The proverbial haystack of all electronic communications

PRISM logoThe intent of the NSA to capture all communications that they can reach has been made clear by General Hayden as well as several NSA whistleblowers over the last decade (Drake, Binney, Wiebe, Klein, Tice). The problem of finding the communications of tiny terrorist cells in the midst of the massive flood of all the world’s  phone calls has been called ‘a search for a needle in a haystack’.  The method has been described as ‘to make sure you get the needles, first get the haystack’, in other words, record *ALL* calls. The massive collection of domestic phone call content was what caused Bill Binney to retire from NSA in 2001 and it is what has caused Tom Drake to blow the whistle at NSA and Defense IG offices, Congressional committees in the years after 9/11 and, now as he speaks to the public.

I am pretty sure the argument goes like this: At 100s of millions of calls per day, the volume of calls is too high to pick which calls to record in real time as they go through the packet-switched network of the phone system in bits and pieces, especially at peak usage. It is thought that the bulk recording is done by switch duplication &/or tapping at the telco switches. Adding the further complication that the packets from a single call may get recorded more than once  at several different switches. So, to make sense of this multi-stream firehose of data, all calls are recorded and are processed later to complete the identification, reconstruction and indexing for linkage with the existing analysis database. By using parallel (& pipeline) methods, the calls are processed too slowly to keep up with an actual phone conversation but still worked through fast enough to keep up in the aggregate – with a lag time of overnight or a few days.

In short, the justification for keeping all the calls is that all calls must be saved in order to make sure that all terrorist calls are acquired. I posit that these ‘means’ (saving all US calls) is a necessary part of the primary end purpose (save and provide all US calls to the FBI, etc.).

Woah!! I hear you say – NSA’s purpose is foreign directed and the FISA/FAA law is clear in its call for minimization of acquisition and retention of US calls. FISA/FAA also contain a clear prohibition of dissemination of any domestic content that may be inadvertently or unavoidably retained with exceptions only for foreign intelligence, public safety and evidence of a crime.

Minimization Procedures Should Prohibit Dissemination …

From 50 USC §1801(h), the definition of minimization procedures (with my bolds) is:

h) “Minimization procedures”, with respect to electronic surveillance, means—

(1) specific procedures, which shall be adopted by the Attorney General, that are reasonably designed in light of the purpose and technique of the particular surveillance, to minimize the acquisition and retention, and prohibit the dissemination, of nonpublicly available information concerning unconsenting United States persons consistent with the need of the United States to obtain, produce, and disseminate foreign intelligence information;
(2) procedures that require that nonpublicly available information, which is not foreign intelligence information, as defined in subsection (e)(1) of this section, shall not be disseminated in a manner that identifies any United States person, without such person’s consent, unless such person’s identity is necessary to understand foreign intelligence information or assess its importance;
(3) notwithstanding paragraphs (1) and (2), procedures that allow for the retention and dissemination of information that is evidence of a crime which has been, is being, or is about to be committed and that is to be retained or disseminated for law enforcement purposes; and
(4) notwithstanding paragraphs (1), (2), and (3), with respect to any electronic surveillance approved pursuant to section 1802 (a) of this title, procedures that require that no contents of any communication to which a United States person is a party shall be disclosed, disseminated, or used for any purpose or retained for longer than 72 hours unless a court order under section 1805 of this title is obtained or unless the Attorney General determines that the information indicates a threat of death or serious bodily harm to any person.

With some exceptions…

One can match the exceptions allowed by law 50 USC §1801(h) to the section 5 domestic content  minimization exceptions:

  • foreign intelligence  1801(h) (2) & (4)   :law = min:  5(1)
  • evidence of a crime 1801(h) (3)  :law = min:  5(2)
  • imminent harm  1801(h) (4)  :law = min:  5(4)
  • incomplete cryptanalysis  -not-in-law- :law = min:  5(3)a
  • hacking/cyberdefense    -not-in-law-  :law = min:  5(3)
  • signal exploitation   -not-in-law-  :law = min:  5(3)
  • traffic analysis    -not-in-law-    :law=min:  5(3)

So there are exceptions within the minimization procedures that are not matched by the definition of minimization at  50 USC §1801(h).  I will grant that the NSA is an expert and appropriate agency in the areas of cryptanalysis and cyberdefense so I step over these two exceptions here as plausibly within their foreign intelligence and cyberdefense mandates.

But uncalled for exceptions eat the rule!

Section 5 of the recently disclosed 2009 Minimization Procedures Used By The NSA… allows for all domestic content (domestic wire, oral, or electronic communications) to be retained and disseminated to the FBI and/or other government entities:

5. A communication identified as a domestic communication will be destroyed upon recognition unless the Director (or Acting Director) of NSA specifically determines, in writing, that:

… snip … 5(1) foreign intelligence info … 5(2) evidence of crime …

5(3) the communication is reasonably believed. to contain technical data base information, [ed: TDI = information retained for cryptanalytic, traffic analytic, or signal exploitation purposes], or information necessary to understand or assess a communications security vulnerability. Such communication may be provided to the FBI and/or disseminated to other elements of the United States Government. Such communications may be retained for a period sufficient to allow a thorough exploitation and to permit access to data that are, or are reasonably believed likely to become, relevant to a current or future foreign intelligence requirement. Sufficient duration may vary with the nature of the exploitation.

The ‘signal exploitation’ and ‘traffic analytic’ exceptions are where all US electronic communications fall down the robot hole: in them the content may be disseminated throughout the USG. One can see that the prohibition of dissemination in the law is implemented by the counter policy “may be provided to the FBI &/or disseminated to other elements of the USG”. Maybe this is technically legal, but the overall legality of these minimization procedures that  disseminate despite specific prohibition is very highly debatable, unless we all agree now that Prohibition can sometimes be Permission.

‘But wait!’ I hear you say that the policy does not flaunt its enabling law because ‘These are technical database exceptions! They are rare and not the usual case at all!  Why do you say this means they retain it all?!?!’   Well, that could be said, but it would be completely wrong: these exceptions are written so that ALL domestic calls fall under their supposedly ‘exceptional’ cases.

Signal exploitation is not an exception – it is what the NSA does

I am no expert on the NSA, but one of their main jobs is SigInt – signals intelligence. Exploiting signals is what they have done for decades: exploitation in this context is wringing every bit of useful information out of the signals that have been intercepted. Thorough signal exploitation is the hallmark of complete work by any intelligence agency. So, 5(3) effectively becomes:

We don’t destroy any domestic communications: we keep them because its our job requires us to acquire all communications and it requires us to exploit all the communications we have.

I can hear you screaming now NOOOOOO!!! that’s too stupid simple!!!  they couldn’t do that… *splutter*
So, I will just note that this justification does seem to require secrecy to preserve its technical, but very questionable legality.
I will just park this argument and move along further down the robot hole ….

Traffic analysis is not an exception – again, it is what the NSA does

Again, I am no expert on the NSA, but one of their main jobs is traffic analysis.  It’s what they do with the metadata, right? Analyzing and obfuscating patterns of communication has been done for a very long time (decades at a minimum).  From the Free Internet Dictionary’s Encyclopedia entry on traffic analysis:

Traffic analysis is the process of intercepting and examining messages in order to deduce information from patterns in communication. It can be performed even when the messages are encrypted and cannot be decrypted. In general, the greater the number of messages observed, or even intercepted and stored, the more can be inferred from the traffic. Traffic analysis can be performed in the context of military intelligence or counter-intelligence, and is a concern in computer security.

Again, traffic analysis falls solidly within the NSA’s bailiwick.  It is very likely that there are many, many ways that the system level content of a cell call meets the ‘traffic analytic’ definition within the technical database information [TDI] exception.  Here are a few:

direct link to already stored TDI:  the call itself contains metadata already stored in the database (perhaps from the Verizon FISA warrant),
pattern info: the size of the call content at the system level will contain weight information (length of call and the amount of talking vs. silence), and
basic traffic info (location of endpoint): the cell tower or other position info will exist at the system content level as packet destination info

So, shorter exception 5(3) is:

We don’t destroy any domestic communications: we keep them because its our job to acquire all communications in order to completely analyze the patterns in the communications we have.

To recap what is clear about the twisted nature of this less ethical minimization procedure signed by Attorney General Eric Holder:

By their nature, ALL electronic communications are useful in signal exploitation and traffic analysis.
Therefore by policy, ALL US phone calls are retained and exploited as signals within patterns of traffic.
Also by policy, ALL retained US calls may be disseminated to the FBI and other governmental entities.
And, ALL US calls are retained until thoroughly exploited.
– YET –
The law clearly states retention is to be minimized (not open-ended), and
The law clearly states dissemination is prohibited (not allowed for domestic calls).

I am not a lawyer – this setup is may still be technically legal because Atty General Holder said so and the FISCourt approved.  However, it is clear that the overall legality of a retention minimization and dissemination prohibition policy that universally retains and disseminates phone calls (and all other electronic communications) is highly questionable to say the least. So, maybe the NSA minimization policy is not illegal, but it certainly is less ethical than an actual prohibition would be.

One can imagine that these minimization procedures have been refined since 2009. It’s quite likely that the ‘signal exploitation’ provision no longer occurs within the current procedures: I believe that the still sealed 86 page 2011 FISC decision that is sought by EFF  most likely struck down this ‘signal exploitation’ non-exception. Seems that one of those FISC judges actually took the time to read and comprehend what he was signing. Signal exploitation as an exceptional case within the NSA!?! It would be laughable if it were not an exception that ate the rule in the implementation of Fourth Amendment protection by the USG.  And there is  still the ‘traffic analysis’ exception…

Whither the Fourth Amendment?

The FISA/FAA laws were passed with the intent to exclude nearly all US communications from surveillance in order to protect Fourth Amendment rights of US persons. The ‘minimization’ policy instead allows for retaining and disseminating essentially ALL domestic communications. The USG implementation of the Fourth Amendment protection mandated by Congress in FISA/FAA appears to have led to complete abrogation of the Fourth Amendment in the sphere of electronic communications.  So, the modern 4th Amendment acts like this now:

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized, except for electronic communication (email, text, phone, wire, IM, VoIP, etc.)  which will in every case be seized before delivery and will be searched, sorted, indexed, retained and disseminated at will throughout the government.

I need a little help here – the only word that comes to my bent and weary mind right now is perverted, as in:  The NSA has perverted the Fourth Amendment.  To turn it so completely around is not subversion, it is worse.  Guess I will just stick with the faint praise …

Retaining and Disseminating All Domestic Electronic Communication Is Just Less Ethical Privacy Protection. 

The disclosure of the general warrants for cell phone metadata was coupled with the protestations that the metadata isn’t content and it is only accessed by the NSA for foreign intelligence purposes. But the metadata can be disseminated to the FBI, as well, along with the content of the calls according to the 2009 minimization procedures.  So, even if one grants that the NSA doesn’t listen to scads of US phone calls, that doesn’t begin to answer the question:

Does the FBI retain and exploit domestic metadata, phone calls and other communications gathered under FISA?

Restore the Fourth!

We need to take a good look at the Fifth as well.  Last time I made a call it made ringing noises instead of telling me “You have the right to hang up.  Anything you say may be used against you…” and neither did my phone come with a
Miranda Warning ringtone when I bought it.

UPDATE: For Llorona:

Bolivian President Evo Morales expresses heart-felt interest in meeting ‘emigrants from North America’ After Unplanned Stop-Over in Austria

As a matter of course, the truth has been there all along.

Either you haven’t heard it yet or it seeps out of reality at every turn.