NSA Spying and the Illusion of Oversight

Last week, the House Judiciary Committee hurtled toward reauthorization of a controversial spying law with a loud-and-clear declaration: not only do we have no idea how many American citizens are caught in the NSA's warrantless surveillance dragnet, we don't care—so please don't tell us! By a 20–11 majority, the panel rejected an amendment that would have required the agency's inspector general to produce an estimate of the number of Americans whose calls and e-mails were vacuumed up pursuant to broad "authorizations" under the FISA Amendments Act.

The agency's Inspector General has apparently claimed that producing such an estimate would be "beyond the capacity of his office" and (wait for it) "would itself violate the privacy of U.S. persons." This is hard to swallow on its face: there might plausibly be difficulties identifying the parties to intercepted e-mail communications, but at least for traditional phone calls, it should be trivial to tally up the number of distinct phone lines with U.S. area codes that have been subject to interception.

If the claim is even partly accurate, however, this should in itself be quite troubling. In theory, the FAA is designed to permit algorithmic surveillance of overseas terror suspects—even when they communicate with Americans. (Traditionally, FISA left surveillance of wholly foreign communications unregulated, but required a warrant when at least one end of a wire communication was in the United States.) But FAA surveillance programs must be designed to "prevent the intentional acquisition of any communication as to which the sender and all intended recipients are known at the time of the acquisition to be located in the United States"—a feature the law's supporters tout to reassure us they haven't opened the door to warrantless surveillance of purely domestic communications. The wording leaves a substantial loophole, though. "Persons" as defined under FISA covers groups and other corporate entities, so an interception algorithm could easily "target persons" abroad but still flag purely domestic communications—a concern pointedly raised by the former head of the Justice Department's National Security Division. The "prevent the intentional acquisition" language is meant to prevent that. Attorney General Eric Holder has made it explicit that the point of the FAA is precisely to allow eavesdropping on broad "Categories" of surveillance targets, defined by general search criteria, without having to identify individual targets. But, of course, if the NSA routinely sweeps up communications in bulk without any way of knowing where the endpoints are located, then it never has to worry about violating the "known at the time of acquisition" clause. Indeed, we already know that "overcollection" of purely domestic communications occurred on a large scale, almost immediately after the law came into effect.

If we care about the spirit as well as the letter of that constraint being respected, it ought to be a little disturbing that the NSA has admitted it doesn't have any systematic mechanism for identifying communications with U.S. endpoints. Similar considerations apply to the "minimization procedures" which are supposed to limit the retention and dissemination of information about U.S. persons: How meaningfully can these be applied if there's no systematic effort to detect when a U.S. person is party to a communication? If this is done, even if only for the subset of communications reviewed by human analysts, why can't that sample be used to generate a ballpark estimate for the broader pool of intercepted messages? How can the Senate report on the FAA extension seriously tout "extensive" oversight of the law's implementation when it lacks even these elementary figures? If it is truly impossible to generate those figures, isn't that a tacit admission that meaningful oversight of these incredible powers is also impossible?

Here's a slightly cynical suggestion: Congress isn't interested in demanding the data here because it might make it harder to maintain the pretense that the FAA is all about "foreign" surveillance, and therefore needn't provoke any concern about domestic civil liberties. A cold hard figure confirming that large numbers of Americans are being spied on under the program would make such assurances harder to deliver with a straight face. The "overcollection" of domestic traffic by NSA reported in 2009 may have encompassed "millions" of communications, and still constituted only a small fraction of the total—which suggests that we could be dealing with a truly massive number.

In truth, the "foreign targeting" argument was profoundly misleading. FISA has never regulated surveillance of wholly foreign communications: if all you're doing is listening in on calls between foreigners in Pakistan and Yemen, you don't even need the broad authority provided by the FAA. FISA and the FAA only need to come into play when one end of the parties to the communication is a U.S. person—and perhaps for e-mails stored in the U.S. whose ultimate destination is unknown. Just as importantly, when you're talking about large scale, algorithm-based surveillance, it's a mistake to put too much weight on "targeting" in the initial broad acquisition stage. If the first stage of your acquisition algorithm says "intercept all calls and e-mails between New York and Pakistan," that will be kosher for FAA purposes provided the nominal target is the Pakistan side, but will entail spying on just as many Americans as foreigners in practice. If we knew just how many Americans, the FAA might not enjoy such a quick, quiet ride to reauthorization.