Can the NSA Search for Americans? Who Knows.

Update: Marcy Wheeler re-wrote her post, levy­ing extra snark at me for being too stu­pid to “get” the dif­fer­ence between search­ing and tar­get­ing. In the new post, clearer lan­guage removes many objec­tions to what she orig­i­nally wrote, though I remain con­fused by her insis­tence that she wasn’t talk­ing about tar­get­ing con­sid­er­ing all of the reports cites (which are excerpted here as well) use the word “tar­get,” while I did not. Indeed, the reports Marcy excerpted all say “tar­get” but not “search,” while her post repeat­edly uses the word “search” to dis­cuss how 702 data is han­dled. I don’t think I’m the one who con­fused the two terms, but any­one read­ing this can make up their own mind on that.

While she’s cleared up her orig­i­nal point, I’m leav­ing this post as is, as a warn­ing against writ­ing writ­ing an unclear blog­post then going ther­monu­clear on Twit­ter when some­one points out rather glar­ing tex­tual inac­cu­ra­cies. At the same time, it’s worth not­ing that in a let­ter Direc­tor of NSA Gen­eral Keith Alexan­der pub­licly retracted some of the NSA’s orig­i­nal talk­ing points, focus­ing in par­tic­u­lar on the tar­get­ing of indi­vid­u­als out­side the U.S. and not­ing that the issue of whether they can search for Amer­i­cans (and under what cir­cum­stances) has already been dis­cussed pub­licly. This let­ter was pub­lished long after Marcy’s orig­i­nal post.


I’m curi­ous about this. Intel­li­gence critic Marcy Wheeler wrote a blog­post titled, “Con­firmed: NSA Does Search Sec­tion 702 Data for Par­tic­u­lar US Per­son Data.” It’s a bold claim, since the NSA, Con­gress, White House, and DOJ have been insist­ing for weeks that it actu­ally does not and, legally, can­not. Nev­er­the­less, Wheeler thinks Sen­a­tors Udall and Wyden are imply­ing in their vaguely worded let­ter about NSA pro­ce­dures that the agency can still search for “par­tic­u­lar US Per­son data,” mean­ing for individuals.

So I decided to dig into the argu­ments sup­port­ing the claim that the NSA searches 702 Data (which is data col­lected under sec­tion 702 of the USA PATRIOT Act). Wheeler writes:

Last year’s SSCI report on extend­ing the FISA Amend­ments Act strongly implied that the gov­ern­ment inter­preted the law to mean it could search for records of par­tic­u­lar Americans.

Yet the para­graphs she cites from that report do not include that impli­ca­tion. Here’s what she excerpts:

Dur­ing the Committee’s con­sid­er­a­tion of this leg­is­la­tion, sev­eral Sen­a­tors expressed a desire to quan­tify the extent of inci­den­tal col­lec­tion under Sec­tion 702. I share this desire. How­ever, the Com­mit­tee has been repeat­edly advised by the ODNI that due to the nature of the col­lec­tion and the lim­its of the tech­nol­ogy involved, it is not rea­son­ably pos­si­ble to iden­tify the num­ber of peo­ple located in the United States whose com­mu­ni­ca­tions may have been reviewed under Sec­tion 702 author­ity. Sen­a­tors Ron Wyden and Mark Udall have requested a review by the Inspec­tor Gen­eral of the NSA and the Inspec­tor Gen­eral of the Intel­li­gence Com­mu­nity to deter­mine whether it is fea­si­ble to esti­mate this num­ber. The Inspec­tors Gen­eral are con­duct­ing that review now, thus mak­ing an amend­ment on this sub­ject unnecessary.

Finally, on a related mat­ter, the Com­mit­tee con­sid­ered whether query­ing infor­ma­tion col­lected under Sec­tion 702 to find com­mu­ni­ca­tions of a par­tic­u­lar United States per­son should be pro­hib­ited or more robustly con­strained. As already noted, the Intel­li­gence Com­mu­nity is strictly pro­hib­ited from using Sec­tion 702 to tar­get a U.S. per­son, which must at all times be car­ried out pur­suant to an indi­vid­u­al­ized court order based upon prob­a­ble cause. With respect to ana­lyz­ing the infor­ma­tion law­fully col­lected under Sec­tion 702, how­ever, the Intel­li­gence Com­mu­nity pro­vided sev­eral exam­ples in which it might have a legit­i­mate for­eign intel­li­gence need to con­duct queries in order to ana­lyze data already in its pos­ses­sion. [Marcy Wheeler emphasis]

In the text of the actual report, though, that last para­graph has more text in it.

Finally, on a related mat­ter, the Com­mit­tee con­sid­ered whether query­ing infor­ma­tion col­lected under Sec­tion 702 to find com­mu­ni­ca­tions of a par­tic­u­lar United States per­son should be pro­hib­ited or more robustly con­strained. As already noted, the Intel­li­gence Com­mu­nity is strictly pro­hib­ited from using  Sec­tion 702 to tar­get a U.S. per­son, which must at all times be car­ried out pur­suant to an indi­vid­u­al­ized court order based  upon prob­a­ble cause. With respect to ana­lyz­ing the infor­ma­tion law­fully col­lected under Sec­tion 702, how­ever, the Intel­li­gence Com­mu­nity pro­vided sev­eral exam­ples in which it might have a legit­i­mate for­eign intel­li­gence need to con­duct queries in order to ana­lyze data already in its pos­ses­sion. The Depart­ment of Jus­tice and Intel­li­gence Com­mu­nity reaf­firmed that any  queries made of Sec­tion 702 data will be con­ducted in strict com­pli­ance with applic­a­ble guide­lines and pro­ce­dures and do not  pro­vide a means to cir­cum­vent the gen­eral require­ment to obtain a court order before tar­get­ing a U.S. per­son under FISA[Empha­sis mine]

Marcy writes, “This pas­sage made it clear that the Intel­li­gence Com­mu­nity had demanded the abil­ity to search on US per­son data already col­lected. Wyden and Udall’s let­ter makes that even more clear.”

This is not an accu­rate sum­mary of the pas­sage from which she quotes. The Com­mit­tee report says the IC and DOJ requested addi­tional queries author­i­ties, which the Com­mit­tee con­sid­ered then rejected while stud­ies of exist­ing capa­bil­i­ties were fin­ished. While Marcy is cor­rect that this pas­sage shows the Intel­li­gence Com­mu­nity requested the abil­ity to search on this data, the  text of the report also shows that the Com­mit­tee rejected that request and made the Intel­li­gence Com­mu­nity and Depart­ment of Jus­tice reaf­firm that any queries adhere to the let­ter of the law and not cir­cum­vent “the gen­eral require­ment to obtain a court order.”

Marcy then says that the min­i­miza­tion pro­ce­dures pub­lished by the Guardian “make it clear that US per­son com­mu­ni­ca­tions will be retained if they con­tain for­eign intel­li­gence infor­ma­tion (a term not defined in the pro­ce­dures), includ­ing those they col­lected because (they claim) they’re unable to fil­ter it out.” Again, this is true but does not address whether NSA itself can search for par­tic­u­lar US per­son data, only that it is retained.

In a twit­ter exchange, Kurt Eichen­wald, a reporter who wrote a volu­mi­nous book on the NSA, said that this data is “anonymized” to pre­vent dis­clo­sure of any par­tic­u­lar US per­son. In order for any par­tic­u­lar data to be searched, a spe­cific war­rant would need to be issued by a court.

But the impor­tant part of this dis­cus­sion is whether data reten­tion is the same thing as data search­ing. At a basic level, it is not. NSA can col­lect data, retain some of it, but is severely cur­tailed in what it can directly search. In fact, she quotes a pas­sage from those min­i­miza­tion pro­ce­dures to sup­port her claim that NSA searches the data directly:

(1) NSA may pro­vide to the Cen­tral Intel­li­gence Agency (CIA) unmin­i­mized com­mu­ni­ca­tions acquired pur­suant to sec­tion 702 of the Act. CIA will iden­tify to NSA tar­gets for which NSA may pro­vide unmin­i­mized com­mu­ni­ca­tions to CIA. CIA will process any such unmin­i­mized com­mu­ni­ca­tions received from NSA in accor­dance with CIA min­i­miza­tion procedures …

(2) NSA may pro­vide to the FBI unmin­i­mized com­mu­ni­ca­tions acquired pur­suant to sec­tion 702 of the Act. FBI will iden­tify to NSA tar­gets for which NSA may pro­vide unmin­i­mized com­mu­ni­ca­tions to the FBI. FBI will process any such unmin­i­mized com­mu­ni­ca­tions received from NSA in accor­dance with FBI min­i­miza­tion procedures …

The thing is, that text does not actu­ally show how or when NSA can search “par­tic­u­lar US per­son data,” as she says it does. Rather, it demon­strates sev­eral pro­ce­dures by which CIA and the FBI can request NSA data to do their own search­ing, in accor­dance with each agency’s own par­tic­u­lar min­i­miza­tion procedures.

While there are aspects of these laws that might sup­port what Marcy is argu­ing, she did not pro­vide it in her text (she also told me over twit­ter that she updated the orig­i­nal ver­sion of her post, so I don’t even know if it’s changed since I began writ­ing this. But in that exchange, she also made a curi­ous statement:

The Intel­li­gence Com­mu­nity is not NSA. NSA is a part of the IC. So when the FAA report says the IC can do it, it is refer­ring to the 17 or so agen­cies that make up the IC, one of which is the NSA. The reports Marcy excerpted also sug­gest that NSA does not directly search records with­out spe­cific queries from other agen­cies that are enabled to do so. Maybe the laws, some­where, say that that is pos­si­ble. But it’s not in the text pro­vided to sup­port that post.

The prob­lem, I sus­pect, is that def­i­n­i­tions mat­ter. And when def­i­n­i­tions are will­fully toyed with, twisted, and appended to leaps of logic that might be sup­port­able but not with the text at hand, con­clu­sions get the patina of cer­tainty when they are really lit­tle more than spec­u­la­tion based on a lot of read­ing between the lines and assumption.

Does the NSA have the power to search for “par­tic­u­lar US per­son data?” In her piece say­ing it can, Marcy Wheeler did not pro­vide any evi­dence to say so. I don’t know if it can, and I can­not deter­mine whether NSA Chief Keith Alexan­der is lying when he says they do not. And that is the prob­lem: we can­not say with any real certainty.