligenceduringthatperiod,anoutlaythatU.S.officialssayhassucceededin its main objective: preventing another catastrophic terrorist attack in theUnitedStates.

Theresultisanespionageempirewithresourcesandareachbeyondthoseofanyadversary,sustainedevennowbyspendingthatrivalsorexceedsthelevelsattheheightoftheColdWar.

Thecurrenttotalbudgetrequestwas2.4percentbelowthatoffiscal2012.Inconstantdollars,itwasabouttwicetheestimatedsizeofthe2001budgetand25percentabovethatof2006,fiveyearsintowhatwasthenknownasthe“globalwaronterror.”

HistoricaldataonU.S.intelligencespendingislargelynonexistent.Throughextrapolation,expertshaveestimatedthatColdWarspendingprobablypeakedinthelate1980satanamountthatwouldbetheequivalentof$71billiontoday.

Spendinginthemostrecentcyclesurpassedthatamount,basedonthe$52.6billiondetailed indocumentsobtainedbyThePostplus a separate$23billiondevotedtointelligenceprogramsthatmoredirectlysupporttheU.S.military.

LeeH.Hamilton,anIndianaDemocratwhochaired theHouseIntelligenceCommitteeandco-chairedthecommissionthatinvestigatedtheSept.11attacks,said that access to budget details will enable an informed public debate onintelligencespendingforthefirsttime,muchasSnowden’sdisclosuresofNSAsurveillanceprogramsbroughtattentiontooperationsthathadassembleddataonnearlyeveryU.S.citizen.

“Much of the work that the intelligence community does has a profoundimpact on the life of ordinary Americans, and they ought not to be excludedfromtheprocess,”Hamiltonsaid.

“Nobodyisarguingthatweshouldbesotransparentastocreatedangersfor

thecountry,”hesaid.But,headded,“thereisamind-setinthenationalsecuritycommunity:‘Leaveittous,wecanhandleit,theAmericanpeoplehavetotrustus.’Theycarryittoquiteanextraordinarylengthsothattheyhaveresistedovera period of decades transparency. . . . The burden of persuasion as to keepingsomethingsecretshouldbeontheintelligencecommunity,theburdenshouldnotbeontheAmericanpublic.”

Expertssaid thataccess tosuchdetailsaboutU.S.spyprogramsiswithoutprecedent.

“Itwasatitanicstrugglejusttogetthetop-linebudgetnumberdisclosed,andthat has only been done consistently since 2007,” said Steven Aftergood, anexpert at the Federation of American Scientists, a Washington-basedorganizationthatprovidesanalysesofnationalsecurityissues.“Butarealgraspof the structureandoperationsof the intelligencebureaucracyhasbeen totallybeyondpublicreach.Thiskindofmaterial,evenonahistoricalbasis,hassimplynotbeenavailable.”

Theonlymeaningfulframeofreferencecamein1994,whenacongressionalsubcommittee inadvertently published a partial breakdown of the NationalIntelligenceProgram.At the time, theCIAaccounted for just$4.8billionofabudget that totaled $43.4 billion in 2012 dollars. The NSA and the NationalReconnaissanceOffice,whichoperatessatellitesandothersensors,commandedfar larger shares of U.S. intelligence budgets until years after the Cold Warended.

Duringthepastdecade,theyhavetakenabackseattotheCIA.TheNSAwasinlinetoreceive$10.5billionin2013,andtheNROwasto

get $10.3 billion — both far below the CIA, whose share had surged to 28percentofthetotalbudget.

Overall, the U.S. government spends 10 times as much on the DefenseDepartmentasitdoesonspyagencies.

“Today’s world is as fluid and unstable as it has been in the past halfcentury,” Clapper said in his statement to The Post. “Even with stepped up

spendingontheICoverthepastdecade,theUnitedStatescurrentlyspendslessthanonepercentofGDPontheIntelligenceCommunity.”

DominantpositionTheCIA’sdominantpositionislikelytostunoutsideexperts.Itrepresentsa

remarkable recovery for an agency that seemed poised to lose power andprestigeafteracknowledgingintelligencefailuresleadinguptothe2001attacksandthe2003U.S.-ledinvasionofIraq.

Thesurgeinresourcesfortheagencyfundedsecretprisons,acontroversialinterrogationprogram,thedeploymentoflethaldronesandahugeexpansionofits counterterrorism center. The agency was transformed from a spy servicestrugglingtoemergefromtheColdWarintoaparamilitaryforce.

The CIA has devoted billions of dollars to recruiting and training a newgeneration of case officers, with the workforce growing from about 17,000 adecadeagoto21,575thisyear.

Theagency’sbudgetallocates$2.3billionforhumanintelligenceoperationsand$2.5billiontocoverthecostofsupportingthesecurity,logisticsandotherneeds of those missions around the world. A relatively small amount of thattotal, $68.6million, was earmarked for creating andmaintaining “cover,” thefalseidentitiesemployedbyoperativesoverseas.

ThereisnospecificentryfortheCIA’sfleetofarmeddronesinthebudgetsummary,butabroadlineitemhintsatthedimensionsoftheagency’sexpandedparamilitaryrole,providingmorethan$2.6billionfor“covertactionprograms”thatwouldincludedroneoperationsinPakistanandYemen,paymentstomilitiasinAfghanistanandAfrica,andattemptstosabotageIran’snuclearprogram.

Theblackbudgetilluminatesforthefirsttimetheintelligenceburdenofthewars in Afghanistan and Iraq. For 2013, U.S. spy agencies were projected tospend$4.9billionon“overseascontingencyoperations.”TheCIAaccountedforabouthalfofthatfigure,asumfactoredintoitsoverall$14.7billionbudget.

Those war expenditures are projected to shrink as the United Stateswithdraws forces from Afghanistan. The budget also indicates that theintelligencecommunityhascutthenumberofcontractorsithiresoverthepastfiveyearsbyabout30percent.

CriticalgapsDespite the vast outlays, the budget blueprint catalogues persistent and in

somecasescriticalblindspots.Throughout thedocument,U.S.spyagenciesattempttorate theirefforts in

tables akin to report cards, generally citing progress but often acknowledgingthat only a fraction of their questions could be answered — even on thecommunity’sforemostpriority,counterterrorism.

In 2011, the budget assessment says intelligence agencies made at least“moderateprogress”on38oftheir50topcounterterrorismgaps,thetermusedto describe blind spots. Several concern Lebanon’s Hezbollah movement, anenemyofIsraelthathasnotattackedU.S.interestsdirectlysincethe1990s.

OtherblankspotsincludequestionsaboutthesecurityofPakistan’snuclearcomponentswhen they are being transported, the capabilities ofChina’s next-generation fighter aircraft, and howRussia’s government leaders are likely torespond to “potentially destabilizing events inMoscow, such as large protestsandterroristattacks.”

Achartoutliningeffortstoaddresskeyquestionsonbiologicalandchemicalweapons is particularly bleak. U.S. agencies set annual goals for at least fivecategories of intelligence collection related to these weapons. In 2011, theagenciesmadeheadwayonjusttwogaps;ayearearlier,themarkwaszero.

The documents describe expanded efforts to “collect on Russian chemicalwarfare countermeasures” and assess the security of biological and chemicallaboratoriesinPakistan.

Atableof“critical”gapslistedfiveforNorthKorea,morethanforanyother

countrythathaspursuedorispursuinganuclearbomb.Theintelligencecommunityseemsparticularlydauntedbytheemergenceof

“homegrown” terrorists who plan attacks in the United States without directsupport or instruction fromabroad, a threat realized thisyear, after thebudgetwassubmitted,intwinbombingsattheBostonMarathon.

TheNationalCounterterrorismCenterhasconveneddozensofanalystsfromother agencies in attempts to identify “indicators” that could help lawenforcementofficialsunderstandthepathfromreligiousextremismtoviolence.The FBI was in line for funding to increase the number of agents whosurreptitiouslytrackactivityonjihadistWebsites.

ButayearbeforethebombingsinBoston,thesearchformeaningfulinsightintothestagesofradicalizationwasdescribedasoneof the“morechallengingintelligencegaps.”

High-techsurveillanceThedocumentsmakeclearthatU.S.spyagencies’long-standingrelianceon

technology remains intact. If anything, their dependence on high-techsurveillancesystemstofillgapsinhumanintelligencehasintensified.

A section on North Korea indicates that the United States has all butsurrounded the nuclear-armed country with surveillance platforms. Distantgroundsensorsmonitorseismicactivityandscanthecountryforsignsthatmightpointtoconstructionofnewnuclearsites.U.S.agenciesseektocapturephotos,airsamplesandinfraredimagery“aroundtheclock.”

InIran,newsurveillancetechniquesandtechnologieshaveenabledanalyststoidentifysuspectednuclearsitesthathadnotbeendetectedinsatelliteimages,accordingtothedocument.

In Syria, NSA listening posts were able to monitor unencryptedcommunications among senior military officials at the outset of the civil warthere, a vulnerability that President Bashar al-Assad’s forces apparently later

recognized.OneoftheNRO’sfunctionsistoextractdatafromsensorsplacedonthegroundnearsuspectedillicitweaponssitesinSyriaandothercountries.

Across this catalogue of technical prowess, one category is depicted asparticularlyindispensable:signalsintelligence,orSIGINT.

The NSA’s ability to monitor e-mails, phone calls and Internet traffic hascomeundernewscrutinyinrecentmonthsasaresultofdisclosuresbySnowden,whoworkedasacontractcomputerspecialistfortheagencybeforestockpilingsecretdocumentsandthenfleeing,firsttoHongKongandthenMoscow.

TheNSAwasprojectedtospend$48.6milliononresearchprojectstoassistin“copingwithinformationoverload,”anoccupationalhazardasthevolumesofintakehaveincreasedsharplyfromfiber-opticcablesandSiliconValleyInternetproviders.

Theagency’sabilitytomonitorthecommunicationsofal-Qaedaoperativesisdescribedinthedocumentsas“oftenthebestandonlymeanstocompromiseseeminglyintractabletargets.”

Signals intercepts also have been used to direct the flight paths of drones,gather clues to the composition of North Korea’s leadership and evaluate theresponse plans of Russia’s government in the event of a terrorist attack inMoscow.

Theresourcesdevotedtosignalsinterceptsareextraordinary.Nearly35,000employeesarelistedunderacategorycalledtheConsolidated

CryptologicProgram,which includes theNSAaswell as the surveillance andcode-breakingcomponentsoftheAirForce,Army,NavyandMarines.

TheNSA is planning high-risk covertmissions, a lesser-known part of itswork, to plant what it calls “tailored radio frequency solutions” — close-insensorstointerceptcommunicationsthatdonotpassthroughglobalnetworks.

Even the CIA devotes $1.7 billion, or nearly 12 percent of its budget, totechnical collection efforts, including a joint program with the NSA called“CLANSIG,”acovertprogramtointerceptradioandtelephonecommunicationsfromhostileterritory.

Theagencyalsoispursuingtrackingsystems“thatminimizeoreliminatetheneed for physical access and enable deep concealment operations against hardtargets.”

TheCIAhasdeployednewbiometric sensors to confirm the identities andlocationsofal-Qaedaoperatives.Thesystemhasbeenused in theCIA’sdronecampaign.

Spendingonsatellitesystemsandalmosteveryothercategoryofcollectionis projected to shrink or remain stagnant in coming years, as Washingtongrapples with budget cuts across the government. But the 2013 intelligencebudgetcalledforincreasedinvestmentinSIGINT.

CounterintelligenceThe budget includes a lengthy section on funding for counterintelligence

programs designed to protect against the danger posed by foreign intelligenceservicesaswellasbetrayalsfromwithintheU.S.spyranks.

The document describes programs to “mitigate insider threats by trustedinsiderswhoseek toexploit theirauthorizedaccess to sensitive information toharmU.S.interests.”

Theagencieshadbudgetedforamajorcounterintelligenceinitiativeinfiscal2012, but most of those resources were diverted to an all-hands emergencyresponse to successive floods of classified data released by the anti-secrecygroupWikiLeaks.

For this year, the budget promised a renewed “focus . . . on safeguardingclassifiednetworks”andastrict“reviewofhigh-risk,high-gainapplicantsandcontractors”— the young, nontraditional computer coders with the skills theNSAneeded.

AmongthemwasSnowden,thena29-year-oldcontractcomputerspecialistwhom the NSA trained to circumvent computer network security. He was

copyingthousandsofhighlyclassifieddocumentsatanNSAfacilityinHawaii,andpreparingtoleakthem,astheagencyembarkedonthenewsecuritysweep.

“NSAwillinitiateaminimumof4,000periodicreinvestigationsofpotentialinsidercompromiseofsensitiveinformation,”accordingtothebudget,scanningitssystemsfor“anomaliesandalerts.”

JulieTatecontributedtothisreport.

AdditionalContent:Insidethe2013U.S.intelligence‘blackbudget’

TheBlackBudget:TopSecretU.S.IntelligenceFundingAmerica’ssecretintelligencebudget,in11(nay13)charts

2013U.S.intelligencebudget:additionalresources

NSApayingU.S.companiesforaccesstocommunicationsnetworks

ByCraigTimbergandBartonGellmanAugust29,2013

TheNationalSecurityAgencyispayinghundredsofmillionsofdollarsayeartoU.S. companies for clandestine access to their communications networks,filtering vast traffic flows for foreign targets in a process that also sweeps inlargevolumesofAmericantelephonecalls,e-mailsandinstantmessages.

The bulk of the spending, detailed in a multi-volume intelligence budgetobtained by TheWashington Post, goes to participants in a Corporate PartnerAccess Project for major U.S. telecommunications providers. The documentsopen an important window into surveillance operations on U.S. territory thathave been the subject of debate since they were revealed by The Post andBritain’sGuardiannewspaperinJune.

New details of the corporate-partner project, which falls under the NSA’sSpecial Source Operations, confirm that the agency taps into “high volumecircuit andpacket-switchednetworks,” according to the spendingblueprint forfiscal2013.Theprogramwasexpectedtocost$278millioninthecurrentfiscalyear,downnearlyone-thirdfromitspeakof$394millionin2011.

Voluntary cooperation from the “backbone” providers of globalcommunicationsdatestothe1970sunderthecovernameBLARNEY,accordingto documents provided by former NSA contractor Edward Snowden. Theserelationships longpredate thePRISMprogramdisclosed in June, underwhich

AmericantechnologycompanieshandovercustomerdataafterreceivingordersfromtheForeignIntelligenceSurveillanceCourt.

Inbriefingslides, theNSAdescribedBLARNEYand threeothercorporateprojects—OAKSTAR,FAIRVIEWandSTORMBREW—undertheheadingof“passive”or“upstream”collection.Theycapturedataastheymoveacrossfiber-opticcablesandthegatewaysthatdirectglobalcommunicationstraffic.

Thedocumentsofferarareviewofasecretsurveillanceeconomyinwhichgovernmentofficialssetfinancialtermsforprogramscapableofpeeringintothelivesofalmostanyonewhousesaphone,computerorotherdeviceconnectedtotheInternet.

Although the companies are required to comply with lawful surveillanceorders, privacy advocates say themultimillion-dollar payments could create aprofitmotivetooffermorethantherequiredassistance.

“It turns surveillance into a revenue stream, and that’s not the way it’ssupposed towork,” saidMarcRotenberg, executive director of the ElectronicPrivacy InformationCenter,aWashington-based researchandadvocacygroup.“Thefact that thegovernmentispayingmoneytotelephonecompaniestoturnoverinformationthattheyarecompelledtoturnoverisverytroubling.”

Verizon,AT&Tandothermajortelecommunicationscompaniesdeclinedtocomment for this article, although several industry officials noted thatgovernmentsurveillancelawsexplicitlycallforcompaniestoreceivereasonablereimbursementfortheircosts.

Previousnewsreportshavemadeclearthatcompaniesfrequentlyseeksuchpayments,butneverbeforehastheiroverallscalebeendisclosed.

The budget documents do not list individual companies, although they dobreakdownspendingamongseveralNSAprograms,listedbytheircodenames.

ThereisnorecordinthedocumentsobtainedbyThePostofmoneysetasideto pay technology companies that provide information to the NSA’s PRISMprogram.Thatprogram is the sourceof91percentof the250million Internetcommunications collected throughSection 702 of theFISAAmendmentsAct,

which authorizes PRISM and the upstream programs, according to an 2011opinionandorderbytheForeignIntelligenceSurveillanceCourt.

Several of the companies that provide information to PRISM, includingApple,FacebookandGoogle,saytheytakenopaymentsfromthegovernmentwhen they comply with national security requests. Others say they do takepaymentsinsomecircumstances.TheGuardianreportedlastweekthattheNSAhad covered “millions of dollars” in costs that some technology companiesincurredtocomplywithgovernmentdemandsforinformation.

Telecommunications companies generally do charge to comply withsurveillancerequests,whichcomefromstate,localandfederallawenforcementofficialsaswellasintelligenceagencies.

Former telecommunications executive Paul Kouroupas, a security officerwhoworkedatGlobalCrossingfor12years,saidthatsomecompanieswelcomethe revenue and enter into contracts in which the government makes higherpayments than otherwise available to firms receiving re imbursement forcomplyingwithsurveillanceorders.

These contractual payments, he said, could cover the cost of buying andinstalling new equipment, along with a reasonable profit. These voluntaryagreementssimplifythegovernment’saccesstosurveillance,hesaid.

“Itcertainlylubricatesthe[surveillance]infrastructure,”Kouroupassaid.HedeclinedtosaywhetherGlobalCrossing,whichoperatedafiber-opticnetworkspanning several continents and was bought by Level 3 Communications in2011,hadsuchacontract.AspokesmanforLevel3Communicationsdeclinedtocomment.

In response to questions in 2012 from then-Rep. Edward J. Markey (D-Mass.), who was elected to the Senate in June, several telecommunicationscompanies detailed their prices for surveillance services to law enforcementagenciesunderindividualwarrantsandsubpoenas.AT&T,forexample,reportedthatitcharges$325toactivatesurveillanceofanaccountandalsoadailyrateof$5or $10, dependingon the informationgathered.For providing the numbers

that have accessed cell towers,meanwhile,AT&T charged $75 per tower, thecompanysaidinaletter.

Nopaymentshavebeenpreviouslydisclosedformasssurveillanceaccesstotrafficflowingacrossacompany’sinfrastructure.

Lawyer Albert Gidari Jr., a partner at Perkins Coie who representstechnologyandtelecommunicationscompanies,saidthatsurveillanceeffortsareexpensive,requiringteamsofattorneystosiftthroughrequestsandexecutetheonesdeemed reasonable.Government agencies,meanwhile, sometimesbalk atpayingthefullcostsincurredbycompanies

“They lose a ton ofmoney,”Gidari said. “And yet the government is stillunsatisfiedwithit.”

The budget documents obtained by The Post list $65.96 million forBLARNEY,$94.74million forFAIRVIEW,$46.04million forSTORMBREWand $9.41 million for OAKSTAR. It is unclear why the total of these fourprogramsamountstolessthantheoverallbudgetof$278million.

Amongthepossiblecostscoveredbytheseamountsare“networkandcircuitleases, equipment hardware and software maintenance, secure networkconnectivity, and covert site leases,” the documents say. They also list in aseparate line item $56.6 million in payments for “Foreign Partner Access,”although it is not clear whether these are for foreign companies, foreigngovernmentsorotherforeignentities.

Some privacy advocates favor payments to companies when they complywith surveillance efforts because the costs can be a brake on overly broadrequestsbygovernmentofficials.Invoicesalsocanprovideapapertrailtohelpexposetheextentofspying.

Butifthepaymentsaretoohigh,theymaypersuadecompaniestogobeyondlegalrequirementsinprovidinginformation,saidChrisSoghoian,atechnologyexpert with the American Civil Liberties Union who has studied governmentpaymentsrelatedtosurveillancerequests.

“I’mworriedthatthechecksmightgreasethewheelsalittlebit,”hesaid.

TohuntOsamabinLaden,satelliteswatchedoverAbbottabad,Pakistan,and

NavySEALs

ByCraigWhitlockandBartonGellmanAugust29,2013

TheU.S.commandoraidthatkilledOsamabinLadenwasguidedfromspacebyafleetofsatellites,whichaimeddozensof receiversoverPakistan tocollectatorrentofelectronicandsignalsintelligenceasthemissionunfolded,accordingtoatop-secretU.S.intelligencedocument.

The National Security Agency also was able to penetrate guardedcommunications among al-Qaeda operatives by tracking calls from mobilephones identified by specific calling patterns, the document shows. AnalystsfromtheCIApinpointedthegeographiclocationofoneofthephonesandlinkedittothecompoundinAbbottabad,Pakistan,whereotherevidencesuggestedbinLadenwashiding.

The disclosures about the hunt for the elusive founder of al-Qaeda arecontainedinclassifieddocumentsthatdetailthefiscal2013“blackbudget”forU.S. intelligence agencies, including the NSA and the CIA. The documents,providedtoTheWashingtonPostbyformerNSAcontractorEdwardSnowden,make only brief references to the bin Laden operation. But the mission isportrayedasasingularexampleofcounterterrorismcooperationamongtheU.S.government’snumerousintelligenceagencies.

Eighthoursaftertheraid,accordingtothedocuments,aforensicintelligencelaboratoryrunbytheDefenseIntelligenceAgencyinAfghanistanhadanalyzedDNA from binLaden’s corpse and “provided a conclusivematch” confirminghis identity.Thebudget further reveals that satellites operatedby theNationalReconnaissanceOffice performedmore than 387 “collects” of high-resolutionand infrared imagesof theAbbottabadcompound in themonthbefore theraid—intelligencethatwas“criticaltoprepareforthemissionandcontributedtothedecisiontoapproveexecution.”

Also playing a role in the search for bin Laden was an arm of the NSAknown as the Tailored Access Operations group. Among other functions, thegroup specializes in surreptitiously installing spyware and tracking devices ontargetedcomputersandmobile-phonenetworks.

Althoughthebudgetdoesnotprovidedetail, itreportsthatTailoredAccessOperations “implants” enabled the NSA to collect intelligence from mobilephonesthatwereusedbyal-Qaedaoperativesandother“personsofinterest”inthehuntforbinLaden.

Separately,TailoredAccessOperationscapabilitieswereusedinApril2011,themonthbeforebinLadenwaskilled,whenU.S.forcesinAfghanistanreliedon signals intelligence from implants to capture 40 low-andmid-levelTalibanfightersandotherinsurgentsinthatcountry,accordingtothedocuments.

ThenewdetailsabouttheraidfilloutanalreadyrichpublicaccountofhowtheU.S.governmentemployedvirtuallyeverytoolinitsenormoussurveillanceapparatus to locatebinLaden.Formorethanadecade,binLadenhadstymiedalleffortstofindhimbymakingcertainhedidnotleaveadirectelectronictrail.He steadfastly avoided phones and e-mail, relying on face-to-facecommunicationswithafewcouriersandmiddlemen.

Inadditiontothesatellites,thegovernmentflewanadvancedstealthdrone,theRQ-170, over Pakistan to eavesdrop on electronic transmissions. TheCIAalsorecruitedaPakistanidoctorandotherpublichealthworkerstotrytoobtainblood samples from people living in the Abbottabad compound as part of a

vaccinationprogramtodeterminewhethertheresidentsmightberelatedtobinLaden.

ThatdoctorwasconvictedbyaPakistanicourtinMay2012of“conspiringagainstthestate.”AseniorjudicialofficialonThursdayoverturnedthe33-yearprisonsentenceforShakilAfridiontechnicalgroundsandorderedaretrial.

Foralltheirtechnologicalprowess,U.S.spyagencieswereunabletoidentifybin Laden with confidence inside the Abbottabad compound. By the timePresidentObamaorderedateamofNavySEALstostormthesiteinMay2011,U.S.intelligenceofficialstoldthepresidentthat,accordingtotheirbestguesses,theoddsthatbinLadenwaspresentwere40percentto60percent.

Even after bin Laden’s death, the U.S. government kept up its relentlesshigh-techcampaigntounlockhissecrets.

Budget documents show that intelligence agencies scraped together $2.5million in emergency money in September 2011 to sift through a backlog ofcomputer files and other evidence recovered from bin Laden’s hideout. Themoney went to buy 36 computer workstations and pay overtime to forensicexaminers,linguistsand“triagepersonnel”involvedintheproject.

U.S.spyagenciesmounted231offensivecyber-operationsin2011,documentsshow

ByBartonGellmanandEllenNakashimaAugust30,2013

U.S.intelligenceservicescarriedout231offensivecyber-operationsin2011,theleadingedgeofaclandestinecampaignthatembracestheInternetasatheaterofspying, sabotage andwar, according to top-secret documents obtained byTheWashingtonPost.

Thatdisclosure, inaclassified intelligencebudgetprovidedbyNSAleakerEdward Snowden, provides new evidence that the Obama administration’sgrowingranksofcyberwarriorsinfiltrateanddisruptforeigncomputernetworks.

Additionally,underanextensiveeffortcode-namedGENIE,U.S.computerspecialistsbreakintoforeignnetworkssothattheycanbeputundersurreptitiousU.S.control.Budgetdocumentssaythe$652millionprojecthasplaced“covertimplants,” sophisticated malware transmitted from far away, in computers,routersandfirewallsontensofthousandsofmachineseveryyear,withplanstoexpandthosenumbersintothemillions.

The documents provided by Snowden and interviews with former U.S.officialsdescribeacampaignofcomputerintrusionsthatisfarbroaderandmoreaggressivethanpreviouslyunderstood.TheObamaadministrationtreatsallsuchcyber-operationsasclandestineanddeclinestoacknowledgethem.

Thescopeandscaleofoffensiveoperationsrepresentanevolutioninpolicy,which in the past sought to preserve an international norm against acts of

aggression in cyberspace, in part because U.S. economic and military powerdependsoheavilyoncomputers.

“Thepolicydebatehasmovedsothatoffensiveoptionsaremoreprominentnow,” said former deputy defense secretaryWilliam J. Lynn III, who has notseenthebudgetdocumentandwasspeakinggenerally.“Ithinkthere’smoreofacase made now that offensive cyberoptions can be an important element indeterringcertainadversaries.”

Of the231offensiveoperationsconducted in2011, thebudget said,nearlythree-quarters were against top-priority targets, which former officials sayincludesadversariessuchasIran,Russia,ChinaandNorthKoreaandactivitiessuchasnuclearproliferation.Thedocumentprovidedfewotherdetailsabouttheoperations.

Stuxnet, a computer worm reportedly developed by the United States andIsraelthatdestroyedIraniannuclearcentrifugesinattacksin2009and2010,isoften cited as themost dramatic use of a cyberweapon. Experts said no otherknowncyberattackscarriedoutbytheUnitedStatesmatchthephysicaldamageinflictedinthatcase.

U.S. agencies define offensive cyber-operations as activities intended “tomanipulate,disrupt,deny,degrade,ordestroyinformationresidentincomputersorcomputernetworks,orthecomputersandnetworksthemselves,”accordingtoapresidentialdirectiveissuedinOctober2012.

Mostoffensiveoperationshaveimmediateeffectsonlyondataortheproperfunctioningof an adversary’smachine: slowing its network connection, fillingitsscreenwithstaticorscramblingtheresultsofbasiccalculations.Anyofthosecouldhavepowerfuleffectsiftheycausedanadversarytobotchthetimingofanattack,losecontrolofacomputerormiscalculatelocations.

U.S. intelligence services are making routine use around the world ofgovernment-built malware that differs little in function from the “advancedpersistentthreats”thatU.S.officialsattributetoChina.Theprincipaldifference,

U.S. officials told The Post, is that China steals U.S. corporate secrets forfinancialgain.

“The Department of Defense does engage” in computer networkexploitation, according to an e-mailed statement from an NSA spokesman,whose agency is part of the Defense Department. “The department does***not***engageineconomicespionageinanydomain,includingcyber.”

‘Millionsofimplants’The administration’s cyber-operations sometimes involve what one budget

document calls “field operations” abroad, commonly with the help of CIAoperativesorclandestinemilitaryforces,“tophysicallyplacehardwareimplantsorsoftwaremodifications.”

Muchmoreoften,animplantiscodedentirelyinsoftwarebyanNSAgroupcalled Tailored Access Operations (TAO). As its name suggests, TAO buildsattacktoolsthatarecustom-fittedtotheirtargets.

The NSA unit’s software engineers would rather tap into networks thanindividualcomputersbecausethereareusuallymanydevicesoneachnetwork.TailoredAccessOperationshassoftwaretemplatestobreakintocommonbrandsand models of “routers, switches and firewalls from multiple product vendorlines,”accordingtoonedocumentdescribingitswork.

TheimplantsthatTAOcreatesareintendedtopersist throughsoftwareandequipmentupgrades,tocopystoreddata,“harvest”communicationsandtunnelintootherconnectednetworks.ThisyearTAOisworkingonimplantsthat“canidentify select voice conversations of interest within a target network andexfiltrateselectcuts,”orexcerpts,according toonebudgetdocument. Insomecases,asinglecompromiseddeviceopensthedoortohundredsorthousandsofothers.

Sometimesan implant’spurpose is tocreateabackdoor for futureaccess.“Youpryopenthewindowsomewhereandleaveitsowhenyoucomebackthe

ownerdoesn’tknowit’sunlocked,butyoucangetbackinwhenyouwantto,”said one intelligence official,whowas speaking generally about the topic andwasnotprivytothebudget.Theofficialspokeontheconditionofanonymitytodiscusssensitivetechnology.

UnderU.S.cyberdoctrine,theseoperationsareknownas“exploitation,”not“attack,”buttheyareessentialprecursorsbothtoattackanddefense.

By the end of this year, GENIE is projected to control at least 85,000implants in strategically chosenmachines around theworld.That is quadruplethenumber—21,252—available in2008, according to theU.S. intelligencebudget.

TheNSAappearstobeplanningarapidexpansionofthosenumbers,whichwere limited until recently by the need for human operators to take remotecontrol of compromisedmachines. Evenwith a staff of 1,870 people,GENIEmadefulluseofonly8,448ofthe68,975machineswithactiveimplantsin2011.

ForGENIE’snextphase,accordingtoanauthoritativereferencedocument,theNSAhasbroughtonlineanautomatedsystem,code-namedTURBINE,thatis capable of managing “potentially millions of implants” for intelligencegathering“andactiveattack.”

‘TheROC’When it comes time to fight the cyberwar against the best of the NSA’s

globalcompetitors,theTAOcallsinitseliteoperators,whoworkattheagency’sFortMeadeheadquarters and in regionaloperations centers inGeorgia,Texas,Colorado and Hawaii. The NSA’s organizational chart has the main office asS321. Nearly everyone calls it “the ROC,” pronounced “rock”: the RemoteOperationsCenter.

“TotheNSAasawhole,theROCiswherethehackerslive,”saidaformeroperator from another section who has worked closely with the exploitation

teams.“It’sbasicallytheone-stopshopforanykindofactiveoperationthat’snotdefensive.”

Oncethehackersfindahole inanadversary’sdefense,“[t]argetedsystemsare compromised electronically, typically providing access to system functionsaswellasdata.Systemlogsandprocessesaremodified tocloak the intrusion,facilitatefutureaccess,andaccomplishotheroperationalgoals,”accordingtoa570-page budget blueprint for what the government calls its ConsolidatedCryptologicProgram,whichincludestheNSA.

TeamsfromtheFBI,theCIAandU.S.CyberCommandworkalongsidetheROC,withoverlappingmissionsandlegalauthorities.Sodotheoperatorsfromthe NSA’s National Threat Operations Center, whose mission is focusedprimarilyoncyberdefense.ThatwasSnowden’sjobasaBoozAllenHamiltoncontractor,anditrequiredhimtolearntheNSA’sbesthackingtechniques.

According to one key document, the ROC teams give Cyber Command“specific target related technical and operational material(identification/recognition), tools and techniques that allow the employmentofU.S.nationalandtacticalspecificcomputernetworkattackmechanisms.”

Theintelligencecommunity’scybermissionsincludedefenseofmilitaryandother classified computer networks against foreign attack, a task that absorbsroughly one-third of a total cyber operations budget of $1.02 billion in fiscal2013,according to theCryptologicProgrambudget.TheROC’sbreaking-and-enteringmission,supportedbytheGENIEinfrastructure,spendsnearlytwiceasmuch:$651.7million.

MostGENIE operations aim for “exploitation” of foreign systems, a termdefinedintheintelligencebudgetsummaryas“surreptitiousvirtualorphysicalaccesstocreateandsustainapresenceinsidetargetedsystemsorfacilities.”Thedocumentadds:“Systemlogsandprocessesaremodifiedtocloaktheintrusion,facilitatefutureaccess,andaccomplishotheroperationalgoals.”

TheNSAdesignsmostofitsownimplants,butitdevoted$25.1millionthisyear to “additional covert purchases of software vulnerabilities” from private

malwarevendors,agrowinggray-marketindustrybasedlargelyinEurope.

‘Mostchallengingtargets’The budget documents cast U.S. attacks as integral to cyber defense —

describingtheminsomecasesas“activedefense.”“If you’re neutralizing someone’s nuclear command and control, that’s a

huge attack,” saidone formerdefenseofficial.Thegreater thephysical effect,officialssaid,thelesslikelyitisthatanintrusioncanremainhidden.

“The United States is moving toward the use of tools short of traditionalweaponsthatareunattributable—thatcannotbeeasilytiedtotheattacker—toconvinceanadversarytochangetheirbehavioratastrategiclevel,”saidanotherformer seniorU.S. official, who also spoke on the condition of anonymity todiscusssensitiveoperations.

ChinaandRussiaareregardedasthemostformidablecyberthreats,anditisnotalwayseasy to tellwhoworks forwhom.China’soffensiveoperationsarecentered in the Technical Reconnaissance Bureau of the People’s LiberationArmy, but U.S. intelligence has come to believe that those state-employedhackersbydayreturntoworkatnightforpersonalprofit,stealingvaluableU.S.defenseindustrysecretsandsellingthem.

Iran is a distant third in capability but is thought to be more stronglymotivated to retaliate for Stuxnet with an operation that would not only stealinformationbuteraseitandattempttodamageU.S.hardware.

The“mostchallengingtargets”topenetratearethesameincyber-operationsasforallotherformsofdatacollectiondescribedintheintelligencebudget:Iran,NorthKorea,ChinaandRussia.GENIEandROCoperatorsplacespecialfocusonlocatingsuspectedterrorists“inAfghanistan,Pakistan,Yemen,Iraq,Somalia,andotherextremistsafehavens,”accordingtoonelistofpriorities.

ThegrowthofTailoredAccessOperationsattheNSAhasbeenaccompaniedbyamajorexpansionoftheCIA’sInformationOperationsCenter,orIOC.

TheCIAunitemployshundredsofpeopleat facilities inNorthernVirginiaandhasbecomeoneoftheCIA’slargestdivisions.Itsprimaryfocushasshiftedin recentyears fromcounterterrorism tocybersecurity,according to thebudgetdocument.

The military’s cyber-operations, including U.S. Cyber Command, havedrawnmuchofthepublic’sattention,buttheIOCundertakessomeofthemostnotable offensive operations, including the recruitment of several newintelligencesources,thedocumentsaid.

Militarycyber-operationspersonnelgrousethattheactionstheycantakeareconstrained by the legal authorities that govern them. The presidential policydirectiveoncyber-operations issued inOctobermadeclear thatmilitarycyber-operations that result in the disruption or destruction or evenmanipulation ofcomputersmustbeapprovedbythepresident.Butthedirective,theexistenceofwhichwasfirst reported last fallbyThePostand leaked inJunebySnowden,largelydoesnotapplytotheintelligencecommunity.

Giventhe“vastvolumesofdata”pulledinbytheNSA,storagehasbecomea pressing question. The NSA is nearing completion of a massive new datacenter inUtah.A second onewill be built at FortMeade “to keep pacewithcyberprocessingdemands,”thebudgetdocumentsaid.

According to the document, a high-performance computing center inUtahwill manage “storage, analysis, and intelligence production.” This will allowintelligence agencies “to evaluate similarities among intrusions that couldindicatethepresenceofacoordinatedcyberattack,whetherfromanorganizedcriminalenterpriseoranation-state.”

Spyagenciesspendmillionstohuntforinsiderthreats,documentshows

ByCarolLeonnig,JulieTateandBartonGellmanSeptember1,2013

TheU.S.governmentsuspectsthatindividualswithconnectionstoal-Qaedaandother hostile groups have repeatedly sought to obtain jobs in the intelligencecommunity, and it reinvestigates thousands of employees a year to reduce thethreat that one of its ownmay be trying to compromise closely held secrets,accordingtoaclassifiedbudgetdocument.

TheCIAfoundthatamongasubsetofjobseekerswhosebackgroundsraisedquestions,roughlyoneoutofeveryfivehad“significantterroristand/orhostileintelligence connections,” according to the document, which was provided toTheWashington Post by former National Security Agency contractor EdwardSnowden.

ThegroupscitedmostoftenwereHamas,Hezbollah, andal-Qaedaand itsaffiliates,butthenatureoftheconnectionswasnotdescribedinthedocument.

SosharpisthefearofthreatsfromwithinthatlastyeartheNSAplannedtolaunchat least4,000probesofpotentiallysuspiciousorabnormalstaffactivityafter scrutinizing trillions of employee keystrokes at work. The anomalousbehavior that sent up red flags could include staffers downloading multipledocumentsoraccessingclassifieddatabases theydonotnormallyuse for theirwork, said two people familiar with the software used to monitor employeeactivity.

Thisshrouded,multimillion-dollarhuntforinsiderthreatshassufferedfromcritical delays in recent years and uneven implementation across agencies, thebudgetrecordsshow.Andthespyagencies’detectionsystemsnevernoticedthatSnowdenwas copying highly classified documents from different parts of theNSA’snetworks.

He subsequently fled toHongKong and thenMoscow,where he remainsafterbeinggrantedtemporaryasylum.

ContractorslikeSnowden,anNSAspokeswomansaid,werenotincludedintheplanstoreinvestigate4,000securityclearances.

CIA officials said the number of applicants ultimately tied to terroristnetworksorhostileforeigngovernmentswas“small”butdeclinedtoprovideanexact number or the reasons the broader group of applicants initially raisedconcerns.

“Overthelastseveralyears,asmallsubsetofCIA’stotaljobapplicantswereflagged due to various problems or issues,” one official said in response toquestions. “During this period, one in five of that small subsetwere found tohave significant connections to hostile intelligence services and or terroristgroups.” The official, like others interviewed for this article, spoke on theconditionofanonymitytodiscussclassifiedmaterial.

Theintelligencecommunity’sdramaticemphasisoninsiderthreatscameinthewakeofdisclosuresbyWikiLeaksin2010.Theanti-secrecygroupreceivedhundreds of thousands ofmilitary and diplomatic documents fromArmy Pfc.BradleyManning,nowknownasChelseaManning.

Congress made security a top priority and in 2011 ordered Director ofNational Intelligence James R. Clapper Jr. to set up “an effective automatedinsiderthreatdetectionprogram”toguardagainstsimilarsecurityfailures.Theprogram was supposed to flag possible abuses, identify double agents andpreventleaks.

Theprojectwas delayed several times because the intelligence communitywas preoccupied with handling the fallout fromManning’s leaks, the budget

documentsshow.CongressgaveClapper anOctober2012deadline to install the automation

system and until October 2013 to have it fully operating. At the Obamaadministration’srequest,thedeadlineswereeachpushedbackayear.

Steven Aftergood, a government secrecy expert at the Federation ofAmerican Scientists, which analyzes national security policy, said he suspectstheagencymayrespondtoalotof“falsepositives”—alertsforactivitythatisactuallyinnocentandwork-related.

“If the 4,000 cases turn up only two or three actual threats, they need toadjust their detection threshold or they’ll be using a lot of resources for nopurpose,”hesaid.

An intelligence official knowledgeable about insider-threat programs saidgovernment agencies may need to better calibrate their software and reassesstheircriteriaforwhatconstitutesarealisticorlikelythreat.

But he added, “Insider-threat detection is an important security tool thatneedstobeputinplace.”

NSAspokeswomanVaneeVinessaidtheinvestigationsarepartofanefforttotrytoreducerisks,notinvestigateknownthreats.

“In FY 2013, NSA planned to initiate 4,000 reinvestigations on civilianemployees to reduce the potential of an insider compromise of sensitiveinformationandmissions,”Vinessaidinastatement.“Periodicreinvestigationsareconductedasonedue-diligencecomponentofourmultifacetedinsiderthreatprogram.”

PresidentObama issued a national insider-threat policy inNovember 2012that defines the problem as any risk that insiders will use their access togovernment secrets, knowingly or unknowingly, in a way that hurts U.S.security.Thedamagecancomethrough“espionage,terrorism,[or]unauthorizeddisclosureofnationalsecurityinformation,orthroughthelossordegradationofdepartmentalresourcesorcapabilities.”

Thepolicyputs leakersof classified informationonparwith terrorists and

doubleagents,anequivalencythatcriticsofgovernmentsecrecyfindworrisome.“It’sdisturbing,becausetheyarenotthesame,”Aftergoodsaid.“Thereare

suchthingsasagoodleak.Someclassifiedthingsshouldbepublic.Theofficialpolicydoesnotadmitthatdistinction.”

The newly obtained budget records also revealwhat some consider a newsecurityriskinthemaking.TheNSAiscreatingamassivenewdatabase,code-namedWILDSAGE, to facilitate the use of sensitive intelligence. The system“provides a mechanism for cybersecurity centers to share signatures at theSECRETclassificationlevel,”thebudgetdocumentsaid.

TheNSAhadnot fully implementedWILDSAGE,according to thebudgetdocument.Buttheintelligencecommunityalsoreportedthatit“madesignificantprogress in FY 2011 in increasing collaboration” across cybersecurity centersandincreatingarchitecturetoshareimportantinformationonrisks.”

Such shared databases give government employees information they mayneedtotrackanddisruptterroristorcyberplots,officialssaid.

The investigation of a 2009 plot by al-Qaeda’s affiliate inYemen to bringdown a civilian aircraft overDetroit found that government agencies failed toshareinformationthatcouldhaveflaggedthewould-bebomberandputhimonaterroristwatchlist.

A report by theSenate IntelligenceCommittee identified14 failure points,including that the CIA did not disseminate some its reporting, which allowedbomber Umar Farouk Abdulmutallab to board a U.S.-bound flight fromAmsterdam.

But the new NSA system has stoked fears about insiders’ access afterManningdownloadedtheentirecontentsofasimilarlysharedStateDepartmentdatabase.

“It’s a valid concern,” saidone intelligenceofficial. “But theother sideofthis...istheneedtoshareinformation.”

InthecaseofManning’sleak,theStateDepartmentmaintainedasharedNetCentric diplomacy database where all secret-level cables were deposited and

availabletoallintelligenceagenciestoaccessandsearch.ManningreviewedthedatabasewhilecreatinganalyticintelligenceproductsinIraq.

Manning was convicted last month of leaking classified information andsubsequentlysentencedto35yearsinprison.

Aprosecutor inManning’scasesaidtheU.S.governmentultimatelyhastoentrustitssecretstoitsemployees—evenlow-levelones.

“Military intelligence professionals go to work every day and use theinformation available to them to do their jobs,” said prosecutor Capt. JoeMorrow.“Wecantakeallthemitigationstepsintheworld,butthebottomlineisthatthereisnostepwecantakeasanation,asamilitary,that’sgoingtostopthedeterminedinsider.”

Top-secretfilesshownewlevelsofdistrustofPakistan

ByGregMiller,CraigWhitlockandBartonGellmanSeptember2,2013

AmemberofPakistan’sbordersecurityforcestandsguardnearTahir.(PhotobyTimCraig/TheWashingtonPost)

The $52.6 billion U.S. intelligence arsenal is aimed mainly at unambiguousadversaries, including al-Qaeda, North Korea and Iran. But top-secret budget

documentsrevealanequallyintensefocusononepurportedally:Pakistan.No other nation draws as much scrutiny across so many categories of

nationalsecurityconcern.A178-page summaryof theU.S. intelligence community’s “blackbudget”

showsthattheUnitedStateshasrampedupitssurveillanceofPakistan’snucleararms,citespreviouslyundisclosedconcernsaboutbiologicalandchemicalsitesthere, and details efforts to assess the loyalties of counter terrorism sourcesrecruitedbytheCIA.

PakistanappearsatthetopofchartslistingcriticalU.S.intelligencegaps.Itisnamedasatargetofnewlyformedanalyticcells.Andfearsaboutthesecurityof itsnuclearprogramaresopervasive thatabudgetsectiononcontaining thespread of illicit weapons divides the world into two categories: Pakistan andeverybodyelse.

Thedisclosures—basedondocumentsprovidedtoTheWashingtonPostbyformerintelligencecontractorEdwardSnowden—exposebroadnewlevelsofU.S.distrust in an already unsteady security partnership with Pakistan, apoliticallyunstablecountrythatfacesrisingIslamistmilitancy.Theyalsoreveala more expansive effort to gather intelligence on Pakistan than U.S. officialshavedisclosed.

TheUnitedStateshasdeliverednearly$26billioninaidtoPakistanoverthepast 12 years, aimed at stabilizing the country and ensuring its cooperation incounterterrorism efforts. But with Osama bin Laden dead and al-Qaedadegraded,U.S.spyagenciesappeartobeshiftingtheirattentiontodangersthathaveemergedbeyondthepatchofPakistaniterritorypatrolledbyCIAdrones.

“If theAmericans are expanding their surveillance capabilities, it canonlymean one thing,” said Husain Haqqani, who until 2011 served as Pakistan’sambassadortotheUnitedStates.“Themistrustnowexceedsthetrust.”

Beyond the budget files, other classified documents provided to The Postexposefreshallegationsofsystemichumanrightsabuses inPakistan.U.S.spyagencies reported thathigh-rankingPakistanimilitaryand intelligenceofficials

had been aware of — and possibly ordered — an extensive campaign ofextrajudicialkillingstargetingmilitantsandotheradversaries.

Publicdisclosureofthosereports,basedoncommunicationsinterceptsfrom2010to2012andotherintelligence,couldhaveforcedtheObamaadministrationto severaid to thePakistaniarmed forcesbecauseofaU.S. law thatprohibitsmilitary assistance to human rights abusers. But the documents indicate thatadministration officials decided not to press the issue, in order to preserve analreadyfrayedrelationshipwiththePakistanis.

In a statement, a spokeswoman for theNational SecurityCouncil said theUnited States is “committed to a long-term partnershipwith Pakistan, andweremainfullyengagedinbuildingarelationshipthatisbasedonmutualinterestsandmutualrespect.”

“Wehaveanongoingstrategicdialoguethataddressesinarealisticfashionmany of the key issues between us, from border management tocounterterrorism,fromnuclearsecuritytopromotingtradeandinvestment,”saidthe spokeswoman, Caitlin Hayden. “The United States and Pakistan share astrategic interest in combating the challenging security issues in Pakistan, andwecontinuetoworkcloselywithPakistan’sprofessionalanddedicatedsecurityforcestodoso.”

ThePostagreed towithholdsomedetails from thebudgetdocumentsafterconsultations with U.S. officials, who expressed concern about jeopardizingongoingoperationsandsources.

AspokesmanforthePakistaniEmbassyinWashingtondidnotrespondtoarequestforcomment.

Critical‘intelligencegaps’StarkassessmentsofPakistancontainedinthebudgetfilesseematoddswith

thesignals thatU.S.officialshaveconveyed inpublic,partly toavoid fanning

PakistanisuspicionsthattheUnitedStatesislayingcontingencyplanstoswoopinandseizecontrolofthecountry’snuclearcomplex.

When Director of National Intelligence James R. Clapper Jr. was askedduring congressional testimony last year whether Pakistan had appropriatesafeguards for its nuclear program, he replied, “I’m reasonably confident theydo.”Facingasimilarquestionthisyear,Clapperdeclinedtodiscussthematterinopensession.

But theclassifiedbudgetoverviewhesignedandsubmittedfor fiscal2013warned that “knowledge of the security of Pakistan’s nuclear weapons andassociatedmaterialencompassedoneofthemostcriticalsetof...intelligencegaps.”Thoseblindspotswereespeciallyworrisome,thedocumentsaid,“giventhe political instability, terrorist threat and expanding inventory [of nuclearweapons]inthatcountry.”

The budget documents do not break down expenditures by country orestimate how much the U.S. government spends to spy on Pakistan. But thenation is at the center of two categories — counterterrorism and counter-proliferation—thatdominatetheblackbudget.

In their proposal for fiscal 2013, which ends Sept. 30, U.S. spy agenciessought$16.6billion to fight al-Qaedaandother terroristgroupsandasked for$6.86billiontocounterthespreadofnuclear,biologicalandchemicalweapons.Together, the two categories accounted for nearly half of theU.S. intelligencecommunity’sbudgetrequestforthisyear.

Detailed spreadsheets contain dozens of line items that correspond tooperations in Pakistan. The CIA, for example, was scheduled to spend $2.6billion on “covert action” programs around the world. Among the mostexpensive, according to current and former U.S. intelligence officials, is thearmeddronecampaignagainstal-QaedafightersandothermilitantsinPakistan’stribalbelt.

U.S.intelligenceanalysts“producedhundredsofdetailedandtimelyreportsonshipmentsandpendingdeliveriesofsuspectcargoes”toPakistan,Syriaand

Iran.MultipleU.S.agenciesexploited themassiveAmericansecuritypresenceinAfghanistan—includingastringofCIAbasesandNationalSecurityAgencylistening posts along the border mainly focused on militants — for broaderintelligenceonPakistan.

AnxietyovernuclearprogramAfteryearsofdiplomaticconflict,significantsourcesoftensionbetweenthe

UnitedStatesandPakistanhavebeguntosubside.ThepaceofCIAdronestrikeshasplunged,andtwoyearshavepassedsince

U.S. leaders infuriated Islamabad by ordering the secret raid inside PakistaniterritorythatkilledbinLaden.

AlthoughPakistaniangerhasabated,Haqqanisaidthefalloutfromtheraidhadbroaderconsequencesthanwidelyunderstood.

“ThediscoveryofbinLaden[inPakistan]madetheAmericansthinkthatthePakistani state’s ability to knowwhat happenswithin the country is a lot lessthan had been assumed,” said Haqqani, who is an international-relationsprofessoratBostonUniversity.

That realizationmay have ratcheted up a long-standing source of concern:Pakistan’sabilitytosafeguarditsnuclearmaterialsandcomponents.

U.S. intelligence agencies are focused on two particularly worrisomescenarios: the possibility that Pakistan’s nuclear facilities might come underattackbyIslamistmilitants,asitsarmyheadquartersinRawalpindididin2009,andevengreaterconcernthatIslamistmilitantsmighthavepenetratedtheranksof Pakistan’s military or intelligence services, putting them in a position tolaunchaninsiderattackorsmuggleoutnuclearmaterial.

Pakistanhasdozensoflaboratoriesandproductionandstoragesitesscatteredacrossthecountry.Afterdevelopingwarheadswithhighlyenricheduranium,ithas more recently tried to do the same with more-powerful and compactplutonium.Thecountry isestimated tohaveasmanyas120nuclearweapons,

and thebudget documents indicate thatU.S. intelligence agencies suspect thatPakistanisaddingtothatstockpile.

Little is known about how itmovesmaterials among its facilities, an areathatexpertshavecitedasapotentialvulnerability.

“Nobodyknowshowtheytrulydoit,”saidFerozKhan,aretiredPakistanimilitary officer and director of arms control who lectures at the U.S. NavalPostgraduate School inMonterey, Calif. “Vehiclesmove in a stealthymannerandmovewith security.But it’s not clearwhether the cores aremoved to thewarheadsorthewarheadsaremovedtothecorelocations.”

Concernspersist thatextremistscouldseizecomponentsof thestockpileortrigger a war with neighboring India. Pakistan also has a track record ofexportingnucleartechnologytocountriesthatareonWashington’sblacklist.

PakistanhasacceptedsomesecuritytrainingfromtheCIA,butU.S.exportrestrictions and Pakistani suspicions have prevented the two countries fromsharingthemostsophisticatedtechnologyforsafeguardingnuclearcomponents.

U.S.anxietyoverPakistan’snuclearprogramappearstobedrivenmorebyuncertainty about how it is run than specific intelligence indicating that itssystemsarevulnerable,accordingtothebudgetdocuments.

A lengthy sectionon counter-proliferation startswith a single goal: “MakeQuantitative andQualitativeProgress against PakistanNuclearGaps.”A tableindicatesthatU.S.spyagencieshaveidentifiedatleastsixareasinwhichtheirunderstandingofPakistan’sweaponsprogramsisdeficient.

U.S. agencies reported gaining valuable information through “extensiveefforts to increase understanding of the transfer and storage of the associatedmaterials.”

ThebudgetdescribesthecreationofaPakistanWMDAnalysisCelltotrackmovementsofnuclearmaterials.Agencies, including theCIAand theDefenseDepartment,wereable“todevelopanddeployanewcompartmentedcollectioncapability” that delivered a “more comprehensive understanding of strategicweaponssecurityinPakistan.”

Even so, “the number of gaps associated with Pakistani nuclear securityremains the same,” thedocument said, and “thequestions associatedwith thisintractabletargetaremorecomplex.”

The budget documents indicate that U.S. intelligence agencies are alsofocusedonthesecurityofthenuclearprograminIndia,Pakistan’sarch-rival.

OtherfieldsunderscrutinyU.S.surveillanceofPakistanextendsfarbeyonditsnuclearprogram.There

areseveralreferencesintheblackbudgettoexpandingU.S.scrutinyofchemicaland biological laboratories. The country is not thought to be running a roguechemicalorbiologicalweaponsprogram,butU.S.intelligenceofficialsfearthatIslamistscouldseizematerialsfromgovernment-runlaboratories.

Even American interdiction operations targeting other countries havestumbledintoconnectionswithPakistan.Inonecase,aU.S.effort toblockanIranian shipment through a Turkish port “proved to be even more successfulwhen aluminum powder destined for Pakistan was also discovered anddetained,” according to the documents. Aluminum powder can be used toincreasethepowerofexplosives.

The budget documents don’t disclose CIA payments to its Pakistanicounterpart, the Inter-Services Intelligence directorate, or ISI, which formerofficialssaidhastotaledtensofmillionsofdollars.Thedocumentsdoshowthatthe CIA has developed sophisticated means of assessing the loyalties ofinformantswhohavehelpedtheagencyfindal-QaedaleadersinPakistan’stribalregion.

Thosemeasures,whichThePosthasagreednottodisclose,haveallowedtheCIAto“gainconfidenceineachasset’sauthenticity,reliabilityandfreedomfromhostilecontrol.”

ExtrajudicialkillingsOtherclassifieddocumentsgiven toThePostbySnowdenreveal thatU.S.

spy agencies for years reported that senior Pakistani military and intelligenceleaderswereorchestratingawaveofextrajudicialkillingsofterrorismsuspectsandothermilitants.

In July 2011, an assessment of communications intercepts and otherintelligence by theNSA concluded that the Pakistanimilitary and intelligenceservices had continued over the preceding 16 months a pattern of lethallytargetingperceivedenemieswithouttrialordueprocess.Thekillings,accordingtotheNSA,occurred“withtheknowledge,ifnotconsent,ofseniorofficers.”

TheNSAcitedtwoseniorPakistaniofficialswho“apparentlyorderedsomeofthekillingsorwereatleastawareofthem,”readasummaryofthetop-secretNSA report, titled “Pakistan/Human Rights: Extrajudicial Killings ConductedWithConsentofSeniorIntelligenceOfficials.”

The report summarydid not provide an estimate of howmanypeople hadbeen killed or their identities. But it generally described the targets as peoplewhom the Pakistani security forces viewed as “undeniably linked to terroristactivity”orresponsibleforattacksonPakistan’sarmedforces.

The killings “seemed to serve the purpose of dispensingwhat themilitaryconsideredswiftjustice,”theintelligenceassessmentstated.Pakistaniauthorities“wereconsciousofnot arousing suspicions.Thenumberofvictimsat agiventime tended to be very small. Furthermore, themilitary took care tomake thedeathsseemtooccurinthecourseofcounterinsurgencyoperations,fromnaturalcauses,orastheresultofpersonalvendettas.”

AlthoughPakistanhasbeenengagedforyearsinopenwarfarewithTalibanfactionsandotherdomesticinsurgents,theNSAplacedtheextrajudicialkillingsinamuchdarkercategory.Pakistanipolice forces“were reluctant tocarryoutthekillings,”thereportsaid.

The NSA compiled its report shortly after the public exposure of otherallegedPakistaniatrocities.

In June 2010, the Human Rights Commission of Pakistan charged thatPakistani forceshadcarriedoutmore than280 summaryexecutionsduringanoffensiveagainstTalibanfightersandothermilitants,mostlyintheSwatValley.Fivemonths later, a video surfaced on the Internet showingPakistani soldiersexecutingsixblindfoldedmenwiththeirhandstiedbehindtheirbacks.

An international outcry over the latter incident prompted the Obamaadministration towithhold aid—but only to a handful of low-level Pakistaniarmyunitsthoughttohavebeeninvolvedinsuchincidents.

At the time, Pakistani officials dismissed the video and other reports ofsummaryexecutionsasTalibanpropaganda,but they later reversedcourseandlaunched an internal investigation. Pakistan’smilitary leaders insisted publiclythattheyhadzerotoleranceforsuchincidents.

HumanrightsabusesIt was not the first time that U.S. officials sought to keep evidence of

Pakistanihumanrightsabusesoutofthepubliceye.Aclassifieddiplomatic cable, sent from theU.S.Embassy in Islamabad to

officials in Washington in September 2009, also raised concern about theextrajudicial killings of militants by Pakistani army units. But the cable —originally released in 2010 by the anti-secrecy group WikiLeaks — advisedagainst public disclosure of the incidents, saying it was more important tomaintainsupportforthePakistaniarmedforces.

U.S.intelligenceofficialshavekeptquietaboutothersignsofhumanrightsabuses by the Pakistanimilitary, even though their classified reporting on thesubjectunderscorespersistentconcerns.

In September 2011, the summary of a top-secret report from a DefenseIntelligenceAgencytaskforcecitedthe“systemicpractice”ofunlawfulkillingsbyPakistanisecurityforcesinthetribalregionsofwesternPakistan.

Pakistanhadrecentlypassedalawallowingthemilitarytodetaininsurgentsindefinitelyandmake it easier to convict them inciviliancourts.But theDIAconcludedthatbecauseextrajudicialkillingswere“condonedbyseniorofficials”

inPakistan’s security establishment, the new lawwas unlikely to significantlyreducethenumberofdeaths.

Other U.S. intelligence documents indicate that Pakistani officials weren’ttargetingjustsuspectedinsurgents.

InMay 2012, U.S. intelligence agencies discovered evidence of Pakistaniofficers plotting to “eliminate” a prominent human rights activist, AsmaJahangir, according to the summary of a top-secret DIA report. Jahangir hadbeenaleadingpubliccriticoftheISIforyears.

TheDIAreportdidnotidentifywhichofficerswereplottingtokillJahangir,but it said the plan “included either tasking militants to kill her in India ortaskingmilitantsorcriminalstokillherinPakistan.”

TheU.S.agencysaiditdidnotknowwhethertheISIhadgivenapprovalfortheplottoproceed.AlthoughthereportspeculatedthattheISIwasmotivatedtokillJahangir“toquietpubliccriticismofthemilitary,”theDIAnotedthatsuchaplot“wouldresultininternationalanddomesticbacklashasISIisalreadyundersignificantcriticismforintimidationandextrajudicialkillings.”

News of the alleged plot became public a fewweeks later when Jahangirgave a round of interviews to journalists, revealing that she had learned thatPakistani intelligence officials had marked her for death. The plot was nevercarriedout.

U.S.documentsdetailal-Qaeda’seffortstofightbackagainstdrones

ByBartonGellmanandCraigWhitlockSeptember3,2013

Al-Qaeda’s leadership has assigned cells of engineers to find ways to shootdown, jamor remotelyhijackU.S.drones,hoping to exploit the technologicalvulnerabilities of a weapons system that has inflicted huge losses upon theterroristnetwork,accordingtotop-secretU.S.intelligencedocuments.

Although there is no evidence that al-Qaeda has forced a drone crash orinterferedwithflightoperations,U.S.intelligenceofficialshavecloselytrackedthegroup’spersistenteffortstodevelopacounterdronestrategysince2010,thedocumentsshow.

Al-QaedacommandersarehopingatechnologicalbreakthroughcancurbtheU.S.dronecampaign,whichhaskilledanestimated3,000peopleoverthepastdecade. The airstrikes have forced al-Qaeda operatives and other militants totake extreme measures to limit their movements in Pakistan, Afghanistan,Yemen,Somaliaandotherplaces.Butthedroneattackshavealsotakenaheavytoll on civilians, generating a bitter popular backlash against U.S. policiestowardthosecountries.

Detailsofal-Qaeda’sattemptstofightbackagainstthedronecampaignarecontainedinaclassifiedintelligencereportprovidedtoTheWashingtonPostbyEdwardSnowden,thefugitiveformerNationalSecurityAgencycontractor.Thetop-secretreport,titled“ThreatstoUnmannedAerialVehicles,”isasummaryofdozensofintelligenceassessmentspostedbyU.S.spyagenciessince2006.

U.S. intelligenceanalystsnoted in theirassessments that informationaboutdrone operational systems is available in the public realm. But The Post iswithholding some detailed portions of the classified material that could shedlightonspecificweaknessesofcertainaircraft.

UnderPresidentObamaandhispredecessor,GeorgeW.Bush,droneshaverevolutionized warfare and become a pillar of the U.S. government’scounterterrorism strategy, enabling the CIA and the military to track downenemiesinsomeof theremotestpartsof theplanet.Dronestrikeshaveleftal-Qaeda’scoreleadershipinPakistanscramblingtosurvive.

U.S. spy agencies have concluded that al-Qaeda faces “substantial”challenges indevisinganeffectiveway to attackdrones, according to the top-secret report disclosed by Snowden. Still, U.S. officials and aviation expertsacknowledge that unmanned aircraft have a weak spot: the satellite links andremotecontrolsthatenablepilotstoflythemfromthousandsofmilesaway.

In July 2010, a U.S. spy agency intercepted electronic communicationsindicating that senior al-Qaeda leaders had distributed a “strategy guide” tooperatives around the world advising them how “to anticipate and defeat”unmanned aircraft. The Defense Intelligence Agency (DIA) reported that al-Qaeda was sponsoring simultaneous research projects to develop jammers tointerfere with GPS signals and infrared tags that drone operators rely on topinpointmissiletargets.

Other projects in the works included the development of observationballoonsandsmall radio-controlledaircraft,orhobbyplanes,which insurgentsapparently saw as having potential for monitoring the flight patterns of U.S.drones,accordingtothereport.

Al-Qaeda cell leaders in the tribal areas of northwestern Pakistan were“determining the practical application of technologies being developed forbattlefieldapplications,”analysts from theDIAwrote.Theanalystsadded thattheybelievedal-Qaeda“cell leadership is trackingtheprogressofeachprojectandcanredirectcomponentsfromoneprojecttoanother.”

Thetechnologicalvulnerabilitiesofdronesarenosecret.TheU.S.AirForceScientificAdvisoryBoard issuedanunclassified report twoyearsagowarningthat “increasingly capable adversaries” in countries such asAfghanistan couldthreatendroneoperationsbyinventinginexpensivecountermeasures.

Theboardsaidinsurgentsmighttrytouse“lasersanddazzlers”torenderadrone ineffective by blinding its cameras and sensors. It also predicted thatinsurgentsmightuserudimentaryacousticreceiverstodetectdronesand“simplejammertechniques”tointerferewithnavigationandcommunications.

Researchers have since proved that the threat is not just theoretical. Lastyear,aresearchteamfromtheUniversityofTexasatAustindemonstratedtotheDepartmentofHomelandSecurity that itwaspossible tocommandeera smallcivilian drone by “spoofing” its GPS signal with a ground transmitter andchartingadifferentnavigationalcourse.

TrainedengineersAl-Qaedahasalonghistoryofattractingtrainedengineersandotherswitha

scientificbackground.KhalidSheikMohammed,theself-proclaimedarchitectoftheSept.11,2001,attacks,holdsamechanical-engineeringdegreeandissuchaninveteratetinkererthattheCIAallowedhimtofiddlearoundwithnewdesignsforavacuumcleanerafterhewascapturedadecadeago.

In2010, theCIAnotedinasecretreport thatal-Qaedawasplacingspecialemphasisontherecruitmentoftechniciansandthat“theskillsmostindemand”includedexpertiseindronesandmissiletechnology.InJulyofthatyear,AtiyahAbdal-Rahman,anal-Qaedaoperationschief, tolda jihadistWebsite that thenetwork did not need “ordinary fighters” and that it was looking instead for“specialiststaff”tojointheorganization.

Thatsameyear,authoritiesinTurkeysaidtheyarrestedanal-Qaedamemberwhowas developing plans to shoot down smallNATO surveillance drones inAfghanistan. The suspect, a 23-year-old mathematics student, was using

software to conduct ballistics research for drone attacks, according to Turkishofficials.

Al-Qaeda leaders have become increasingly open about their anti-droneefforts.InMarch,anewEnglish-languageonlinejihadistmagazinecalledAzanpublishedastorytitled“TheDroneChain.”Thearticlederideddronearmamentsas“evilmissilesdesignedbythedevilsoftheworld”butreassuredreadersthatjihadists had beenworking on “various technologies” to hack,manipulate anddestroyunmannedaircraft.

Atthesametime,themagazineindicatedthat thoseeffortsneededaboost,and it issued an emergency plea for scientific help: “Any opinions, thoughts,ideas and practical implementations to defeat this drone technology must becommunicated to us as early as possible because these would aid greatly…againstthecrusader-zionistenemy.”

In the absence of a high-tech silver bullet, al-Qaeda affiliates around theworldhave taken tosharinghard-earned lessonsabout the importanceofbasicdefensivemeasures.

Islamist extremists in North Africa this year distributed a photocopiedtipsheet with 22 recommendations for avoiding drone strikes. Among thesuggestionsareseveralideasforcamouflageaswellasdubiousadviceonusingradioormicrowavetransmittersto“confusethefrequenciesusedtocontrolthedrone.”

TheAssociatedPressinFebruaryfoundacopyofthetipsheet inMali, leftbehind by Islamist fighters fleeing the city of Timbuktu. It was written by ajihadist in Yemen two years earlier and has circulated among al-Qaedafranchisessincethen.

‘GPSjammingcapability’In January 2011,U.S. intelligence agencies detected an unusual electronic

signal emanating fromnearMiranShah, a jihadist haven inNorthWaziristan,

Pakistan. TheDIA called the signal “the first observed test of a new terroristGPSjammingcapability.”

The test apparently did not pose a threat to military GPS frequencies orencrypted communications links. In addition, whoever was beaming themysterioussignalmistakenlythoughtthatjammingground-basedGPSreceiverswouldinterferewithdrones’abilitytoaimmissilesormunitionsatfixedtargets,accordingtotheDIAreport.

Despite such missteps, al-Qaeda has been undeterred. In a separate 2011report, the DIA stated that affiliates in Miran Shah and the Pakistani city ofKarachiwerepursuingother“R&Dprojects,”includingoneefforttoshootdowndroneswithportableshoulder-firedmissiles,knownasmanpads.

Armyintelligenceanalystsuncoveredsimilarprojects,includingattemptstodeveloplaserdetectorsthatcouldgivewarningwheneveraU.S.Predatordronewasabout to fire a laser-guidedHellfiremissile, according to a summaryof aclassifiedArmyreport.

In 2011, the DIA concluded that an “al-Qaeda-affiliated research anddevelopment cell currently lacks the technical knowledge to successfullyintegrate and deploy a counterdrone strike system.” DIA analysts added,however,thatifal-Qaedaengineerswereto“overcomethesesubstantialdesignchallenges,we believe such a systemprobablywould be highly disruptive forU.S.operationsinAfghanistanandPakistan.”

TheAirForceandCIArelyheavilyonPredatorandReaperdronestohuntforal-Qaedatargetsandother insurgents inseveralcountries.Bothaircraftcanstay aloft formore than20hours to conduct surveillancemissions and canbearmedwithHellfiremissiles.

Thedrones are flownby remote control via satellite data links, usually bypilots and sensor operators stationed thousands ofmiles away at bases in theUnitedStates.Thosesatellitelinksareencrypted,whichmakestheconnectionsextremelydifficulttohack.

It is only slightly less of a challenge for al-Qaeda fighters to spot a high-

flyingdronewiththenakedeye.PredatorsandReapersloiterataltitudesabove20,000feet,andtheirpowerfulcamerasfocusonobjectsseveralmilesoverthehorizon,sotheirpresenceishardtodetect.

Thesatellitelinks,however,aretheAchilles’heelofdroneoperations.“Lostlink”incidents—triggeredwhenasatellitemovesoutofrangeoradronedropsa signal— are relatively common. The connections are usually reestablishedwithinsecondsorminutes.Theaircraftareprogrammedtoflyinalooppatternorreturntotheirlaunchingspotduringprolongeddisruptions.

Onseveraloccasions,however,lostlinkshaveledtocrashes.InSeptember,anAirForcePredatorslammedintomountainousterrainalongtheIraq-Turkeyborderafterthesatellitedatalinkswerelostandthedronecrewcouldnolongercommunicatewiththeaircraft.

InDecember2011,astealthU.S.spydroneoperatedbytheCIAcrashedinIranian territory. Iran said it downed the advanced RQ-170 drone in an“electronicambush.”U.S.officialssaidtheydidnotbelievethat thedronehadbeen hacked or jammed. They said a technical malfunction was probably toblame.

Although the navigational satellite links are encrypted, other dronetransmissionsaresometimesleftunprotected.

In2009, theU.S.militarydiscovered that Iraqi insurgents hadhacked intovideofeedsfromPredatorandShadowdronesusingoff-the-shelfsoftware.Thedroneshadbeentransmittingfull-motionvideotoU.S.troopsontheground,buttheAirForcehadnotencryptedthosedatalinks,leavingthemvulnerable.

Air Force officials acknowledged the flaw and said they would work toencrypt all video feeds from its fleet of Predator drones by 2014. In theirclassified assessments, U.S. intelligence agencies sought to play down theinsurgents’ hacking handiwork. Although analysts were concerned about theinterceptionsofthevideofeeds,theysaidtherewasnosignthatinsurgentshadbeenabletoseizecontrolofthedroneitself.

“While theabilityof insurgent forces toviewunencryptedor tobreak into

encrypteddatastreamshasbeenaconcernforsometime,indicationstodatearethat insurgents have not been able to wrest [drone] control from its missioncontrolgroundstation,”a2010reportconcluded.

The report went on to suggest that allowing insurgents to intercept videofeeds might actually have “a deterrent effect” by demonstrating the extent towhichU.S.forceswereabletowatchtheirmovements.

GrowinguneaseStill, summaries of the classified reports indicate a growingunease among

U.S.agenciesaboutal-Qaeda’sdeterminationtofindawaytoneutralizedrones.“Al-Qaida Engineers in PakistanContinueDevelopment of Laser-Warning

SystemsinEffortToCounterUAVStrikes,”read theheadlineofonereport in2011,usingthemilitaryacronymforunmannedaerialvehicles.

Beyondthethreatthatal-Qaedamightfigureouthowtohackorshootdowna drone, however, U.S. spy agencies worried that their drone campaign wasbecomingincreasinglyvulnerabletopublicopposition.

Intelligenceanalyststookcarefulnoteofal-Qaeda’seffortstoportraydronestrikesascowardlyor immoral,beginning in January2011witha report titled“Al-Qa’idaExploresManipulatingPublicOpiniontoCurbCTPressure.”

Analystsalsoquestionedwhethertheywerelosingtherhetoricalbattleinthemedia,thecourtsandevenamong“citizenswithlegitimatesocialagendas.”One2010 reportpredicted thatdroneoperations“couldbebroughtunder increasedscrutiny,perceivedtobeillegitimate,openlyresistedorundermined.”

Inresponse,intelligenceagenciesfloatedtheirownideastoinfluencepublicperceptions.Oneunclassifiedreportsaidthephrase“dronestrike”shouldneverbeuttered,callingit“aloadedterm.”

“Drones connote mindless automatons with no capability for independentthoughtoraction,”thereportsaid.“Strikesconnoteafirstattack,whichleavesthe victim unable to respond. Other phrases employed to evoke an emotional

responseinclude‘KillList,’‘HitSquads,’‘RobotWarfare,’or‘AerialAssassins.’“

Instead, the report advised referring to “lethal UAV operations.” It alsosuggested “elevating the conversation” to more-abstract issues, such as the“Inherent Right of Self-Defense” and “Pre-emptive and Preventive MilitaryAction.”

GregMillercontributedtothisreport.

ObamaadministrationhadNSArestrictionsreversedin2011

ByEllenNakashimaSeptember7,2013

Sen.RonWyden(D-Ore.)hasbeenoneof themostvocalcriticsof theNSA’sdomesticspyingprogram.(PhotobyMelinaMara/TheWashingtonPost)

TheObamaadministrationsecretlywonpermissionfromasurveillancecourtin2011toreverserestrictionsontheNationalSecurityAgency’suseofintercepted

phone calls and e-mails, permitting the agency to search deliberately forAmericans’ communications in its massive databases, according to interviewswithgovernmentofficialsandrecentlydeclassifiedmaterial.

Inaddition,thecourtextendedthelengthoftimethattheNSAisallowedtoretaininterceptedU.S.communicationsfromfiveyearstosixyears—andmoreunder special circumstances, according to the documents, which include arecentlyreleased2011opinionbyU.S.DistrictJudgeJohnD.Bates,thenchiefjudgeoftheForeignIntelligenceSurveillanceCourt.

What had not been previously acknowledged is that the court in 2008imposed an explicit ban— at the government’s request— on those kinds ofsearches, that officials in 2011got the court to lift the bar and that the searchauthorityhasbeenused.

Together the permission to search and to keep data longer expanded theNSA’s authority in significant ways without public debate or any specificauthority from Congress. The administration’s assurances rely on legalisticdefinitionsoftheterm“target”thatcanbeatoddswithordinaryEnglishusage.The enlarged authority is part of a fundamental shift in the government’sapproach to surveillance: collecting first, and protecting Americans’ privacylater.

“Thegovernmentsays,‘We’renottargetingU.S.persons,’“saidGregoryT.Nojeim,seniorcounselattheCenterforDemocracyandTechnology.“Butthentheyneversay,‘WeturnaroundanddeliberatelysearchforAmericans’recordsinwhatwe tookfromthewire.’That, tome, isnotsodifferent fromtargetingAmericansattheoutset.”

The court decision allowed theNSA “to query the vastmajority” of its e-mailandphonecalldatabasesusingthee-mailaddressesandphonenumbersofAmericansandlegalresidentswithoutawarrant,accordingtoBates’sopinion.

The queries must be “reasonably likely to yield foreign intelligenceinformation.”AndtheresultsaresubjecttotheNSA’sprivacyrules.

The court in 2008 imposed a wholesale ban on such searches at the

government’s request, said Alex Joel, civil liberties protection officer at theOffice of the Director of National Intelligence (ODNI). The governmentincludedthisrestriction“toremainconsistentwithNSApoliciesandproceduresthatNSAappliedtootherauthorizedcollectionactivities,”hesaid.

But in 2011, to more rapidly and effectively identify relevant foreignintelligence communications, “we did ask the court” to lift the ban, ODNIgeneralcounselRobertS.Littsaidinaninterview.“Wewantedtobeabletodoit,”hesaid,referringtothesearchingofAmericans’communicationswithoutawarrant.

Joel gavehypothetical examplesofwhy the authoritywasneeded, such aswhen theNSA learnsof a rapidlydeveloping terroristplot and suspects that aU.S. person may be a conspirator. Searching for communications to, from oraboutthatpersoncanhelpassessthatperson’sinvolvementandwhetherheisintouchwith terroristswho are surveillance targets, he said.Officialswould notsayhowmanysearcheshavebeenconducted.

Thecourt’sexpansionofauthoritywentlargelyunnoticedwhentheopinionwasreleased,butitformedthebasisforcrypticwarningslastyearbyapairofDemocratic senators, Ron Wyden (Ore.) and Mark Udall (Colo.), that theadministrationhada“back-doorsearchloophole”thatenabledtheNSAtoscourinterceptedcommunicationsforthoseofAmericans.Theyintroducedlegislationtorequireawarrant,buttheywerebarredbyclassificationrulesfromdisclosingthe court’s authorization or whether the NSA was already conducting suchsearches.

“The[surveillance]Courtdocumentsdeclassifiedrecentlyshowthat in late2011thecourtauthorizedtheNSAtoconductwarrantlesssearchesofindividualAmericans’ communications using an authority intended to target onlyforeigners,” Wyden said in a statement to The Washington Post. “Ourintelligence agencies need the authority to target the communications offoreigners,butforgovernmentagenciestodeliberatelyreadthee-mailsorlistentothephonecallsofindividualAmericans,theConstitutionrequiresawarrant.”

Senioradministrationofficialsdisagree.“Ifwe’revalidlytargetingforeignersandwehappentocollectcommunicationsofAmericans,wedon’thavetocloseour eyes to that,”Litt said. “I’mnot aware of other situationswhere oncewehave lawfully collected information,we have to go back and get awarrant tolookattheinformationwe’vealreadycollected.”

ThesearchestakeplaceunderasurveillanceprogramCongressauthorizedin2008underSection702oftheForeignIntelligenceSurveillanceAct.Underthatlaw, the target must be a foreigner “reasonably believed” to be outside theUnitedStates,and thecourtmustapprove the targetingprocedures inanordergoodforoneyear.

But— and thiswas the nub of the criticism— awarrant for each targetwouldnolongerberequired.ThatmeansthatcommunicationswithAmericanscouldbepickedupwithoutacourtfirstdeterminingthatthereisprobablecausethatthepeopletheyweretalkingtowereterrorists,spiesor“foreignpowers.”

That is why it is important to require a warrant before searching forAmericans’ data, Udall said. “Our founders laid out a roadmap whereAmericans’privacyrightsareprotectedbeforetheircommunicationsareseizedorsearched—notafterthefact,”hesaidinastatementtoThePost.

AnotherchangeapprovedbyBatesallowstheagencytokeepthee-mailsofor concerning Americans for up to six years, with an extension possible forforeign intelligence or counterintelligence purposes. Because the retentionperiodbegins“fromtheexpirationdate”oftheone-yearsurveillanceperiod,thecourteffectivelyaddeduptooneyearofshelflifeforthee-mailscollectedatthebeginningoftheperiod.

Joelsaidthatthechangewasintendedtostandardizeretentionperiodsacrossthe agencies and that the more generous standard was “already in use” byanotheragency.

The NSA intercepts more than 250 million Internet communications eachyear under Section 702.Ninety-one percent are fromU.S. Internet companiessuchasGoogleandYahoo.Therestcomefrom“upstream”companiesthatroute

Internet traffic to, from and within the United States. The expanded searchauthorityappliesonlytothedownstreamcollection.

DeclassifiedcourtdocumentshighlightNSAviolationsindatacollection

ByEllenNakashima,JulieTate,CarolLeonnigSeptember10,2013

The National Security Agency for almost three years searched a massivedatabase of Americans’ phone call records attempting to identify potentialterrorists in violation of court-approved privacy rules, and the problem wentunfixedbecausenooneattheagencyhadafulltechnicalunderstandingofhowitssystemworked,accordingtonewdocumentsandseniorgovernmentofficials.

Moreover, itwas JusticeDepartment officialswhodiscovered the problemandreportedit to thecourt thatoverseessurveillanceprograms, thedocumentsshow,underminingassertionsbytheNSAthatself-reportingispartofitsculture.

TheimproperactivitywentonfromMay2006toJanuary2009,accordingtoaMarch2009opinionbyJudgeReggieB.Walton,whoserveson theForeignIntelligenceSurveillanceCourt.

It was one of more than a dozen documents declassified and releasedTuesdayinresponsetolawsuitsbycivillibertiesgroupsandatthedirectionofPresidentObamain thewakeof theJunedisclosurebyformerNSAcontractorEdwardJ.Snowdenofthemassivephonerecordscollection.

“Thedocuments released todayare a testament to thegovernment’s strongcommitment to detecting, correcting and reporting mistakes that occur inimplementing technologically complex intelligence collection activities, and tocontinually improving its oversight and compliance processes,” said JamesR.Clapper,thedirectorofnationalintelligence.

AstrongrebukeoftheNSAbythecourtcomeslessthanamonthaftertheOffice of theDirector ofNational Intelligence released a highly critical FISAcourt opinion that took the agency to task for its operation of a separatesurveillanceprogram.Takentogether,thedocumentsreleasedbytheofficeoverthepastmonthpainta troublingpictureofanagency thathassoughtandwonfar-reaching surveillance powers to run complex domestic data collectionwithoutanyonehaving full technicalunderstandingof theefforts, and thathasrepeatedlymisrepresentedtheprograms’scopetoitscourtoverseer.

SuchrevelationscallintoquestiontheeffectivenessofanoversightprogramthatdependsonaccuratedisclosurebytheNSAtoacourtthatactsinsecretandsaysitlackstheresourcestoverifyindependentlytheagency’sassertions.

“It has finally come to light that the FISC’s authorizations of this vastcollectionprogramhavebeenpremisedonaflaweddepictionofhowtheNSAuses”thephonedata,Waltonwrote.

“ThismisperceptionbytheFISCexistedfromtheinceptionofitsauthorizedcollectioninMay2006,buttressedbyrepeatedinaccuratestatementsmadeinthegovernment’ssubmissions,”hecontinued.

Privacyprocedures“havebeensofrequentlyandsystemicallyviolatedthatitcanfairlybesaidthatthiscriticalelementoftheoverall[phonerecords]regimehasneverfullyfunctionedeffectively,”hesaid.

The “bulk records” program began without any court or congressionalapproval shortly after the Sept. 11, 2001, attacks but was put under courtsupervisioninMay2006whenAmericanphonecompaniesbalkedatprovidingthedatasolelyattherequestoftheexecutivebranch.

Undertheprogram,theNSAreceivesdailytransfersofallcustomerrecordsfromthenation’sphonecompanies.Those records includenumberscalled, thecalls’timeandduration,butnotthecontentofconversations.

BeginninginlateJanuary2009,JusticeDepartmentofficialsbegannotifyingthecourtofproblems,inparticularthattheNSAhadbeenrunninganautomated“alert list” on selected phone numbers without meeting the court-required

standardof“reasonableandarticulablesuspicion”thatthosenumbersweretiedtoterrorists.

Justice Department officials notified the court that the NSA had beensearching the business records “in a manner directly contrary” to the court’sorders “and directly contrary to the sworn attestations of several ExecutiveBranchofficials,”WaltonwroteinaJan.29,2009,order.

NSADirectorKeithB.Alexandersuggestedtothecourt that theviolationsstemmedfromabeliefbyNSApersonnelthatnotallthedatabaseswerecoveredbythesameprivacyrules,WaltonwroteinhisMarchopinion.

“Thatinterpretationofthecourt’sordersstrainscredulity,”Waltonsaid.WaltonalsosuggestedthattheNSA’sOfficeofGeneralCounseldeliberately

chosetoapprovetheuseofphonenumbersthatdidnotmeetthecourtstandardsbecausesuchprocedureswereinkeepingwithotherNSAcollectionactivities.

InMarch2009,thecourttooktheunusualstepoforderingthegovernmenttoseek approval to query the database on a case-by-case basis “except wherenecessarytoprotectagainstanimminentthreattohumanlife.”

Waltonalsoexpressedconsternationat theNSA’s inaccuratedescriptionofits use of the database, saying it slowed efforts to fix the errors. “Thegovernment’s failure to ensure that responsibleofficials adequatelyunderstoodtheNSA’s alert list process, and to accurately report its implementation to thecourt,haspreventedformorethantwoyears,boththegovernmentandtheFISCfromtakingstepstoremedydailyviolations,”Waltonwrote.

After the problems came to light, theNSA and the Justice Department inFebruary 2009 began a full review of the program. The review identifiedadditionalviolationsthatneededfixing,thedocumentsshow.

Forinstance,thereviewfoundthat“overtime”morethan200analystsfromtheCIA,theFBIandtheNationalCounterterrorismCenterhadaccessto“queryresults” from the database that did not properly mask the identities of U.S.persons.

InSeptember2009,theJusticeDepartmentreportedthatqueryresultswere

shared with NSA analysts who were not trained in how to handle the data.Waltonnoted that the problems came after the government’s “submissionof areportintendedtoassuretheCourtthattheNSAhadcorrectedandaddressedtheissues.”

In November 2009, Walton also expressed concern that the NSA hadsearchedphonenumberslongafterthenumbershadbeenfoundtobeirrelevantand said he “remained concerned” that the NSA did not meet the requiredstandard for using the numbers, exposing information about Americans whowerenotthesubjectofFBIinvestigations.Walton’sMarchrulingalsoexpressedskepticism about the program’s utility, noting the government cited only threeFBI preliminary investigations opened as a result of tips gleaned from thedatabase.“ThetimehascomeforthegovernmenttodescribetotheCourthow,basedon the informationcollectedandanalyzedduring that time, thevalueofthe program to the nation’s security justifies the continued collected andretentionofmassivequantitiesofUSpersoninformation,”hesaid.

The documents were released in response to lawsuits from the ElectronicFrontierFoundationand theACLU.TheEFFfirstsoughtdisclosure twoyearsago when Congress was debating reauthorization of the statute that thegovernmentusedtojustifythephonecollection.

“At that time, the government withheld every word, claiming that graveharmtonationalsecuritywouldresultifthecourt’sopinionswerereleased,”saidDavid Sobel, the foundation’s senior counsel. “Now that the agency has beenforcedtoreleasethem,wecanseethattherealreasonforsecrecywastoconcealthefactthatsurveillanceunderthePatriotActwasfarbroader,andlessfocused,thanthepublicandCongresshadbeenledtobelieve.”

FISAcourtreleasesopinionupholdingNSAphoneprogram

ByEllenNakashimaSeptember17,2013

A federal surveillance court on Tuesday released a declassified opinionupholding the constitutionality of the National Security Agency’s sweepingcollectionofbillionsofAmericans’phonerecordsforcounterterrorismpurposes.

Thegatheringof“allcalldetailrecords”fromphonecompaniesis justifiedas long as the government can show that it is relevant to an authorizedinvestigation intoknown—and, significantly—unknown terroristswhomaybeintheUnitedStates,theAug.29opinionstates.

Moreover, the government need only show that there are “reasonablegrounds to believe” the records will be relevant to the investigation, a lowerburden than required in ordinary criminal investigations. That is justifiedbecausethegoalistopreventaterroristattack,notsolveacrimethathasalreadytakenplace,thecourtsaid,affirmingthegovernment’sposition.

Takentogether,theargumentisaboldassertionofauthoritythatcriticssayisnot justified by the Foreign Intelligence Surveillance Act (FISA) or theConstitution.Someelementsof thecourt’s reasoninghadbeendiscussed inanearlier Justice Department white paper released by the government, but theconceptof the“unknown” terroristand theargument for the lowerburdenhadnotbeenexplicitlylinkedtotheprogram.

The 29-page opinion signed by Claire V. Eagan, a judge on the secretiveForeign Intelligence SurveillanceCourt (FISC), is the first to be released that

addresses theconstitutionalityof theNSA’s“bulkrecords”collectionofphonedata. It isanattempt toaddressgrowingcriticismabout thebroadsurveillancesinceitsexistencewasdisclosedinJuneinadocumentleakedtotheGuardian,aBritish newspaper, by formerNSA contractor Edward Snowden. The programwasauthorizedbythecourtin2006underSection215ofthePatriotAct,whichamended FISA, but that was not known until June. In the program, theNSAgathersrecordsofphonecalls,theirtimeandduration,butnotsubscribernamesorcallcontent.

TheopinionwasreleasedatEagan’swill,JusticeDepartmentofficialssaid,not at the request of the government or in response to lawsuits from civillibertiesgroups.Eagan,appointedtothefederalbenchinOklahomabyPresidentGeorgeW.Bush,isafairlynewmemberoftheFISC.

A senior JusticeDepartment official said that it is not a substitute for therelease of other lengthier, significant opinions relating to the surveillanceprogram.

Privacyadvocatesreactedwithdismayuponreadingtheruling.“Thisisn’tajudicialopinionintheconventionalsense,”saidJameelJaffer,

American Civil Liberties Union deputy legal director. “It’s a document thatappears to have been cobbled together over the last fewweeks in an effort tojustifyadecisionthatwasmadesevenyearsago.Idon’tknowofanyprecedentforthat,anditraisesalotofquestions.”

Jafferaddedthattheopinionwas“completelyunpersuasive”asadefenseofthe call-records program. The constitutional analysis fails to mention thelandmarkUnitedStatesv.JonesprivacycasedecidedbytheSupremeCourtlastyear,which suggested awarrantwas necessary for long-term trackingofGPSdata, he said.AndEagan’s analysis of the statute overemphasizes some termswhileignoringothers,hesaid.

“On the whole, the opinion only confirms the folly of entrusting privacyrights to a court that hears argument only from the government,” said Jaffer,referringtothefactthatthereisnoadversaryintheclassifiedproceedings.

Eagan’srulingendorsedthegovernment’sargumentthatthebroadcollectionwas necessary to find unknown terrorist operativeswhomaybe in theUnitedStates “because it is impossible to knowwhere in the data the connections tointernationalterroristorganizationswillbefound.”

The senior Justice Department official said the “unknown” language wasimportant.“Ifyouknowwhoallthepeoplewere,youwouldjustask[thephonecompanies] for those numbers,” he said. “So that’s why you need all thosenumbers…Thebottomlineisthis:Youhavetohavethislargerbodyofdatatofindtheneedlesinthehaystack.”

The ruling also reaffirmed the government’s contention, upheld by theSupreme Court in 1979, that Americans have no reasonable expectation ofprivacy in records of their calls held by phone companies, and a warrant tocollectthemisnotrequired.Awarrantwouldberequiredtowiretapthecalls.

Eagan asserted that to date, no company has challenged the legality of anorder.ShealsostatedthatCongressratifiedtheprogramwhenitreauthorizedthestatutewithoutchangein2010and2011,becauseithadaccesstoinformationonthestatute’sapplicationtothephoneprogram.

Kurt Opsahl, senior staff attorney at Electronic Frontier Foundation,disagreed. “The outrage ofmany Congressmembers” upon hearing about theprogram’sscope“shows this isnot true.Weshouldnothave the legalbasisofthesurveillancestaterestingonajudiciallycreatedlegalfiction.”

U.S.officialsdodgequestionsonscopeofsurveillance

ByEllenNakashimaSeptember26,2013

TheSenateSelectIntelligenceCommitteeholdsaconfirmationhearingtohear thetestimonyofnomineeJamesClappertofillthevacancyofdirectorofNationalIntelligence(DNI),onCapitolHillTuesdayJuly20,2010.(PhotobyMelinaMara/TheWashingtonPost)

U.S. officials declined to directly answer lawmakers’ questions on ThursdayaboutthefullscopeoftheNationalSecurityAgency’scollectionofAmericans’

data,includingwhetherithaseversoughttoacquirelargevolumesofcellphonelocationinformationorotherrecords.

NSADirectorKeithAlexanderdodgedquestionsbyaseniormemberoftheSenate Intelligence Committee about whether the agency has ever tried toaugment its broad collection of virtually allAmericans’ phone-call records bygathering data that would indicate the callers’ locations. He noted thatintelligenceofficialshadgivenaclassifiedanswertothequestion.

“Ifyou’rerespondingtomyquestionbynotansweringitbecauseyouthinkit’s a classified matter, that is your right,” Sen. Ron Wyden (D-Ore.) toldAlexanderatahearingaboutthegovernment’sintelligence-gatheringprograms.

“Wewill continue to explore that,”Wyden said, “because I believe this issomethingthattheAmericanpeoplehavearighttoknow—whethertheNSAhasevercollectedormadeplanstocollectcellsiteinformation.”

Questions by Wyden and Sen. Mark Udall (D-Colo.) suggested that theagency has at least sought if not won permission to expand its domesticcollectionactivitiesbeyondwhathasbeenpubliclyacknowledged.

Theirpointedquestioningofofficialsstoodincontrasttomostlysympatheticlinesofqueryingfromotherpanelmembers,whomadeclear that theysupportthephone-logsprogramasavitalcounterterrorismtoolandaccusedthemediaofinaccurateandmisleadingcoverage.CommitteeChairmanDianneFeinstein(D-Calif.)saidsuchcoverage“hasledtoanunfortunate…skepticismanddistrust”oftheintelligencecommunity.

The existence of the phone-records collection, and its authorization by afederalsurveillancecourt,wasrevealedinJunewhentheGuardiannewspaperinBritain published a court order to a phone company leaked by former NSAcontractorEdwardSnowden.LeaksregardingotherNSAprogramsensuedandhaveputtheadministrationonthedefensive,forcingit,asDirectorofNationalIntelligenceJamesR.ClapperJr.saidThursday,to“lower…thethreshold”fordisclosure.

Alexander and other officials stressed that the call database contains only

phonenumbersandthetimeanddurationofcalls,butnoconversationcontent,subscriber names or cell site location. But Alexander acknowledged that theNSA is interested in compiling the largest national database possible, and thatthereisnolimit tothenumberofrecordsthatcanbegathered.Thestorehouseholdsbillionsofrecords,formerofficialshavetoldTheWashingtonPost.

“Is it thegoal of theNSA to collect thephone recordsof allAmericans?”Udallasked.

“Ibelieveitisinthenation’sbestintereststoputallthephonerecordsintoalockbox thatwe could searchwhen the nationneeds to do it, yes,”Alexandersaid.

Thegovernmenthasclaimed theauthority togather thedataunderSection215oftheUSAPatriotAct,alsoknownasthe“businessrecords”provisionoftheForeign IntelligenceSurveillanceAct.TheFISAcourt in2006 agreed thatthegovernmentcouldusethatstatutetoorderphonecompaniestohandover“allcalldetailrecords”dailytotheNSA.

AskedbyUdallifthatstatutegaveNSAtheauthoritytocollectotherdata—such as utility bills — Deputy Attorney General James M. Cole offered aqualifiedanswer.“It’sgiven them theauthority tocollectotherbulk records ifthey can show that it is necessary to find something relevant to a foreignintelligenceinvestigationofparticulartypes…It’snotjustallbulkrecords.Butit’salsonotnobusinessrecords.It’salldependentonthepurpose.”

Atthehearing’soutset,Clapperassertedthattheleaks“havebeenextremelydamaging”tonationalsecurity.“Thesedisclosuresarethreateningourabilitytocollectintelligenceandkeepourcountrysafe,”hesaid.“There’snowaytoeraseormakeupforthedamagethathasalreadybeendone.Weanticipatemoreaswecontinueourassessment.”

FeinsteinsaidsheandSaxbyChambliss(Ga.),therankingRepublicanonthepanel, have begun drafting legislation that would reform the nation’ssurveillancesystem,includingameasurethatwouldrequireSenateconfirmation

oftheNSAdirector.Theirbillalsowouldlimitaccesstophonerecordscollectedbytheagency,andreducethelengthoftimetherecordscanbeheld.

Wyden,Udall andother lawmakershave introduced reform legislation thatwould,amongotherthings,endthephonerecordscollection,whileallowingforamorelimitedprogram.

OnThursday,WydenaccusedU.S.officialsofnotbeingmoreforthcomingaboutintelligence-collectionprograms.

“Theleadershipofyouragenciesbuiltanintelligence-collectionsystemthatrepeatedlydeceived theAmericanpeople,”he said. “Timeand timeagain, theAmerican people were told one thing about domestic surveillance in publicforumswhilegovernmentagenciesdidsomethingelseinprivate.”

NSAreportontheTorEncryptedNetwork

ByBartonGellmanOctober4,2013

On Nov. 1, 2007, the National Security Agency hosted a talk by RogerDingledine, principal designer of one of the world’s leading Internet privacytools.Itwasawaryencounter,akintomutualintelligencegathering,betweenaspyagencyandamanwhobuilttoolstowardoffelectronicsurveillance.

Accordingtoatop-secretNSAsummaryofthemeeting,DingledinetoldtheassembledNSA staff that his service, calledTor, offered anonymity to peoplewho needed it badly— to keep business secrets, protect their identities fromoppressivepolitical regimesor conduct researchwithout revealing themselves.InthemindsofNSAofficials,Torwasofferingprotectiontoterroristsandotherintelligencetargets.

As he spoke to the NSA, Dingledine said in an interview Friday, hesuspectedtheagencywasattemptingtobreakintoTor,whichisusedbymillionsofpeoplearoundtheworldtoshieldtheiridentities.DocumentsprovidedtoTheWashington Post by former agency contractor Edward Snowden show that hewasright.

Beginning at least a year beforeDingledine’s visit, theNSA hasmountedincreasinglysuccessfulattackstounmasktheidentitiesandlocationsofusersofTor. In some cases, the agency has succeeded in blocking access to theanonymousnetwork,divertingTorusers to insecure channels. Inothers, it hasbeenableto“stain”anonymoustrafficasitenterstheTornetwork,enablingtheNSAtoidentifyusersasitexits.

Tor works by encrypting traffic repeatedly as it flows across a globalnetworkofservers,mostlyrunbyvolunteers.Thetraffic,whichcanincludee-mails, informationfromaWebsiteandalmostanythingelseontheInternet, issupposed to arrive at its destination with no identifying information about itsoriginorthepathittook.

The Snowden documents, including a detailed PowerPoint presentation,suggest that theNSAcannot see directly insideTor’s anonymous network butthat ithas repeatedlyuncloakedusersbycircumventingTor’sprotections.Thedocuments also illustrate the power of the NSA to at least partially penetratewhathavelongbeenconsideredthemostsecurecornersoftheInternet.

TheU.S.NavalResearchLaboratoryfirstdevelopedTormorethanadecadeago as a tool to allow anonymous communications andWeb browsing. Itwasembraced by privacy advocates, including the Electronic Frontier Foundation,andcontinues to receivesubstantial federal funding.Tor isnowmaintainedbyDingledine’snonprofitgroup,theTorProject.

TheStateDepartmenttrainspoliticalactivistsworldwideonhowtouseTorto protect communications from the intelligence services of repressivegovernments.Buttheanonymityservicealsohasbecomepopularwithcriminals— especially dealers of illicit drugs, military-grade weapons and childpornography—andterroristsseekingtoevadetrackingbyWesternintelligenceservices.

Oneof thedocumentsprovidedbySnowden said anNSA techniquecode-namedEGOTISTICALGIRAFFEhadsucceededinunmasking24Torusersinasingleweekend.ThesameoperationallowedtheNSAtodiscovertheidentityofa key propagandist for al-Qaeda in the Arabian Peninsula, as the group’soffshootinYemenisknown,afterhepostedinformationandinstructionsonthegroup’sWebsite.

NSAanti-anonymitytechniquesarenowalsobeingusedbylawenforcementagencies. In August, civilian security researchers detected an FBI operationagainst an alleged child pornography ring that used a Tor-based Web server

calledFreedomHosting.TheFBImountedacyberattacktounmaskthelocationandownerofthatanonymousserver,usingpreciselythetechniquedescribedasEGOTISTICALGIRAFFE.

TheWashington Post is not releasing certain details from the documents,including the name of the al-Qaeda operative. Documents about the NSA’sattempts to penetrate Tor were also shared with the British newspaper theGuardian,whichpublishedareportontheeffortFriday.

Inastatement,DirectorofNational IntelligenceJamesR.ClapperJr.,whooversees the NSA and other intelligence agencies, said that the intelligencecommunity “seeks to understand” tools that facilitate anonymouscommunication.He added that it does so because of the “undeniable fact thatthese are the tools our adversaries use to communicate and coordinate attacksagainsttheUnitedStatesandourallies.”

Theintelligencecommunity“isonlyinterestedincommunicationrelatedtovalidforeignintelligenceandcounterintelligencepurposes,”Clappersaid.

There is no evidence that the NSA is capable of unmasking Tor trafficroutinelyonaglobalscale.Butforalmostsevenyears,ithasbeentrying.

Since2006, according to a49-page researchpaper titled simply “Tor,” theagencyhasworkedonseveralmethodsthat,ifsuccessful,wouldallowtheNSAto uncloak anonymous traffic on a “wide scale” — effectively by watchingcommunications as they enter and exit the Tor system, rather than trying tofollow them inside. One type of attack, for example, would identify users byminutedifferencesintheclocktimesontheircomputers.

Dingledineexpressednosurprisethat theNSAhastriedtodefeateffortsatanonymity. In the interview, he said the weaknesses in Tor described in thePowerPointpresentationlikelycouldbeexploitedonlyagainstarelativelysmallnumberofindividualusers.That,hesaid,isreassuring.

“Ifthosedocumentsactuallyrepresentwhattheycando,theyarenotasbiganadversaryasIthought,”hesaid.

The Tor Browser Bundle, available for free at www.torproject.org, was

downloaded 40million times last year. Until a recent security upgrade to theFirefox browser,which is incorporated in the bundle, theNSAcould trick thebrowser into leaking the real Internet address of a targeted user. One slidedescribedthesetacticsas“prettymuchguaranteedtosucceed.”

Mozilla, the nonprofit organization that develops Firefox, declined tocomment.

OnedocumentprovidedbySnowden includedan internalexchangeamongNSAhackersinwhichoneofthemsaidtheagency’sRemoteOperationsCenterwascapableoftargetinganyonewhovisitedanal-QaedaWebsiteusingTor.

“TheROCcurrently [operates]againstcertainextremistweb forumsat themoment,”theemployeewrote.“Iamundertheimpressionthattheycanserveupanexploit”—hackerjargonformaliciouscode—“toprettymuchanyonethatvisitstheparticularwebforum,though.”

“Likeanytool,[Tor]canbeusedforsomethinggood,anditcanbeusedforsomething bad,” said Garth Bruen, a Boston-based investigator who studiesInternetcrimes.“It’sallabouthowpeopleareusingit,andcriminalshavebeenusingittogreatadvantage.. . .It’sanightmare.”

AnFBIagenttoldanIrishcourtlastmonththatFreedomHosting,unmaskedwith NSA-devised techniques, was among the largest purveyors of childpornography in the world, according to news reports. Silk Road, an onlinemarketplacesomecalled“theeBayof illicit substances,”alsoreliedonTor—andwas targetedby theFBI.Federalofficialsarrested theallegedfounderandshutdownthesiteWednesday.

Privacy advocates, however, say Tor is valuable and should be protectedevenifitissometimesusedbycriminals.“Torisnetworkingtechnology,”saidChristopherSoghoian,anAmericanCivilLibertiesUniontechnologyexpert.“Itisnodifferentfromapostagestamporahighway.Goodpeopleusehighways,andbadpeopleusehighways.”

TheNSAdocumentsportrayayears-longprogramtodefeatwhattheagencycalled “The Tor Problem,” with the agency repeatedly updating its tactics as

Tor’sdevelopersmadechangestothenetwork.TheNSAalsoalteredtacticsasMozillaintroducednewversionsofFirefox.

InanticipationofanewreleaseofFirefox,oneagencyofficialwroteinJanuarythatanewexploitwasunderdevelopment:“I’mconfidentwecanhaveitreadywhentheyreleasesomethingnew,orverysoonafter:).”

Inlate2006,whentheNSApreparedaworkingpaperonmethodstodefeatTor,theanonymousnetworkhadanestimated200,000usersand1,000servers.AmongthesecretNSAdocumentswerelistsofhundredsofserverstheagencybelievedtobe“nodes”onthatnetwork.

Along with EGOTISTICALGIRAFFE, the agency’s cover names for Torattacks have included MJOLNIR, MOTHMONSTER andEGOTISTICALGOAT. A similar program at Britain’s GovernmentCommunicationsHeadquarters,theNSA’sclosecounterpart,wascalledSTUNTWORM.

OneNSAPowerPoint presentation providedbySnowden is titled “PeelingBacktheLayersofTORwithEGOTISTICALGIRAFFE.”

Theagencybegan identifyingbrowsers thatwereusingTorbynotinghowthe encryption program reset what’s called the BuildID — a 14-digit coderepresentingtheexactdateandtimewhenthatversionofFirefoxwasreleased.OnversionsusingTor,theBuildIDisresetto“0.”ThatfeaturemadeithardtodistinguishoneToruser fromanother,but italsoallowed theNSAtopickoutTor-enabledbrowsersfromamongallothersinuseatanygivenmoment.

“It’seasy!”aslidedescribingthetechniquesaid.Mozilla issued apatch toFirefox thatwouldprotect newerversionsof the

browser against such an attack, though the NSA documents make clear thatresearchintonewexploitsremainsactive.

OnePowerPointslidesumsupamultistepmethodfor learning the identityandlocationofTorusersandimplantingNSAcodeinthebrowser.Itendswithafinalbulletpointsaying,“Win!”

AshkanSoltaniandJulieTatecontributedtothisreport.

AdditionalContent:NSAreportontheTorencryptednetwork

Dual-leadershiproleatNSAandCyberCommandstirsdebate

ByEllenNakashimaOctober6,2013

MarkYoung,formerexecutivedirectorfor theDirectorateforPlansandPolicyatU.S.CyberCommand.One military official oversees both the NSA and Cyber Command. (Photo by Jeffrey MacMillan/TheWashingtonPost)

DuringsuspectedIraniancyberattacksontheWebsitesofcommercialbankslastyear,Gen.KeithB.Alexander,whosimultaneouslyheads thecountry’s largest

electronic spy agency and the military’s Cyber Command, proposed a simplesolution:Shutofftheattacksattheirsource.

“We had the expertise and could have done something about it,” said oneU.S.official,wholikeothersinterviewedforthisstorespokeontheconditionofanonymity to describe sensitive discussions. “We’re sitting on their networksoverseas.Whydon’twejustturnitoff?”

Buttheproposaltosendasimplecomputer“reset”commandtotheattackingserverswasultimatelyrejectedbyNationalSecurityCouncilofficials thisyearbecause the attacks were not causing enough harm to warrant an offensiveresponse.

Theepisodeshowsthewillingness—somesayeagerness—ofAlexandertouse his authority to conduct offensive actions to fend off attacks against theprivatesector.Ifasimilarproposalwereonthetabletoday,itwouldbethenewcyber-teamsthatAlexanderiscreatingtodefendthenationthatprobablywoulddothejob.

As he builds out U.S. Cyber Command at Fort Meade, Md., and otherinstallationstoafightingforceof6,000overthenextthreeyears,therearefreshquestions about the wisdom of so much power residing in one“dual-hatted”official.

Thedebatehas takenongreater significance in thewakeofdisclosuresbyformer National Security Agency contractor Edward Snowden about thesweepingscopeoftheagency’sdomesticsurveillancetothwartterroristattacksandgainforeignintelligence.

“The mashing together of the NSA and Cyber Command has blurred thelinesbetweenamilitarycommandandanationalspyagency,”saidPeterSinger,aBrookingsInstitutionexpertonevolvingmodesofwarfare.

Alexanderdisagrees.“It’sonenetwork,”hesaid inarecent interview.“Wealloperateonthesamenetwork.Youcreatemoreproblemsbytryingtoseparatethemandhavetwopeoplefightingoverwho’sincharge[ofbothmissions]thanputtingitalltogether.Ithinkournationbenefitsfromthat.”

He said that other countries “do similar things.” Britain’s GCHQ, theequivalent of the NSA, is able to conduct espionage and computer-networkattacks.

WithAlexanderexpectedtoretirenextyearaftereightyearsasthelongest-servingNSAdirector,hissuccessorwillfacethequestions.

Administrationofficialsacknowledgethatthereareconcernswithwhattheycallthedual-hatassignment,whichincludesregularlybriefingthepresidentoncounterterrorism.“Itisanunusualarrangement,”saidonesenioradministrationofficial, speaking on the condition of anonymity. “I’m sure that debate willresurface when General Alexander leaves that position— whether that’s therightmixturetohave.”

When it comes to cyberattacks,much of it is done by theNSA’s TailoredAccess Operations unit, officials say. Many of the operators are uniformedmilitary personnel who spy on overseas networks for national intelligencepriorities, includingtargetssuchasIran,RussiaandNorthKorea,amongothercountries.

According to interviews with U.S. officials, these same personnel, whooperate under intelligence legal authorities,may switch to amilitary authoritywhentheyareorderedtoconductacomputerattackunderanexecuteorderbythepresidentandthedefensesecretary.Theprocessisdocumented.“Youcanbedoingintelligence-gatheringonesecondandthenpullthetriggeronanoffensiveopthenext,”aformerintelligenceofficialsaid.

“We’re allowing the same military commander to tell us how bad theproblemisandproposeandimplementsuggestionstofixit,”saidJasonHealey,directoroftheAtlanticCouncil’sCyberStatecraftInitiative.“TheconcentrationofpoweratFortMeaderisksfurthermilitarizingcyberspace.”

Alexander and his supporters have long argued that the NSA and CyberCommandmustbecloselyconnectedbecausesomuchofwhatCyberCommandwassetuptodo—fromdefendtoattack—dependsonintelligencethatcomes

from the NSA. To re-create the NSA’s capabilities is neither feasible nordesirable,officialssay.

“It would be folly to separate them,” a former senior intelligence officialsaid.

Suchcoordination,Alexandersaid, iskey to theUnitedStates’cyberattackprowess.

“Cyber offense requires a deep, persistent and pervasive presence onadversary networks in order to precisely deliver effects,” Alexander told theHouseArmedServicesCommitteeinMarchinawrittenresponsetoquestions.

Effects could include things such as stopping a denial-of-service attack,rerouting a jihadi Web site and disrupting an industrial control or militaryweaponssystem,actionsthatgenerallyrequirepresidentialpermission.

TheNSAand theCIA carried out 231 offensive cyber-operations in 2011,according to classified budget documents obtained by Snowden, TheWashingtonPostreportedlastmonth.Theirexactnaturewasnotdetailedinthedocuments,butmostoffensiveoperationshaveimmediateeffectsonlyondataorthe proper functioning of an adversary’s machine: slowing its networkconnectionorscramblingtheresultsofbasiccalculations,whichtheNSAwoulddoforforeignintelligencepurposes.TheNSA,officialssay,doesnotconducta“computernetworkattack.”Thatisdonebythemilitaryunderanexecuteorder.

But it can help develop the weapons used in a covert operation, as wasreportedly thecasewithStuxnet, acomputerwormused inanextensiveU.S.-IsraelicampaigntodelayIran’snuclearprogrambydisruptingcentrifugesinanuraniumenrichmentplant.

The House and Senate Armed Services committees have raised concernswith the dual-hat arrangement, as well as with a proposal to elevate CyberCommand to a unified commandon a parwithCentralCommand andPacificCommand.ThecyberunitfallsunderStrategicCommandinOmaha, thoughitleaves considerable leeway in policy and operational matters to Alexander,officialssay.Themovetoaunifiedcommand,oncelookeduponasasurebet,

has been slowed because of concerns on Capitol Hill and the Snowdendisclosures.

Alexander ismovingaheadwithplanstobuildout thefledglingcommand.Bytheendof2016,therewillbe133teams,withabout2,000newpersonnelinplace.About4,000willbecomingfromtheservices.Alexandersaiditwilltakeacoupleofyearstotraintheteams.

Of the 133 teams, 27 will support the combatant organizations such asCentralCommand, PacificCommand andEuropeanCommand.Key questionsremainas tohowwell the teamswillmeetcombatantcommanders’needsandpriorities.

Perhaps themost controversial, though, are the 13 nationalmission teams,whose job it will be to defend the nation in the event of attacks on criticalsystemsintheprivatesector.

SomeinthemilitarysayitisnottheDefenseDepartment’sjobtostaveoffattacks against U.S. private-sector systems. “My role is to fight wars— notprotecttheprivatesector,”washowonemilitaryofficialputit.

Buttosettletheargument,lastyear,then-DefenseSecretaryLeonE.Panettasignedamemostating that itwas theDefenseDepartment’srole todefend thecountryagainstcyberattacks.

Thenationalmission forcesare “absolutelycritical,”Alexander said in therecentinterview.“It’sthefuture.Thereareonlyacoupleofwaysthatpeoplecanhurtthiscountry:terrorismandcyber.We’redoingreallygoodagainstterrorism.Ourcyber-forcewehavetobuildup.”

NSAtriestoregainindustry’strusttoworkcooperativelyagainstcyber-threats

ByEllenNakashimaOctober10,2013

InthisslidefromaNationalSecurityAgencypresentationon“GoogleCloudExploitation,”asketchshowswherethe“PublicInternet”meetstheinternal“GoogleCloud”whereuserdataresides.TwoengineerswithclosetiestoGoogleexplodedinprofanitywhentheysawthedrawing.

A drop in Americans’ trust in the government is making the difficult task ofpublic-privatecooperationagainstcyber-threatsevenmoredifficult.

And that has officials such as Gen. Keith B. Alexander, director of theNational Security Agency, scrambling to shore up confidence in his agency,whose image has taken a beating in the wake of leaks about its surveillanceprogramsbyformerNSAcontractorEdwardSnowden.

At public hearings and in speeches, Alexander, who also heads the U.S.CyberCommand,iswarningthatcyberattacksonsuchcriticalandtechnology-dependentindustriesasenergy,financeandtransportationcanbepreventedonlyif those industries work with the government. But companies are wary ofpartneringwithanagencythathasbeenrevealedtobeconductingfar-reachingdomesticdatacollectioninthenameofthwartingterrorism.

“Industry iscritical to resolvingourproblems” incybersecurity,Alexandersaid at the Billington Cybersecurity Summit last month at the National PressClub.

Toward that end, he said, Congress needs to pass “cyber-legislation” toencourageprivatecompaniestosharedataoncyber-threats.AbipartisanbilltheHousepassedinAprilwouldprovideimmunityfromcivil lawsuitsorcriminalprosecution to companies that give the Department of Homeland Securitynetworkdata thatmightcontainevidenceofsuch threats.DHSwouldpass thedataontorelevantagencies,suchastheNSA.

Alexander said the protected data would be limited to technical materialindicating vulnerabilities in systems and hackers’ tracks. “We’re not talkingaboutsharingourprivateinformation,”heassuredthesummitaudience.

But there is wide recognition within and outside the government that theSnowden leaks, which began in June, have created a deficit of trust. “It wastoughenoughto[passthebill]whenthewaterswerecalm,”MichaelV.Hayden,Alexander’s predecessor as NSA director, said last week at The WashingtonPost’s Cyber Summit. “Now [proponents are] trying to do it in whitewaterrapids,andit’snotgoingtohappen.”

Even before the Snowden revelations, theWhiteHouse threatened to vetothebillongroundsitlackedadequatesafeguardsforAmericans’privacy,among

otherthings.Now,expertssay,itisincreasinglyunlikelythattheHouseversionwillemergefromtheSenate.

“Idon’t thinkanybody thinks it’s realistic toput theNSAin themiddleofdomestic cybersecurity at this point,” said Michelle Richardson, legislativecounselattheAmericanCivilLibertiesUnion.

Oneof themost consequentialSnowden leakswas a classified court orderwhose publication forced the government to acknowledge that the NSA hadobtainedsecretcourtpermissionin2006togatherthephonerecordsofvirtuallyallAmericans—billionsofcalls—tosearchforcluestoterroristplots.Anotherleak detailed how nine Internet companies — including Yahoo, Google andMicrosoft—cooperated,undercourtorder,withtheNSAtocollecte-mailsandotherdigitaldatafromlawfulforeigntargets.

Thescaleof thedatacollectionstunnedAmericans, saidPaulTiao, formerseniorcounselortotheFBIdirectorwhoisapartneratHunton&Williams.“Idon’t thinka lotofpeople thought theyhadall that information.TheNSAhasbeentryingtoovercomethateversince.”

Companieshavelongbeensensitivetotheimplicationsofsharingdatawiththe government, fearing harm to their reputations and potential lawsuits forprivacy and other violations, Tiao said. “The Snowden disclosures havemadecompanies more careful about what they might share with the governmentbecausetheyknowthat thepublicis thatmuchmoreconcernedaboutit.”Andrestoringconfidence,expertssay,dependsonhowmeaningfulthegovernment’ssurveillancereformsare.

Here’s the reality: The bits and bytes that zip through computer networkseachdayservemanypurposes.Someareinnocentmessagesandimagessentbyfriends,co-workersormarketers.Butotherscontainforeignintelligenceusefultothegovernmentsuchasindicationsofterroristactivity.Andsomemaycontainmalicious software or signals from foreign hackers designed to disrupt U.S.industrialnetworksorstealsecretsfromcompanies.

TheNSAissupposedtoignorethefirstcategoryofmessagesasitintercepts

the second. But Snowden’s leaks have cast doubt on how well the agencyprotects the privacy of Americans’ communications it “inadvertently” collectswhileeavesdroppingonforeigntargets.

And that is impeding its efforts to be more successful at seeing the thirdcategory: the data that indicate a cyberattack is brewing.Whether the agencyshouldhavethatcapabilityisthecruxofthatdebate.

Administration officials are optimistic about another initiative: a voluntaryframework—which PresidentObama ordered— to help companies improvetheirnetworksecurity.TheNationalInstituteofStandardsandTechnologyisontracktoissueapreliminaryframeworkthisweekthatincludescontrolssuchasacompanyidentifyingitscomputersystemssoitknowswhatithas.It’safarcryfrom the administration’s initial goal of mandatory industry standards. But,White House cybersecurity coordinator Michael Daniel said, “it will providecompaniesagoodwayof thinkingabout theircyber-riskandgivethemaverystructuredwaytomitigatethatrisk.”

Theoutlineshouldmakeiteasiertoelevatethecyber-riskdiscussiontotheboardroom, on a par with financial risk issues, Daniel said. “This structuredprocesswill reallymakeitmucheasierforcompanies thathaven’t tackled thisproblemasfullyastheywouldliketo.”

Rick Dakin, chief executive of Coalfire Systems in Louisville, Colo.,predicted that industrywouldget“tremendousmileage”outof the framework.“If you’re an exec today and you know there’s a downside if you’re notcomplying with that industry standard, wouldn’t you want that standarddefined?”hesaid.“It’sreallytoindustry’sbenefittoknow.”

But Paul Rosenzweig, a former Department of Homeland Security deputyassistant secretary for policy who consults on cybersecurity, called theframeworka“modestlyusefulcompilationofexistingstandards”that“breaksnonewground.”Anybodywhooperateshigh-risksystems,hesaid,alreadyknowsmostofwhat is in it.And some industryofficials say the framework is a steptowardregulationthatwillstifleinnovation.

Mark Weatherford, former deputy undersecretary for cybersecurity at theDepartmentofHomelandSecurity, said it’sup to industry to raise itsgame—because the government’s role is limited by restrictions on the sharing ofclassified information and other policy constraints. “The government is notgoingtocomeridinginonawhitehorsetorescueyouwhenyouhaveasecurityincident,”hesaidataspeechinAugust.“Thegovernmentissimplyunable,atleast today, toprovidetimelyandactionableinformationwhenyoureallyneedit.”

Danielsaidthenextstepistocreateincentivesforindustrytoadoptthebestpracticessuggested in theframework—immunityfromlawsuits, forexample,orcontractingadvantages.

Thebottomline,expertssay,isthatcyber-legislationlooksunlikelywithouttrustingovernment—unlessthere’samajorcyberattackontheUnitedStates.

“That,”Tiaosaid,“couldchangethings.”

EffortunderwaytodeclassifydocumentthatislegalfoundationforNSAphone

program

ByEllenNakashimaandCarolD.LeonnigOctober12,2013

IntherecentstreamofdisclosuresaboutNationalSecurityAgencysurveillanceprograms, one document, sources say, has been conspicuously absent: theoriginal—and still classified— judicial interpretation that held that the bulkcollectionofAmericans’datawaslawful.

That document,written byColleenKollar-Kotelly, then chief judge of theForeign Intelligence Surveillance Court (FISC), provided the legal foundationfor theNSAamassingadatabaseofallAmericans’phone records, saycurrentandformerofficialswhohavereadit.

Now,more officials are saying thatAmericans should be able to read andunderstand how an important precedent was established under the 2001 USAPatriotAct,whichwaspassedaftertheSept.11,2001,attacks.

“TheoriginallegalinterpretationthatsaidthatthePatriotActcouldbeusedto collectAmericans’ records in bulk should never have been kept secret andshould be declassified and released,” Sen. Ron Wyden (D-Ore) said in astatementtoTheWashingtonPost.“Thiscollectionhasbeenongoingforyearsandthepublicshouldbeabletocomparethelegalinterpretationunderwhichitwasoriginallyauthorizedwithmorerecentdocuments.”

Kollar-Kotelly told associates this summer that she wanted her legalargument out, according to two people familiar with what she said. Severalmembersoftheintelligencecourtwantmoretransparencyaboutthecourt’sroleto dispel what they consider a misperception that the court acted as a rubberstamp for the administration’s top-secret spying programs. The courtmeets insecret tohear applications fordomestic surveillanceand itsopinionsgenerallyarenotmadepublic.

Kollar-Kotelly,whoisno longeron theFISC,declined tocomment,asdidthecurrentchiefjudge,ReggieB.Walton.

Kollar-Kotelly’s interpretation served as the legal basis for a courtauthorization inMay2006thatallowedtheNSAtogatheronadailybasis thephonerecordsoftensofmillionsofAmericans,sourcessay.Heranalysis,morethan80pageslong,was“painstakinglythorough,”saidonepersonwhoreadit.Thedateoftheanalysishasnotbeendisclosed.

Thebroadoutlinesofthejudge’sargumenthavebeenrevealedviaaJusticeDepartment “white paper.” And last month, the administration released a 29-page opinion written in August that defended the program by assertingessentiallythataslongassomeAmericans’phonerecordsmightbe“relevant”toaterrorisminvestigation,thegovernmentmaycollectthemall.Butthatopinion,currentandformerofficialssaid,isnotasubstituteforKollar-Kotelly’soriginalinterpretation.

“Ifthequestionis,‘Howwasthisprogramauthorizedandwhattypeoflegalanalysis first took place?’ the 2013 opinion is just not responsive,” said oneformerseniorObamaadministrationofficial.“It’shardformetoimagine,withallthat’salreadyoutthere,thathighlyclassifiedintelligencematerialwouldbesodeeplyentwinedin thelegalanalysis in thatoriginal interpretationthat theycouldn’tsomehowreleaseit.”

Asked to comment, Justice Department spokesman Brian Fallon said,“Already so far, the department has declassified a white paper explaining thelegalbasisforthe[phonerecords]program,andthecourthaspubliclypostedan

opinionupholdingitslawfulness.”HedeclinedtoconfirmordenytheexistenceofKollar-Kotelly’soriginalinterpretation.

AccordingtoadraftNSAinspectorgeneralreportobtainedbyThePostfromformerNSAcontractorEdwardSnowden,Kollar-Kotelly in2004approvedtheNSA’s collection of Americans’ bulk e-mail metadata records (to-fromaddresses,dates, timestamps,etc.)usingaPatriotActprovisionsimilartoonethe court used in 2006 to authorize the phone records program.The argumentmade for the e-mail metadata program, analysts say, may have been used tojustifythephonerecordscollection.

Thephoneprogramlogsmetadatasuchasnumberscalledandthetimeanddurationofcallsbutnotnamesorcontent.

Fallon said that “additional materials related to the [phone] program areunderreviewforpossibledeclassificationandrelease”inresponsetolawsuitsbytheAmericanCivilLibertiesUnionandtheElectronicFrontierFoundation.Theoriginal interpretation is one of a number of classified court documents andexecutive branch rulings that some lawmakers say should be declassified.andreleased

GovernmentlawyershavetoldtheACLUthattheyarewithholdingatleasttwosignificantFISCopinions—onefrom2008andonefrom2010—relatingtothePatriotAct’sSection215,or“businessrecords”provision.

Fallondeclinedtocomment.TheJusticeDepartmentalsoisreviewinga2006courtopinionrelatedtothe

Section215provisiontodeterminewhetheritcanbereleased,saidAlexAbdo,anACLUstafflawyer.(AseniordepartmentofficialtoldThePostthatno2006Kollar-Kotellyopinionisbasedonthatprovision.)

KennethWainstein,a formerseniorJusticeDepartmentofficialnowon thePublic Interest Declassification Board, an advisory committee established byCongress, agreed that more disclosure is wise. “Especially when it comes tolegal decisions about big programs,” he said at a recent panel discussion

sponsoredbytheNewYorkUniversitySchoolofLaw,“wecantalkabouttheminasanitizedwaywithoutdisclosingsourcesandmethods.”

Senate Judiciary Committee Chairman Patrick J. Leahy (D-Vt.) said in astatement to The Post that he is “particularly interested” in seeing theadministration declassify and release “any additional legal analysis” related tothephonerecordsprogram.“That,”hesaid,“isexactlythesortoftransparencyweneedinorder tohaveafullandopendebateaboutwhether thisprogramislegalandappropriateorneeded.”

NSAcollectsmillionsofe-mailaddressbooksglobally

ByBartonGellmanandAshkanSoltaniOctober14,2013

TheNationalSecurityAgencyisharvestinghundredsofmillionsofcontactlistsfrompersonale-mailandinstantmessagingaccountsaroundtheworld,manyofthembelongingtoAmericans,accordingtoseniorintelligenceofficialsandtop-secretdocumentsprovidedbyformerNSAcontractorEdwardSnowden.

Thecollectionprogram,whichhasnotbeendisclosedbefore, intercepts e-mail address books and “buddy lists” from instantmessaging services as theymove across global data links. Online services often transmit those contactswhenauserlogson,composesamessage,orsynchronizesacomputerormobiledevicewithinformationstoredonremoteservers.

Rather than targeting individualusers, theNSAisgatheringcontact lists inlargenumbersthatamounttoasizablefractionoftheworld’se-mailandinstantmessaging accounts. Analysis of that data enables the agency to search forhiddenconnectionsandtomaprelationshipswithinamuchsmalleruniverseofforeignintelligencetargets.

Duringa singleday lastyear, theNSA’sSpecialSourceOperationsbranchcollected 444,743 e-mail address books from Yahoo, 105,068 from Hotmail,82,857 fromFacebook,33,697 fromGmail and22,881 fromunspecifiedotherproviders,accordingtoaninternalNSAPowerPointpresentation.Thosefigures,describedasatypicaldailyintakeinthedocument,correspondtoarateofmorethan250 millionayear.

Eachday,thepresentationsaid,theNSAcollectscontactsfromanestimated500,000buddylistsonlive-chatservicesaswellasfromtheinboxdisplaysofWeb-basede-mailaccounts.

The collection depends on secret arrangements with foreigntelecommunications companies or allied intelligence services in control offacilitiesthatdirecttrafficalongtheInternet’smaindataroutes.

Although the collection takes place overseas, two senior U.S. intelligenceofficialsacknowledgedthatitsweepsinthecontactsofmanyAmericans.Theydeclinedtoofferanestimatebutdidnotdisputethatthenumberislikelytobeinthemillionsortensofmillions.

Aspokesmanfor theOfficeof theDirectorofNational Intelligence,whichoversees theNSA, said the agency “is focusedondiscovering anddevelopingintelligence about valid foreign intelligence targets like terrorists, humantraffickers and drug smugglers.We are not interested in personal informationaboutordinaryAmericans.”

The spokesman, Shawn Turner, added that rules approved by the attorneygeneralrequiretheNSAto“minimizetheacquisition,useanddissemination”ofinformationthatidentifiesaU.S.citizenorpermanentresident.

The NSA’s collection of nearly all U.S. call records, under a separateprogram, has generated significant controversy since it was revealed in June.TheNSA’sdirector,Gen.KeithB.Alexander,hasdefended“bulk”collectionasanessentialcounterterrorismandforeignintelligencetool,saying,“Youneedthehaystacktofindtheneedle.”

Contact lists storedonlineprovide theNSAwith far richer sourcesofdatathancallrecordsalone.Addressbookscommonlyincludenotonlynamesande-mail addresses,but also telephonenumbers, street addresses, andbusinessandfamily information. Inbox listings of e-mail accounts stored in the “cloud”sometimescontaincontent,suchasthefirstfewlinesofamessage.

Taken together, the data would enable the NSA, if permitted, to drawdetailedmapsofaperson’s life,as toldbypersonal,professional,politicalandreligious connections. The picture can also be misleading, creating false“associations”withex-spousesorpeoplewithwhomanaccountholderhashadnocontactinmanyyears.

The NSA has not been authorized by Congress or the special intelligencecourtthatoverseesforeignsurveillancetocollectcontactlistsinbulk,andseniorintelligenceofficialssaiditwouldbeillegaltodosofromfacilitiesintheUnitedStates. The agency avoids the restrictions in the Foreign IntelligenceSurveillanceAct by intercepting contact lists from access points “all over theworld,”oneofficialsaid,speakingontheconditionofanonymitytodiscusstheclassifiedprogram.“NoneofthoseareonU.S.territory.”

Because of the method employed, the agency is not legally required ortechnically able to restrict its intake to contact lists belonging to specifiedforeignintelligencetargets,hesaid.

When information passes through “the overseas collection apparatus,” theofficialadded,“theassumptionisyou’renotaU.S.person.”

In practice, data fromAmericans is collected in large volumes— in partbecausetheyliveandworkoverseas,butalsobecausedatacrossesinternationalboundaries even when its American owners stay at home. Large technologycompanies, includingGoogle and Facebook,maintain data centers around theworldtobalanceloadsontheirserversandworkaroundoutages.

AseniorU.S.intelligenceofficialsaidtheprivacyofAmericansisprotected,despitemass collection, because “we have checks and balances built into ourtools.”

NSA analysts, he said, may not search within the contacts database ordistributeinformationfromitunlesstheycan“makethecasethatsomethinginthereisavalidforeignintelligencetargetinandofitself.”

Inthisprogram,theNSAisobligedtomakethatcaseonlytoitselforothersin the executive branch.With few exceptions, intelligence operations overseas

fall solely within the president’s legal purview. The Foreign IntelligenceSurveillance Act, enacted in 1978, imposes restrictions only on electronicsurveillancethattargetsAmericansortakesplaceonU.S.territory.

By contrast, the NSA draws on authority in the Patriot Act for its bulkcollection of domestic phone records, and it gathers online records fromU.S.Internet companies, in a programknown as PRISM, under powers granted byCongress in theFISAAmendmentsAct.Thoseoperationsareoverseenby theForeignIntelligenceSurveillanceCourt.

Sen. Dianne Feinstein, the California Democrat who chairs the SenateIntelligenceCommittee,saidinAugustthatthecommitteehaslessinformationabout,andconductslessoversightof,intelligencegatheringthatreliessolelyonpresidential authority.She said sheplanned to ask formorebriefingson thoseprograms.

“Ingeneral, the committee is far less awareofoperations conductedunder12333,” said a senior committee staff member, referring to Executive Order12333,which defines the basic powers and responsibilities of the intelligenceagencies.“Ibelieve theNSAwouldanswerquestions ifweasked them,and ifwe knew to ask them, but it would not routinely report these things, and, ingeneral,theywouldnotfallwithinthefocusofthecommittee.”

Because the agency captures contact lists “on the fly” as they crossmajorInternetswitches,ratherthan“atrest”oncomputerservers,theNSAhasnoneedtonotify theU.S. companies thathost the informationor to ask forhelp fromthem.

“Wehaveneitherknowledgeofnorparticipation in thismasscollectionofweb-mailaddressesorchatlistsbythegovernment,”saidGooglespokeswomanNikiFenwick.

At Microsoft, spokeswoman Nicole Miller said the company “does notprovideanygovernmentwithdirectorunfetteredaccesstoourcustomers’data,”adding that “we would have significant concerns if these allegations aboutgovernmentactionsaretrue.”

Facebook spokeswoman JodiSeth said that “wedidnot knowanddidnotassist”intheNSA’sinterceptionofcontactlists.

It isunclearwhytheNSAcollectsmorethantwiceasmanyaddressbooksfromYahoothantheotherbigservicescombined.OnepossibilityisthatYahoo,unlikeotherserviceproviders,has leftconnections to itsusersunencryptedbydefault.

Suzanne Philion, a Yahoo spokeswoman, said Monday in response to aninquiry from The Washington Post that, beginning in January, Yahoo wouldbeginencryptingallitse-mailconnections.

Googlewas the first to secure all its e-mail connections, turning on “SSLencryption”globallyin2010.Peoplewithinsideknowledgesaidthemovewasintendedinpart to thwart large-scalecollectionof itsusers’ informationbytheNSAandotherintelligenceagencies.

The volume ofNSA contacts collection is so high that it has occasionallythreatened to overwhelm storage repositories, forcing the agency to halt itsintake with “emergency detasking” orders. Three NSA documents describeshort-term efforts to build an “across-the-board technology throttle for trulyheinousdata”andlonger-termeffortstofilteroutinformationthattheNSAdoesnotneed.

Spam has proven to be a significant problem for the NSA — cloggingdatabaseswithinformationthatholdsnoforeignintelligencevalue.Themajorityofall e-mails,oneNSAdocument says, “areSPAMfrom‘fake’addressesandnever‘delivered’totargets.”

In fall 2011, according to an NSA presentation, the Yahoo account of anIraniantargetwas“hackedbyanunknownactor,”whousedittosendspam.TheIranianhad“anumberofYahoogroupsinhis/hercontactlist,somewithmanyhundredsorthousandsofmembers.”

The cascading effects of repeated spam messages, compounded by theautomaticadditionoftheIranian’scontactstootherpeople’saddressbooks,led

toamassivespikeinthevolumeoftrafficcollectedbytheBritainintelligenceserviceontheNSA’sbehalf.

After nine days of data-bombing, the Iranian’s contact book and contactbooksforseveralpeoplewithinitwere“emergencydetasked.”

InabriefingfromtheNSA’sLargeAccessExploitationworkinggroup,thatexample was used to illustrate the need to narrow the criteria for datainterception.Itcalledfora“shiftingcollectionphilosophy”:“Memorializewhatyouneed”vs.“Orderoneofeverythingoffthemenuandeatwhatyouwant.”

Julie Tate contributed to this report. Soltani is an independent securityresearcherandconsultant.

DocumentsrevealNSA’sextensiveinvolvementintargetedkillingprogram

ByGregMiller,JulieTateandBartonGellmanOctober16,2013

It was an innocuous e-mail, one of millions sent every day by spouses withupdateson the situationathome.But thisonewasofparticular interest to theNationalSecurityAgencyandcontainedclues thatput thesender’shusbandinthecrosshairsofaCIAdrone.

Dayslater,HassanGhul—anassociateofOsamabinLadenwhoprovidedacriticalpieceofintelligencethathelpedtheCIAfindtheal-Qaedaleader—waskilledbyadronestrikeinPakistan’stribalbelt.

The U.S. government has never publicly acknowledged killing Ghul. ButdocumentsprovidedtoTheWashingtonPostbyformerNSAcontractorEdwardSnowdenconfirmhisdemiseinOctober2012andrevealtheagency’sextensiveinvolvement in the targetedkillingprogramthathasservedasacenterpieceofPresidentObama’scounterterrorismstrategy.

Anal-Qaedaoperativewhohadaknackforsurfacingatdramaticmomentsin the post-Sept. 11 story line, Ghul was an emissary to Iraq for the terroristgroupattheheightofthatwar.Hewascapturedin2004andhelpedexposebinLaden’scouriernetworkbeforespendingtwoyearsatasecretCIAprison.Then,in 2006, theUnitedStates deliveredhim to his nativePakistan,where hewasreleasedandreturnedtotheal-Qaedafold.

But beyond filling in gaps about Ghul, the documents provide the mostdetailedaccountoftheintricatecollaborationbetweentheCIAandtheNSAin

thedronecampaign.ThePostiswithholdingmanydetailsaboutthosemissions,attherequestof

U.S.intelligenceofficialswhocitedpotentialdamagetoongoingoperationsandnationalsecurity.

TheNSAis“focusedondiscoveringanddevelopingintelligenceaboutvalidforeignintelligencetargets,”anNSAspokeswomansaidinastatementprovidedto The Post on Wednesday, adding that the agency’s operations “protect thenation and its interests from threats such as terrorism and the proliferation ofweaponsofmassdestruction.”

In the search for targets, the NSA has draped a surveillance blanket overdozens of square miles of northwest Pakistan. In Ghul’s case, the agencydeployedanarsenalofcyber-espionagetools,secretlyseizingcontroloflaptops,siphoning audio files and othermessages, and tracking radio transmissions todeterminewhereGhulmight“beddown.”

Thee-mailfromGhul’swife“abouthercurrentlivingconditions”containedenough detail to confirm the coordinates of that household, according to adocument summarizing the mission. “This information enabled a capture/killoperation against an individual believed to beHassanGhul onOctober 1,” itsaid.

The file is part of a collection of records in the Snowden trove thatmakeclear that thedronecampaign—oftendepictedas theCIA’sexclusivedomain—reliesheavilyon theNSA’sability tovacuumupenormousquantitiesofe-mail,phonecallsandotherfragmentsofsignalsintelligence,orSIGINT.

Tohandletheexpandingworkload,theNSAcreatedasecretunitknownasthe CounterTerrorism Mission Aligned Cell, or CT MAC, to concentrate theagency’svast resourcesonhard-to-find terrorismtargets.TheunitspentayeartrackingGhul andhis courier network, tunneling into an arrayof systemsanddevices, before he was killed. Without those penetrations, the documentconcluded,“thisopportunitywouldnothavebeenpossible.”

At a timewhen the NSA is facing intense criticism for gathering data on

Americans, thedrone filesmaybolster theagency’scase that its resourcesarefocusedonfightingterrorismandsupportingU.S.operationsoverseas.

“Ours is a noble cause,” NSA Director Keith B. Alexander said during apubliceventlastmonth.“Ourjobistodefendthisnationandtoprotectourcivillibertiesandprivacy.”

ThedocumentsdonotexplainhowtheGhule-mailwasobtainedorwhetherit was intercepted using legal authorities that have emerged as a source ofcontroversy in recentmonthsandenable theNSAtocompel technologygiantsincludingMicrosoftandGoogletoturnoverinformationabouttheirusers.Noris there a reference to another NSA program facing scrutiny after Snowden’sleaks, itsmetadata collection of numbers dialed by nearly every person in theUnitedStates.

To the contrary, the records indicate that the agency depends heavily onhighly targeted network penetrations to gather information that wouldn’totherwisebetrappedinsurveillancenetsthatithassetatkeyInternetgateways.

Thenewdocumentsareself-congratulatoryintone,draftedtotouttheNSA’scounterterrorismcapabilities.Oneistitled“CTMACHassanGulSuccess.”Thefilesmakenomentionofotheragencies’rolesinadroneprogramthatescalateddramaticallyin2009and2010beforetaperingoffinrecentyears.

Evenso,formerCIAofficialssaidthefilesareanaccuratereflectionoftheNSA’s contribution to finding targets in a campaign that has killedmore than3,000people,includingthousandsofallegedmilitantsandhundredsofcivilians,inPakistan,accordingtoindependentsurveys.Theofficialssaidtheagencyhasassigned senior analysts to the CIA’s Counterterrorism Center, and deployedotherstoworkalongsideCIAcounterpartsatalmosteverymajorU.S.embassyormilitarybaseoverseas.

“NSAthrew thekitchensinkat theFATA,”saida formerU.S. intelligenceofficialwithexperience inAfghanistanandPakistan, referring to theFederallyAdministeredTribalAreas, the region in northwest Pakistanwhere al-Qaeda’sleadershipisbased.

NSA employees rarely ventured beyond the security gates of the U.S.Embassy in Islamabad, officials said. Surveillance operations that requiredplacing a device or sensor near an al-Qaeda compound were handled by theCIA’sInformationOperationsCenter,whichspecializesinhigh-techdevicesand“close-in”surveillancework.

“But if you wanted huge coverage of the FATA, NSA had 10 times themanpower, 20 times the budget and 100 times the brainpower,” the formerintelligenceofficialsaid,comparingthesurveillanceresourcesoftheNSAtothesmallercapabilitiesoftheagency’sIOC.ThetwoagenciesarethelargestintheU.S.intelligencecommunity,withbudgetslastyearof$14.7billionfortheCIAand$10.8billionfortheNSA.“Weprovidedthemap,”theformerofficialsaid,“andtheyjustfilledinthepieces.”

In broad terms, the NSA relies on increasingly sophisticated versions ofonline attacks that are well-known among security experts. Many rely onsoftware implants developed by the agency’s Tailored Access Operationsdivisionwith code-names such asUNITEDRAKEandVALIDATOR. In othercases, the agency runs “man-in-the-middle” attacks inwhich it positions itselfunnoticed midstream between computers communicating with one another,divertingfilesforreal-timealertsandlonger-termanalysisindatarepositories.

Throughtheseandothertactics,theNSAisabletoextractvastquantitiesofdigital information, including audio files, imagery and keystroke logs. Theoperationsamounttosilentraidsonsuspectedsafehousesandoftenarecarriedoutbyexpertssittingbehinddesksthousandsofmilesfromtheirtargets.

The reach of the NSA’s Tailored Access Operations division extends farbeyondPakistan.Otherdocumentsdescribeefforts to tunnel intosystemsusedby al-Qaeda affiliates in Yemen and Africa, each breach exposing othercorridors.

Anoperationagainstasuspectedfacilitatorforal-Qaeda’sbranchinYemenledtoatroveoffilesthatcouldbeusedto“helpNSAmapoutthemovementofterrorists and aspiring extremists betweenYemen,Syria,Turkey,Egypt,Libya

andIran,”accordingtothedocuments.“ThismayenableNSAtobetterflagthemovement of these individuals” to allied security services that “can putindividualsonno-flylistsormonitorthemonceincountry.”

A single penetration yielded 90 encrypted al-Qaeda documents, 16encryptionkeys,30unencryptedmessagesaswellas“thousands”ofchatlogs,accordingtoaninventorydescribedinoneoftheSnowdendocuments.

The operations are so easy, in some cases, that the NSA is able to startdownloadingdatainlesstimethanittakesthetargetedmachinetobootup.Lastyear,auseraccountonasocialmediaWebsiteprovidedaninstantportaltoanal-Qaedaoperative’sharddrive.“Withinminutes,wesuccessfullyexploitedthetarget,”thedocumentsaid.

ThehuntforGhulfollowedamoreelaboratepath.Ghul,who is listed inotherdocumentsasMustafaHajiMuhammadKhan,

had surfaced on U.S. radar as early as 2003, when an al-Qaeda detaineedisclosed that Ghul escorted one of the intended hijackers to a Pakistani safehouseayearbeforetheSept.11,2001,attacks.

A trusted facilitator and courier, Ghul was dispatched to Iraq in 2003 todeliver a message to Abu Musab al-Zarqawi, the al-Qaeda firebrand whoangered the network’s leaders in Pakistan by launching attacks that oftenslaughteredinnocentMuslims.

WhenGhulmadeanotherattempttoenterIraqin2004,hewasdetainedbyKurdish authorities in an operation directed by theCIA.Almost immediately,Ghulprovidedapieceofintelligencethatwouldprovemoreconsequentialthanhemayhaveanticipated:HedisclosedthatbinLadenreliedonatrustedcourierknownasal-Kuwaiti.

Theripplesfromthatrevelationwouldn’tsubsideforyears.TheCIAwentonto determine the true identity of al-Kuwaiti and followed him to a heavilyfortified compound in Abbottabad, Pakistan, where bin Laden was killed in2011.

Because of the courier tip, Ghul became an unwitting figure in the

contentiousdebateoverCIAinterrogationmeasures.HewasheldataCIAblacksite in Eastern Europe, according to declassified Justice Department memos,wherehewasslappedandsubjectedtostresspositionsandsleepdeprivationtobreakhiswill.

DefendersoftheinterrogationprogramhavecitedGhul’scourierdisclosureas evidence that the agency’s interrogation programwas crucial to getting binLaden.Butothers, includingformerCIAoperativesdirectlyinvolvedinGhul’scase, said that he identified the courier while he was being interrogated byKurdish authorities, who posed questions scripted by CIA analysts in thebackground.

Thedebateresurfacedamidthereleaseofthemovie“ZeroDarkThirty”lastyear,inwhichadetainee’sslipafterabrutalinterrogationsequenceisdepictedasabreakthroughinthebinLadenhunt.Ghul’scasealsohasbeenexploredindetail in a 6,000-page investigation of the CIA interrogation program by theSenateIntelligenceCommitteethathasyettobereleased.

Sen.DianneFeinstein(D-Calif.),thechairmanofthepanel,soughttosettlethe Ghul debate in a statement last year that alluded to his role but didn’tmentionhimbyname.

“TheCIAdetaineewhoprovidedthemostsignificantinformationaboutthecourier provided the information prior to being subjected to coerciveinterrogationtechniques,”Feinsteinsaidinthestatement,whichwassignedbySen.CarlLevin(D-Mich.).

The George W. Bush administration’s decision to close the secret CIAprisons in2006setoffascramble toplaceprisonerswhomtheagencydidnotregard as dangerous or valuable enough to transfer toGuantanamoBay.Ghulwas not among the original 14 high-value CIA detainees sent to the U.S.installation in Cuba. Instead, he was turned over to the CIA’s counterpart inPakistan,withostensibleassurancesthathewouldremainincustody.

A year later, Ghul was released. There was no public explanation fromPakistaniauthorities.CIAofficialshavenoted thatGhulhad ties toLashkar-e-

Taiba,amilitantgroupsupportedbyPakistan’sintelligenceservice.By2007,hehadreturnedtoal-Qaeda’sstrongholdinWaziristan.

In 2011, the Treasury Department named Ghul a target of U.S.counterterrorismsanctions.Sincehisrelease,thedepartmentsaid,hehadhelpedal-Qaeda reestablish logisticsnetworks,enablingal-Qaeda tomovepeopleandmoney in and out of the country. The NSA document described Ghul as al-Qaeda’schiefofmilitaryoperationsanddetailedabroadsurveillanceeffort tofindhim.

“Themostcriticalpiece”camewithadiscoverythat“providedavector”forcompoundsusedbyGhul,thedocumentsaid.Aftermonthsofinvestigation,andsurveillance by CIA drones, the e-mail from his wife erased any remainingdoubt.

Even afterGhulwas killed inMirAli, theNSA’s role in the drone strikewasn’tdone.Althoughtheattackwasaimedat“anindividualbelievedtobe”thecorrecttarget,theoutcomewasn’tcertainuntillaterwhen,“throughSIGINT,itwasconfirmedthatHassanGhulwasinfactkilled.”

NSAinfiltrateslinkstoYahoo,Googledatacentersworldwide,Snowdendocuments

say

ByBartonGellmanandAshkanSoltaniOctober30,2013

The National Security Agency has secretly broken into the maincommunications links that connectYahoo andGoogle data centers around theworld, according to documents obtained from formerNSA contractor EdwardSnowdenandinterviewswithknowledgeableofficials.

Bytappingthoselinks,theagencyhaspositioneditselftocollectatwillfromhundredsofmillionsofuser accounts,manyof thembelonging toAmericans.TheNSAdoesnotkeepeverythingitcollects,butitkeepsalot.

According to a top-secret accounting dated Jan. 9, 2013, the NSA’sacquisitionsdirectoratesendsmillionsofrecordseverydayfrominternalYahooandGoogle networks to datawarehouses at the agency’s headquarters at FortMeade, Md. In the preceding 30 days, the report said, field collectors hadprocessed and sent back 181,280,466 new records — including “metadata,”whichwouldindicatewhosentorreceivede-mailsandwhen,aswellascontentsuchastext,audioandvideo.

The NSA’s principal tool to exploit the data links is a project calledMUSCULAR, operated jointly with the agency’s British counterpart, theGovernment Communications Headquarters . From undisclosed interceptionpoints,theNSAandtheGCHQarecopyingentiredataflowsacrossfiber-opticcablesthatcarryinformationamongthedatacentersoftheSiliconValleygiants.

The infiltration is especially striking because the NSA, under a separateprogram known as PRISM, has front-door access to Google and Yahoo useraccountsthroughacourt-approvedprocess.

TheMUSCULARprojectappearstobeanunusuallyaggressiveuseofNSAtradecraft against flagshipAmerican companies. The agency is built for high-techspying,withawiderangeofdigitaltools,butithasnotbeenknowntousethemroutinelyagainstU.S.companies.

In a statement, theNSA said it is “focusedondiscovering anddevelopingintelligenceaboutvalidforeignintelligencetargetsonly.”

“NSAappliesAttorneyGeneral-approvedprocessestoprotecttheprivacyofU.S.persons—minimizingthelikelihoodoftheirinformationinourtargeting,collection,processing,exploitation,retention,anddissemination,”itsaid.

In a statement, Google’s chief legal officer, David Drummond, said thecompany has “long been concerned about the possibility of this kind ofsnooping”andhasnotprovidedthegovernmentwithaccesstoitssystems.

“Weareoutragedatthelengthstowhichthegovernmentseemstohavegonetointerceptdatafromourprivatefibernetworks,anditunderscorestheneedforurgentreform,”hesaid.

AYahoospokeswomansaid,“Wehavestrictcontrolsinplacetoprotectthesecurityofourdatacenters,andwehavenotgivenaccesstoourdatacenterstotheNSAortoanyothergovernmentagency.”

Under PRISM, the NSA gathers huge volumes of online communicationsrecordsbylegallycompellingU.S.technologycompanies,includingYahooandGoogle, to turn over any data that match court-approved search terms. Thatprogram,whichwas first disclosedbyTheWashingtonPost and theGuardiannewspaperinBritain,isauthorizedunderSection702oftheFISAAmendmentsActandoverseenbytheForeignIntelligenceSurveillanceCourt(FISC).

Intercepting communications overseas has clear advantages for the NSA,withlooserrestrictionsandlessoversight.NSAdocumentsabouttheeffortreferdirectly to “full take,” “bulk access” and “high volume” operations onYahooandGooglenetworks.Such large-scalecollectionof Internetcontentwouldbeillegal in theUnited States, but the operations take place overseas, where theNSAisallowedtopresumethatanyoneusingaforeigndatalinkisaforeigner.

OutsideU.S.territory,statutoryrestrictionsonsurveillanceseldomapplyandtheFISChasno jurisdiction.Senate IntelligenceCommitteeChairmanDianneFeinstein(D-Calif.)hasacknowledgedthatCongressconductslittleoversightofintelligence-gatheringunderthepresidentialauthorityofExecutiveOrder12333,whichdefinesthebasicpowersandresponsibilitiesoftheintelligenceagencies.

John Schindler, a former NSA chief analyst and frequent defender whoteachesattheNavalWarCollege,saiditisobviouswhytheagencywouldprefertoavoidrestrictionswhereitcan.

“Look,NSAhasplatoonsoflawyers,andtheirentirejobisfiguringouthowtostaywithinthelawandmaximizecollectionbyexploitingeveryloophole,”hesaid.“It’sfair tosaytherulesarelessrestrictiveunderExecutiveOrder12333thantheyareunderFISA,”theForeignIntelligenceSurveillanceAct.

Inastatement,theOfficeoftheDirectorofNationalIntelligencedeniedthatit was using executive authority to “get around the limitations” imposed byFISA.

The operation to infiltrate data links exploits a fundamental weakness insystemsarchitecture.Toguardagainstdatalossandsystemslowdowns,GoogleandYahoomaintainfortresslikedatacentersacrossfourcontinentsandconnectthemwiththousandsofmilesoffiber-opticcable.Datamoveseamlesslyaroundthese globe-spanning “cloud” networks, which represent billions of dollars ofinvestment.

Forthedatacenterstooperateeffectively,theysynchronizelargevolumesofinformation about account holders. Yahoo’s internal network, for example,sometimes transmits entire e-mail archives — years of messages andattachments—fromonedatacentertoanother.

Tapping the Google and Yahoo clouds allows the NSA to interceptcommunicationsinrealtimeandtotake“aretrospectivelookattargetactivity,”accordingtooneinternalNSAdocument.

Toobtainfreeaccesstodata-centertraffic,theNSAhadtocircumventgold-standardsecuritymeasures.Google“goestogreatlengthstoprotectthedataandintellectualproperty in thesecenters,”according tooneof thecompany’sblogposts, with tightly audited access controls, heat-sensitive cameras, round-the-clockguardsandbiometricverificationofidentities.

Google andYahoo also pay for premiumdata links, designed to be faster,more reliable andmore secure. In recent years, both of them are said to haveboughtorleasedthousandsofmilesoffiber-opticcablesfortheirownexclusiveuse.Theyhadreasontothink,insiderssaid,thattheirprivate,internalnetworksweresafefrompryingeyes.

In anNSApresentation slide on “GoogleCloudExploitation,” however, asketch shows where the “Public Internet” meets the internal “Google Cloud”wheretheirdatareside.Inhand-printedletters,thedrawingnotesthatencryption

is“addedandremovedhere!”Theartistaddsasmileyface,acheekycelebrationofvictoryoverGooglesecurity.

Two engineerswith close ties toGoogle exploded in profanitywhen theysawthedrawing.“Ihopeyoupublishthis,”oneofthemsaid.

For theMUSCULARproject, theGCHQdirects all intake into a “buffer”thatcanhold three to fivedaysof trafficbefore recyclingstoragespace.Fromthebuffer,custom-builtNSAtoolsunpackanddecode thespecialdataformatsthatthetwocompaniesuseinsidetheirclouds.Thenthedataaresentthroughaseriesoffiltersto“select”informationtheNSAwantsand“defeat”whatitdoesnot.

PowerPointslidesabouttheGooglecloud,forexample,showthattheNSAtries to filter out all data from the company’s “Web crawler,” which indexesInternetpages.

According to the briefing documents, prepared by participants in theMUSCULAR project, collection from insideYahoo andGoogle has producedimportant intelligence leads against hostile foreign governments that arespecifiedinthedocuments.

Last month, long before The Post approached Google to discuss thepenetrationofitscloud,EricGrosse,vicepresidentforsecurityengineering,saidthe company is rushing to encrypt the links between its data centers. “It’s anarmsrace,”hesaidthen.“Weseethesegovernmentagenciesasamongthemostskilledplayersinthisgame.”

Yahoohasnotannouncedplanstoencryptitsdata-centerlinks.Becausedigitalcommunicationsandcloudstoragedonotusuallyadhereto

nationalboundaries,MUSCULARandapreviouslydisclosedNSAoperationtocollect Internet address books have amassed content and metadata on apreviously unknown scale from U.S. citizens and residents. Those operationshave gone undebated in public or in Congress because their existence wasclassified.

The Google and Yahoo operations call attention to an asymmetry in U.S.

surveillance law. Although Congress has lifted some restrictions on NSAdomesticsurveillanceongroundsthatpurelyforeigncommunicationssometimespassoverU.S.switchesandcables,ithasnotaddedrestrictionsoverseas,whereAmericancommunicationsordatastoresnowcrossoverforeignswitches.

“Thirty-fiveyearsago,differentcountrieshadtheirowntelecommunicationsinfrastructure, so the division between foreign and domestic collection wasclear,”Sen.RonWyden(D-Ore.),amemberoftheintelligencepanel,saidinaninterview. “Today there’s a global communications infrastructure, so there’s agreaterriskofcollectingonAmericanswhentheNSAcollectsoverseas.”

ItisnotclearhowmuchdatafromAmericansiscollectedandhowmuchofthatisretained.OneweeklyreportonMUSCULARsaystheBritishoperatorsofthesiteallowtheNSAtocontribute100,000“selectors,”orsearchterms.Thatismore than twice the number in use in the PRISMprogram, but even 100,000cannoteasilyaccountforthemillionsofrecordsthataresaidtobesenttoFortMeadeeachday.

In2011,whentheFISClearnedthattheNSAwasusingsimilarmethodstocollectandanalyzedatastreams—onamuchsmallerscale—fromcablesonU.S.territory,JudgeJohnD.BatesruledthattheprogramwasillegalunderFISAandinconsistentwiththerequirementsoftheFourthAmendment.

Soltaniisanindependentsecurityresearcherandconsultant.

AddtionalContent:HowtheNSAisinfiltratingprivatenetworks

HowtheNSA’sMUSCULARprogramcollectstoomuchdatafromYahooandGoogle

HowweknowtheNSAhadaccesstointernalGoogleandYahooclouddata

NSAtrackingcellphonelocationsworldwide,Snowdendocumentsshow

ByBartonGellmanandAshkanSoltaniDecember4,2013

TheNationalSecurityAgencyisgatheringnearly5billionrecordsadayonthewhereaboutsofcellphonesaroundtheworld,accordingtotop-secretdocumentsandinterviewswithU.S.intelligenceofficials,enablingtheagencytotrackthemovementsofindividuals—andmaptheirrelationships—inwaysthatwouldhavebeenpreviouslyunimaginable.

Therecordsfeedavastdatabasethatstoresinformationaboutthelocationsof at least hundreds ofmillions of devices, according to the officials and thedocuments,whichwereprovidedbyformerNSAcontractorEdwardSnowden.New projects created to analyze that data have provided the intelligencecommunitywithwhatamountstoamasssurveillancetool.

TheNSAdoesnottargetAmericans’locationdatabydesign,buttheagencyacquires a substantial amount of information on the whereabouts of domesticcellphones “incidentally,” a legal term that connotes a foreseeable but notdeliberateresult.

Oneseniorcollectionmanager,speakingonconditionofanonymitybutwithpermission from theNSA,said“wearegettingvastvolumes”of locationdatafromaroundtheworldbytappingintothecablesthatconnectmobilenetworksglobally and that serveU.S. cellphones as well as foreign ones. Additionally,dataisoftencollectedfromthetensofmillionsofAmericanswhotravelabroadwiththeircellphoneseveryyear.

In scale, scope and potential impact on privacy, the efforts to collect andanalyzelocationdatamaybeunsurpassedamongtheNSAsurveillanceprogramsthathavebeendisclosedsinceJune.Analystscan findcellphonesanywhere inthe world, retrace their movements and expose hidden relationships amongindividualsusingthem.

(Graphic:HowtheNSAistrackingpeoplerightnow)U.S. officials said the programs that collect and analyze location data are

lawfulandintendedstrictlytodevelopintelligenceaboutforeigntargets.Robert Litt, general counsel for the Office of the Director of National

Intelligence, which oversees the NSA, said “there is no element of theintelligencecommunitythatunderanyauthorityisintentionallycollectingbulkcellphonelocationinformationaboutcellphonesintheUnitedStates.”

TheNSAhasnoreasontosuspectthatthemovementsoftheoverwhelmingmajority of cellphone users would be relevant to national security. Rather, itcollects locations in bulk because its most powerful analytic tools— knowncollectively asCO-TRAVELER—allow it to look for unknownassociates ofknownintelligencetargetsbytrackingpeoplewhosemovementsintersect.

Still,locationdata,especiallywhenaggregatedovertime,iswidelyregardedamong privacy advocates as uniquely sensitive. Sophisticated mathematicaltechniques enable NSA analysts to map cellphone owners’ relationships bycorrelating theirpatternsofmovementover timewith thousandsormillionsofother phone users who cross their paths. Cellphones broadcast their locationsevenwhentheyarenotbeingusedtoplaceacallorsendatext.

CO-TRAVELER and related tools require the methodical collection andstorageoflocationdataonwhatamountstoaplanetaryscale.Thegovernmentistrackingpeoplefromafar intoconfidentialbusinessmeetingsorpersonalvisitstomedicalfacilities,hotelrooms,privatehomesandothertraditionallyprotectedspaces.

“Oneof the key components of locationdata, andwhy it’s so sensitive, isthat the laws of physics don’t let you keep it private,” said Chris Soghoian,

principaltechnologistattheAmericanCivilLibertiesUnion.Peoplewhovaluetheir privacy can encrypt their e-mails and disguise their online identities, but“the only way to hide your location is to disconnect from our moderncommunicationsystemandliveinacave.”

TheNSA cannot know in advancewhich tiny fraction of 1 percent of therecordsitmayneed,soitcollectsandkeepsasmanyasitcan—27terabytes,by one account, or more than double the text content of the Library ofCongress’sprintcollection.

The location programs have brought in such volumes of information,according to aMay 2012 internal NSA briefing, that they are “outpacing ourabilitytoingest,processandstore”data.Intheensuingyearandahalf,theNSAhas been transitioning to a processing system that provided it with greatercapacity.

Thepossibilitythattheintelligencecommunityhasbeencollectinglocationdata,particularlyofAmericans,haslongconcernedprivacyadvocatesandsomelawmakers. Three Democratic senators — Ron Wyden (Ore.), Mark Udall(Colo.) andBarbaraMikulski (Md.)— have introduced an amendment to the2014defensespendingbillthatwouldrequireU.S.intelligenceagenciestosaywhether theyhave ever collectedormadeplans to collect locationdata for “alargenumberofUnitedStatespersonswithnoknownconnectiontosuspiciousactivity.”

NSADirectorKeithAlexanderdisclosedinSenatetestimonyinOctoberthattheNSAhadrunapilotproject in2010and2011tocollect“samples”ofU.S.cellphonelocationdata.Thedatacollectedwereneveravailableforintelligenceanalysis purposes, and the project was discontinued because it had no“operationalvalue,”hesaid.

Alexanderallowedthatabroadercollectionofsuchdata“maybesomethingthatisafuturerequirementforthecountry,butitisnotrightnow.”

ThenumberofAmericanswhoselocationsaretrackedaspartoftheNSA’scollection of data overseas is impossible to determine from the Snowden

documentsalone,andseniorintelligenceofficialsdeclinedtoofferanestimate.“It’sawkwardforustotrytoprovideanyspecificnumbers,”oneintelligence

official said ina telephone interview.AnNSAspokeswomanwho tookpart inthecallcutintosaytheagencyhasnowaytocalculatesuchafigure.

Anintelligencelawyer,speakingwithhisagency’spermission,saidlocationdataareobtainedbymethods“tunedtobelookingoutsidetheUnitedStates,”aformulationherepeatedthreetimes.WhenU.S.cellphonedataarecollected,hesaid, the data are not covered by the Fourth Amendment, which protectsAmericansagainstunreasonablesearchesandseizures.

Accordingtotop-secretbriefingslides,theNSApullsinlocationdataaroundtheworldfrom10major“sigads,”orsignalsintelligenceactivitydesignators.

A sigad known as STORMBREW, for example, relies on two unnamedcorporate partners describedonly asARTIFICEandWOLFPOINT.Accordingto an NSA site inventory, the companies administer the NSA’s “physicalsystems,”orinterceptionequipment,and“NSAasksnicelyfortasking/updates.”

STORMBREWcollects data from27 telephone links known asOPC/DPCpairs, which refer to originating and destination points and which typicallytransfer traffic from one provider’s internal network to another’s. That dataincludecelltoweridentifiers,whichcanbeusedtolocateaphone’slocation.

Theagency’saccesstocarriers’networksappearstobevast.“Many shared databases, such as those used for roaming, are available in

their complete form to any carrierwho requires access to anypart of it,” saidMattBlaze, an associate professor of computer and information science at theUniversity of Pennsylvania. “This ‘flat’ trust model means that a surprisinglylarge number of entities have access to data about customers that they neveractuallydobusinesswith, andan intelligenceagency—hostileor friendly—can get ‘one stop shopping’ to an expansive range of subscriber data just bycompromisingafewcarriers.”

Some documents in the Snowden archive suggest that acquisition of U.S.locationdataisroutineenoughtobecitedasanexampleintrainingmaterials.In

an October 2012 white paper on analytic techniques, for example, the NSA’scounterterrorism analysis unit cites two U.S.-based carriers to illustrate thechallengeofcorrelatingthetravelsofphoneusersondifferentmobilenetworks.Askedaboutthat,aU.S.intelligenceofficialsaidtheexamplewaspoorlychosenanddidnotrepresenttheprogram’sforeignfocus.

The NSA’s capabilities to track location are staggering, based on theSnowdendocuments,andindicatethattheagencyisabletorendermosteffortsatcommunicationssecurityeffectivelyfutile.

Like encryption and anonymity tools online,which are usedbydissidents,journalists and terrorists alike, security-minded behavior — using disposablecellphonesandswitchingthemononlylongenoughtomakebriefcalls—marksauserforspecialscrutiny.CO-TRAVELERtakesnote,forexample,whenanewtelephoneconnects toacell towersoonafteranothernearbydeviceisusedforthelasttime.

Side-by-side security efforts — when nearby devices power off and ontogetherovertime—“assistindeterminingwhetherco-travelersareassociated…throughbehaviorallyrelevantrelationships,”accordingtothe24-pagewhitepaper, which was developed by the NSA in partnership with the NationalGeospatialAgency,theAustralianSignalsDirectorateandprivatecontractors.

Acentralfeatureofeachofthesetoolsisthattheydonotrelyonknowingaparticular target in advance, or even suspecting one. They operate on the fulluniverse of data in the NSA’s FASCIA repository, which stores trillions ofmetadatarecords,ofwhichalargebutunknownfractionincludelocations.

Themostbasicanalytictoolsmapthedate,time,andlocationofcellphonesto look for patterns or significant moments of overlap. Other tools computespeed and trajectory for large numbers of mobile devices, overlaying theelectronic data on transportation maps to compute the likely travel time anddeterminewhichdevicesmighthaveintersected.

To solve the problem of undetectable surveillance against CIA officersstationed overseas, one contractor designed an analytic model that would

carefully record the case officer’s path and look for other mobile devices insteadyproximity.

“Resultshavenotbeenvalidatedbyoperationalanalysts,”thereportsaid.

Julie Tate contributed to this report. Soltani is an independent securityresearcherandconsultant.

AdditionalContent:HowtheNSAistrakingpeoplerightnow

HowtheNSAusescellphonetrackingtofindand‘develop’targets(VIDEO)

Judge:NSA’scollectingofphonerecordsisprobablyunconstitutional

ByEllenNakashimaandAnnE.MarimowDecember16,2013

A federal judge ruled Monday that the National Security Agency’s dailycollection of virtually all Americans’ phone records is almost certainlyunconstitutional.

U.S.DistrictJudgeRichardJ.LeonfoundthatalawsuitbyLarryKlayman,aconservative legal activist, has “demonstrated a substantial likelihood ofsuccess” on the basis of Fourth Amendment privacy protections againstunreasonablesearches.

LeongrantedtherequestforaninjunctionthatblocksthecollectionofphonedataforKlaymanandaco-plaintiffandordersthegovernmenttodestroyanyoftheirrecordsthathavebeengathered.Butthejudgestayedactiononhisrulingpending a government appeal, recognizing in his 68-page opinion the“significantnationalsecurityinterestsatstakeinthiscaseandthenoveltyoftheconstitutionalissues.”

“Icannot imagineamore‘indiscriminate’and‘arbitrary invasion’ than thissystematic andhigh tech collection and retentionof personal data onvirtuallyevery single citizen for purposes of querying and analyzing it without priorjudicialapproval,”saidLeon,ajudgeontheU.S.DistrictCourtfortheDistrictofColumbia.“Surely,suchaprograminfringeson‘thatdegreeofprivacy’thatthefoundersenshrinedintheFourthAmendment.”

Thestronglywordeddecisionstandsincontrasttothesecretdeliberationsof15judgesonthenation’ssurveillancecourt,whichhearsonlythegovernment’sside of cases and since 2006 has held in a series of classified rulings that theprogram is lawful. It marks the first time a federal judge in open court hasopined on the collection of lawfulness in a case not involving a criminaldefendant.

A Justice Department spokesman, Andrew Ames, said Monday that thegovernment was reviewing Leon’s decision. “We believe the program isconstitutionalaspreviousjudgeshavefound,”hesaid.

ThechallengetotheNSA’sonce-classifiedcollectionofphonerecordsisoneof a series of cases filed in federal court since the program’s existence wasrevealedinJunebyformerNSAcontractorEdwardSnowden.

Snowden praised the ruling in a statement made to journalist GlennGreenwald,whoreceivedNSAdocumentsfromSnowdenandfirstreportedontheprogram’sexistence.

“IactedonmybeliefthattheNSA’smasssurveillanceprogramswouldnotwithstand a constitutional challenge, and that theAmerican public deserved achancetoseetheseissuesdeterminedbyopencourts,”saidSnowden,whohasreceived temporary asylum in Russia, where he is seeking to avoid U.S.prosecution under the Espionage Act for leaking NSA documents. “Today, asecretprogramauthorizedbya secret courtwas,whenexposed to the lightofday,foundtoviolateAmericans’rights.Itisthefirstofmany.”

The ruling also comes as Congress is debating whether to end the NSA’s“bulk”collectionofphonedataorendorseitinstatute.TheWhiteHouse,U.S.officialssay,supportsmaintainingtheprogram.

“ItwillbeverydifficultfortheadministrationtoarguethattheNSA’scall-tracking program should continue when a federal judge has found it to beunconstitutional,”saidJameelJaffer,deputylegaldirectoroftheAmericanCivilLiberties Union, which has also sued the government over the program’sconstitutionality.

ButGeorgeWashingtonUniversity lawprofessorOrinKerr said, “It givesopponentsoftheNSAprogrammorefueltoaddtothefire,butitslegalimpactisquitelimitedbecausethecasenowjustgoestothecourtofappeals.”

Thegovernmenthasstressedthattheprogramcollectsonly“metadata,”suchasnumbersdialed and the times and lengthsof calls, but nophone content orsubscribernames.Officialssaythatonlynumberslinkedtosuspectedterroristsarerunagainstthedatabase.

Leon’s opinion countered that the program is so sweeping— thedatabaseeasilycontainsbillionsofrecords—thatitamountstoa“dragnet”thatintrudeson the constitutional expectation of privacy. He dismissed the government’sclaim that “special needs” requiring quick access to data that could thwart aterrorist plot make a warrant impracticable. “No court has ever recognized aspecial need sufficient to justify continuous, daily searches of virtually everyAmericancitizenwithoutanyparticularizedsuspicion,”hesaid.

Thegovernment’slegaljustificationforthecall-trackingprogramisbasedona1979case,Smithv.Maryland,involvingthesurveillanceofacriminalsuspectoveratwo-dayperiod.Inthatcase,theSupremeCourtsaidthatAmericanshaveno expectation of privacy in the telephone metadata that companies hold asbusiness records, and that therefore a warrant is not required to obtain suchinformation. A succession of judges on the Foreign Intelligence SurveillanceCourthaveadoptedthegovernment’sargumentbasedonthatruling.

ButLeonsaidthequestiontheSupremeCourtconfrontedin1979isnotthesameastheonehewasfacedwith.“Indeed,thequestioninthiscasecanmoreproperly be styled as follows: When do present-day circumstances — theevolutions in thegovernment’s surveillancecapabilities,citizens’phonehabits,and the relationship between the NSA and telecom companies— become sothoroughlyunlikethoseconsideredbytheSupremeCourtthirty-fouryearsago,that a precedent like Smith does not apply?” he wrote. “The answer,unfortunatelyforthegovernment,isnow.”

Kerr said Leon is wrong to suggest that Smith no longer applies. That

decision, he said, draws a clear distinction between the collection of data onnumbersdialedandoncallcontent.Themetadatainformationthegovernmentisgatheringtoday,Kerrsaid,isthesametypeofinformationthecourtsaidthatlawenforcementcouldcollectmore than30yearsago.“Theopinion ismorevalidnow than it was,” Kerr said, adding that “it’s up to the Supreme Court tooverturnitsdecision,nottrialjudges.”

Leon,whowasnominatedbyPresidentGeorgeW.Bushandappointedtothebench in 2002, said the government has played down the program’sinvasiveness.

The “almost-Orwellian technology” that allows the government to collect,store and analyze phone metadata is “unlike anything that could have beenconceivedin1979”and,“atbest,thestuffofsciencefiction,”hesaid.

Klayman,founderofthepublicinterestgroupFreedomWatch,calledLeon’sruling“courageous.”

“Thisisawarningtobothpartiesthatthey’dbetterstartobservingtheruleoflawandprotectingtheAmericanpeopleortherewillbesevereconsequences,”hesaid.

Meanwhile,VerizonCommunications,namedasadefendant,filedamotionMondayaskingtobedismissedfromthecase.TherequestwasbasedinpartonacertificationalsofiledMondaybytheJusticeDepartmentthatthecompanyhasimmunity against lawsuits since itwas compelled by a court order to complywith thegovernment’s request fordata.That immunitywasauthorizedundera2008lawknownastheFISAAmendmentsAct.

Inhisruling,Leonrejectedthegovernment’sargumentthatKlaymanandaco-plaintiff—thefatherofanNSAcryptologistkilledinAfghanistanin2011—lacked standing to bring the suit because they were customers of VerizonsubsidiaryVerizonWireless,whichhasnotbeenpubliclyrevealedastakingpartintheprogram.

“Thegovernment,”hesaid,saysithascreateda“comprehensive”database— “in which case, the NSA must have collected metadata from Verizon

Wireless,thesinglelargestwirelesscarrierintheUnitedStates.”Yet,atthesametime,hewrote,thegovernmentassertsthattheplaintiffslackstanding“basedonthe theoretical possibility” that the NSA has not collected Verizon’s records.“Candor of this type defies common sense and does not exactly inspireconfidence!”hewrote.

Todrawan analogy, hewrote, omittingVerizonWireless,AT&TorSprint“would be like omitting John, Paul and George” and building a “Ringo-onlydatabase.”

Greg Miller, Sari Horwitz, Julie Tate and Peter Wallsten contributed to thisreport.

MorefromtheWashingtonPost

GetthelatestnewsandessentialinformationdirectlyinyourinboxfromTheWashingtonPost.

Signupforfreee-newslettersandalerts.

ConnectwithTheWashingtonPostonTwitter@washingtonpostandFacebook.

LearnmoreabouttheWashingtonPostSeries:

https://ssl.washingtonpost.com/actmgmt/help/washington-post-e-books

ConnectwithDiversionBooks

ConnectwithusforinformationonnewtitlesandauthorsfromDiversionBooks,freeexcerpts,specialpromotions,contests,andmore:

@DiversionBooks

www.Facebook.com/DiversionBooks

DiversionBookseNewsletter

www.scribd.com/DiversionBooks