On Saturday the Washington Post reported that a newly released cache of intercepted conversations, obtained from whistleblower Edward Snowden, shows that ordinary internet users ‘far outnumbered’ legal targets for NSA surveillance.
In fact, nine out of ten account holders in the cache were not the intended surveillance targets, and despite the NSA only having a legal remit to collect data on ‘foreign’ targets, almost half of the accounts ‘could be strongly linked to U.S. citizens or U.S.residents. (sic)’
In fairness, it seems that some genuinely valuable information was uncovered in collecting the data seen in the cache, including ‘fresh revelations about a secret overseas nuclear project, double-dealing by an ostensible ally, a military calamity that befell an unfriendly power, and the identities of aggressive intruders into U.S. computer networks.’
A Pakistan based bomb-maker implicated in the 2002 Bali bombings was also captured after ‘months of tracking communications across more than 50 alias accounts.’ The Post has withheld further examples in order not to ‘compromise ongoing operations.’
Nevertheless, the vast majority of the 160,000 intercepted email and instant-message conversations (some of them hundreds of pages long), and 7,900 documents taken from over 11,000 online accounts, are from illegally targeted subjects, and relate to often very personal information,
‘Many other files, described as useless by the analysts but nonetheless retained, have a startlingly intimate, even voyeuristic quality. They tell stories of love and heartbreak, illicit sexual liaisons, mental-health crises, political and religious conversions, financial anxieties and disappointed hopes. The daily lives of more than 10,000 account holders who were not targeted are catalogued and recorded nevertheless.’
The cache came from domestic NSA operations performed under the 2008 amendments to the Foreign Intelligence Surveillance Act (FISA), which only authorises collection of data relating to foreign nationals located overseas, unless a warrant based on probable cause has been obtained from a special surveillance court.
It is clear that while ‘incidental collection’ of third party communications is inevitable, the NSA made little or no effort to limit this,
‘If a target entered an online chat room, the NSA collected the words and identities of every person who posted there, regardless of subject, as well as every person who simply “lurked,” reading passively what other people wrote.
“1 target, 38 others on there,” one analyst wrote. She collected data on them all.
In other cases, the NSA designated as its target the Internet protocol, or IP, address of a computer server used by hundreds of people.’
Perhaps most worrying is the Post’s revelation that all an NSA operator needs satisfy FISA regulations is ‘reasonable belief’ that the target is foreign,
‘One analyst rests her claim that a target is foreign on the fact that his e-mails are written in a foreign language, a quality shared by tens of millions of Americans. Others are allowed to presume that anyone on the chat ‘buddy list’ of a known foreign national is also foreign.’