Can the NSA Search for Americans? Who Knows.

8 minutes read
Analysis • Blog
journalism • NSA

Update: Marcy Wheeler re-wrote her post, levying extra snark at me for being too stupid to “get” the difference between searching and targeting. In the new post, clearer language removes many objections to what she originally wrote, though I remain confused by her insistence that she wasn’t talking about targeting considering all of the reports cites (which are excerpted here as well) use the word “target,” while I did not. Indeed, the reports Marcy excerpted all say “target” but not “search,” while her post repeatedly uses the word “search” to discuss how 702 data is handled. I don’t think I’m the one who confused the two terms, but anyone reading this can make up their own mind on that.

While she’s cleared up her original point, I’m leaving this post as is, as a warning against writing writing an unclear blogpost then going thermonuclear on Twitter when someone points out rather glaring textual inaccuracies. At the same time, it’s worth noting that in a letter Director of NSA General Keith Alexander publicly retracted some of the NSA’s original talking points, focusing in particular on the targeting of individuals outside the U.S. and noting that the issue of whether they can search for Americans (and under what circumstances) has already been discussed publicly. This letter was published long after Marcy’s original post.

I’m curious about this. Intelligence critic Marcy Wheeler wrote a blogpost titled, “Confirmed: NSA Does Search Section 702 Data for Particular US Person Data.” It’s a bold claim, since the NSA, Congress, White House, and DOJ have been insisting for weeks that it actually does not and, legally, cannot. Nevertheless, Wheeler thinks Senators Udall and Wyden are implying in their vaguely worded letter about NSA procedures that the agency can still search for “particular US Person data,” meaning for individuals.

So I decided to dig into the arguments supporting the claim that the NSA searches 702 Data (which is data collected under section 702 of the USA PATRIOT Act). Wheeler writes:

Last year’s SSCI report on extending the FISA Amendments Act strongly implied that the government interpreted the law to mean it could search for records of particular Americans.

Yet the paragraphs she cites from that report do not include that implication. Here’s what she excerpts:

During the Committee’s consideration of this legislation, several Senators expressed a desire to quantify the extent of incidental collection under Section 702. I share this desire. However, the Committee has been repeatedly advised by the ODNI that due to the nature of the collection and the limits of the technology involved, it is not reasonably possible to identify the number of people located in the United States whose communications may have been reviewed under Section 702 authority. Senators Ron Wyden and Mark Udall have requested a review by the Inspector General of the NSA and the Inspector General of the Intelligence Community to determine whether it is feasible to estimate this number. The Inspectors General are conducting that review now, thus making an amendment on this subject unnecessary.

Finally, on a related matter, the Committee considered whether querying information collected under Section 702 to find communications of a particular United States person should be prohibited or more robustly constrained. As already noted, the Intelligence Community is strictly prohibited from using Section 702 to target a U.S. person, which must at all times be carried out pursuant to an individualized court order based upon probable cause. With respect to analyzing the information lawfully collected under Section 702, however, the Intelligence Community provided several examples in which it might have a legitimate foreign intelligence need to conduct queries in order to analyze data already in its possession. [Marcy Wheeler emphasis]

In the text of the actual report, though, that last paragraph has more text in it.

Finally, on a related matter, the Committee considered whether querying information collected under Section 702 to find communications of a particular United States person should be prohibited or more robustly constrained. As already noted, the Intelligence Community is strictly prohibited from using  Section 702 to target a U.S. person, which must at all times be carried out pursuant to an individualized court order based  upon probable cause. With respect to analyzing the information lawfully collected under Section 702, however, the Intelligence Community provided several examples in which it might have a legitimate foreign intelligence need to conduct queries in order to analyze data already in its possession. **The Department of Justice and Intelligence Community reaffirmed that any  queries made of Section 702 data will be conducted in strict compliance with applicable guidelines and procedures and do not  provide a means to circumvent the general requirement to obtain a court order before targeting a U.S. person under FISA. **[Emphasis mine]

Marcy writes, “This passage made it clear that the Intelligence Community had demanded the ability to search on US person data already collected. Wyden and Udall’s letter makes that even more clear.”

This is not an accurate summary of the passage from which she quotes. The Committee report says the IC and DOJ requested additional queries authorities, which the Committee considered then rejected while studies of existing capabilities were finished. While Marcy is correct that this passage shows the Intelligence Community requested the ability to search on this data, the  text of the report also shows that the Committee rejected that request and made the Intelligence Community and Department of Justice reaffirm that any queries adhere to the letter of the law and not circumvent “the general requirement to obtain a court order.”

Marcy then says that the minimization procedures published by the Guardian “make it clear that US person communications will be retained if they contain foreign intelligence information (a term not defined in the procedures), including those they collected because (they claim) they’re unable to filter it out.” Again, this is true but does not address whether NSA itself can search for particular US person data, only that it is retained.

In a twitter exchange, Kurt Eichenwald, a reporter who wrote a voluminous book on the NSA, said that this data is “anonymized” to prevent disclosure of any particular US person. In order for any particular data to be searched, a specific warrant would need to be issued by a court.

But the important part of this discussion is whether data retention is the same thing as data searching. At a basic level, it is not. NSA can collect data, retain some of it, but is severely curtailed in what it can directly search. In fact, she quotes a passage from those minimization procedures to support her claim that NSA searches the data directly:

6(c)

(1) NSA may provide to the Central Intelligence Agency (CIA) unminimized communications acquired pursuant to section 702 of the Act. CIA will identify to NSA targets for which NSA may provide unminimized communications to CIA. CIA will process any such unminimized communications received from NSA in accordance with CIA minimization procedures …

(2) NSA may provide to the FBI unminimized communications acquired pursuant to section 702 of the Act. FBI will identify to NSA targets for which NSA may provide unminimized communications to the FBI. FBI will process any such unminimized communications received from NSA in accordance with FBI minimization procedures …

The thing is, that text does not actually show how or when NSA can search “particular US person data,” as she says it does. Rather, it demonstrates several procedures by which CIA and the FBI can request NSA data to do their own searching, in accordance with each agency’s own particular minimization procedures.

While there are aspects of these laws that might support what Marcy is arguing, she did not provide it in her text (she also told me over twitter that she updated the original version of her post, so I don’t even know if it’s changed since I began writing this. But in that exchange, she also made a curious statement:

The Intelligence Community is not NSA. NSA is a part of the IC. So when the FAA report says the IC can do it, it is referring to the 17 or so agencies that make up the IC, one of which is the NSA. The reports Marcy excerpted also suggest that NSA does not directly search records without specific queries from other agencies that are enabled to do so. Maybe the laws, somewhere, say that that is possible. But it’s not in the text provided to support that post.

The problem, I suspect, is that definitions matter. And when definitions are willfully toyed with, twisted, and appended to leaps of logic that might be supportable but not with the text at hand, conclusions get the patina of certainty when they are really little more than speculation based on a lot of reading between the lines and assumption.

Does the NSA have the power to search for “particular US person data?” In her piece saying it can, Marcy Wheeler did not provide any evidence to say so. I don’t know if it can, and I cannot determine whether NSA Chief Keith Alexander is lying when he says they do not. And that is the problem: we cannot say with any real certainty.

comments powered by Disqus