NSA quietly expands domestic spying

NSA quietly expands domestic spying program, even as Congress balks
03/10/2008 @ 7:52 am
Filed by RAW STORY


"The central role the NSA has come to occupy in domestic intelligence gathering has never been publicly disclosed," The Wall Street Journal's Siobhan Gorman reports on Monday page ones. "But an inquiry reveals that its efforts have evolved to reach more broadly into data about people's communications, travel and finances in the U.S. than the domestic surveillance programs brought to light since the 2001 terrorist attacks."

"According to current and former intelligence officials, the spy agency now monitors huge volumes of records of domestic emails and Internet searches as well as bank transfers, credit-card transactions, travel and telephone records," Gorman adds. "The NSA receives this so-called 'transactional' data from other agencies or private companies, and its sophisticated software programs analyze the various transactions for suspicious patterns. Then they spit out leads to be explored by counterterrorism programs across the U.S. government, such as the NSA's own Terrorist Surveillance Program, formed to intercept phone calls and emails between the U.S. and overseas without a judge's approval when a link to al Qaeda is suspected."

"The NSA's enterprise involves a cluster of powerful intelligence-gathering programs, all of which sparked civil-liberties complaints when they came to light," he continues. "They include a Federal Bureau of Investigation program to track telecommunications data once known as Carnivore, now called the Digital Collection System, and a U.S. arrangement with the world's main international banking clearinghouse to track money movements."

Excerpts follow:
---------------------------------------------------------

The effort also ties into data from an ad-hoc collection of so-called "black programs" whose existence is undisclosed, the current and former officials say. Many of the programs in various agencies began years before the 9/11 attacks but have since been given greater reach. Among them, current and former intelligence officials say, is a longstanding Treasury Department program to collect individual financial data including wire transfers and credit-card transactions.

...

Two former officials familiar with the data-sifting efforts said they work by starting with some sort of lead, like a phone number or Internet address. In partnership with the FBI, the systems then can track all domestic and foreign transactions of people associated with that item -- and then the people who associated with them, and so on, casting a gradually wider net. An intelligence official described more of a rapid-response effect: If a person suspected of terrorist connections is believed to be in a U.S. city -- for instance, Detroit, a community with a high concentration of Muslim Americans -- the government's spy systems may be directed to collect and analyze all electronic communications into and out of the city.

The information doesn't generally include the contents of conversations or emails. But it can give such transactional information as a cellphone's location, whom a person is calling, and what Web sites he or she is visiting. For an email, the data haul can include the identities of the sender and recipient and the subject line, but not the content of the message.

...

Two current officials also said the NSA's current combination of programs now largely mirrors the former TIA project. But the NSA offers less privacy protection. TIA developers researched ways to limit the use of the system for broad searches of individuals' data, such as requiring intelligence officers to get leads from other sources first. The NSA effort lacks those controls, as well as controls that it developed in the 1990s for an earlier data-sweeping attempt.

...

NSA gets access to the flow of data from telecommunications switches through the FBI, according to current and former officials. It also has a partnership with FBI's Digital Collection system, providing access to Internet providers and other companies. The existence of a shadow hub to copy information about AT&T Corp. telecommunications in San Francisco is alleged in a lawsuit against AT&T filed by the civil-liberties group Electronic Frontier Foundation, based on documents provided by a former AT&T official. In that lawsuit, a former technology adviser to the Federal Communications Commission says in a sworn declaration that there could be 15 to 20 such operations around the country. Current and former intelligence officials confirmed a domestic network of hubs, but didn't know the number. "As a matter of policy and law, we can not discuss matters that are classified," said FBI spokesman John Miller.

The budget for the NSA's data-sifting effort is classified, but one official estimated it surpasses $1 billion. The FBI is requesting to nearly double the budget for the Digital Collection System in 2009, compared with last year, requesting $42 million. "Not only do demands for information continue to increase, but also the requirement to facilitate information sharing does," says a budget justification document, noting an "expansion of electronic surveillance activity in frequency, sophistication, and linguistic needs."

Wiretapping focus shifts to email, as firms move data overseas
03/07/2008 @ 10:11 am
Filed by John Byrne

Microsoft, Google don't deny participation in NSA program

Little-noticed comments by a senior Justice Department official suggest Congress' fight over renewal of the Foreign Intelligence Surveillance Act surround interception of email and Internet data.

At a Monday breakfast sponsored by the American Bar Association, Assistant Attorney General for National Security Kenneth Wainstein remarked that the fight over the eavesdropping bill actually centers on US interception of email.

"In response to a question at the meeting by David Kris, a former federal prosecutor and a FISA expert, Wainstein said FISA's current strictures did not cover strictly foreign wire and radio communications, even if acquired in the United States," the Washington Post reported Tuesday. "The real concern, he said, is primarily e-mail, because "essentially you don't know where the recipient is going to be" and so you would not know in advance whether the communication is entirely outside the United States."

Unlike phone calls, email messages are generally stored before being transmitted to the sender. Most messages are stored on an email provider's servers before they are accessed by the recipient.

Because they can be located anywhere, this means any portion of the law related to the Web could snare Americans' data overseas.

Microsoft declined to comment when asked about their participation in any NSA program, saying only that they have 300 million active email accounts.

Google told CNET: "As our privacy policy states, we comply with law enforcement requests made with proper service. We do not discuss specific law enforcement requests and generally do not share aggregate information about them. There are also some legal restrictions on what information we can share about law enforcement requests."

US companies moving data centers overseas
The admission comes amidst US email and Internet companies moving some of their servers overseas. According to a piece in March's edition of Harper's Magazine, AT&T, Microsoft and Google all have or plan overseas data centers in an effort by the companies to cut costs.

"Microsoft has announced plans for a data center in Siberia, AT&T has built two in Shanghai, and Dublin has attracted Google and Microsoft," Harper's notes.

Americans' personal data isn't just email. More and more computer users are storing personal word processing, photographs and other files online through document sharing programs like Google Documents.

"As the functions long performed by personal computers come to be executed by these far-flung data centers," the magazine writes, "the technology industry has rapturously rebranded the Internet as 'the cloud.'"

Some say Wainstein's admission that the debate over the eavesdropping act is centered not on "wire and radio" transmissions -- eg, phone calls -- suggests that most of the National Security Agency's concern is about their ability to spy on Internet data.

Director of National Intelligence "Michael McConnell, the serial exaggerator who claims to be a non-political straight shooter, himself kept saying the NSA lost 70 percent of its capabilities after the ruling," Wired blogger Ryan Singer writes. "If that's the case, that means that 70 percent of what the NSA does is collect emails inside United States telecom infrastructure and service providers."

If Congress approves immunity for companies that participated in President Bush's warrantless wiretapping program, these email carriers will get a pass. Though most debate centers around those companies already identified as participants -- Verizon, AT&T and Sprint -- the Act provides immunity for all companies that complied with federal orders, provided they had a solid legal foundation.

CNET's Chris Soghoian offers more. He writes that yet more companies could have been involved, noting that there are numerous firms that make up the Internet backbone -- Tier 1 Internet service providers.

According to Wikipedia, Soghoian continues, these providers are: AOL Transit Data Network, AT&T, Global Crossing, Verizon Business, NTT Communications, Qwest, SAVVIS, and Sprint.

"That leaves AOL, Global Crossing, NTT Communications, and SAVVIS as other potential participants in any NSA effort to sniff email communications," he adds.