Jochai Ben-Avie and Katherine Maher contributed to this report.
This week, we learned the NSA is eavesdropping on the private cables running between the Google and Yahoo data centers where all user data is held. Under a program codenamed MUSCULAR the NSA is going right in, without permission from the companies or the courts, and Google engineers are reportedly livid.
While PRISM and other surveillance programs allow the NSA and other intelligence agencies to directly request user data from Google, Yahoo!, and other companies (with some oversight from the Foreign Intelligence Surveillance Court), the NSA is also intercepting and acquiring user data as it travels between the companies’ private data centers. What’s worse, because the interception is occurring outside of the U.S., the NSA isn’t bound by even the (extremely limited) protections contained in the Foreign Intelligence Surveillance Act (FISA) and other authorities.
An endless stream of data is available on the tapped cables: According to a leaked memo dated Jan. 9, 2013, the NSA had gathered 181,280,466 records from internal Yahoo and Google networks in just 30 days, and sent it to the agency’s headquarters at Fort Meade, Maryland. The data is also shared with NSA’s British counterpart, the Government Communications Headquarters (GCHQ).
Legal limits and principles
Both Yahoo and Google have publicly denied giving U.S. government access, and the NSA says it has processes to avoid snooping on U.S. persons, but the program’s legal groundings are murky. While the U.S. Congress has never pretended to defend the rights of foreign nationals, it also hasn’t imposed any clear restrictions on data acquired abroad, regardless of the nationality of the user. And barring a remarkable reversal in U.S. politics, it seems unlikely that an international ‘no-spy’ agreement will be reached soon.
The Washington Post, which broke the story, suggested that this program may be authorized under Executive Order 12333, issued by U.S. President Ronald Reagan in 1981, in order to expand U.S. intelligence activities to collect the “best intelligence available.” E.O. 12333 mandates the NSA collect and process data for “national foreign intelligence purposes,” and its only explicit limitations are on collection about U.S. persons. The only other guidance on collection states that it must be done in a “responsible manner that is consistent with the Constitution and applicable law and respectful of the principles upon which the United States was founded” — hardly a strong standard for user privacy.
But MUSCULAR violates both parts of that guidance. It is a total abandonment of the US Constitution’s Fourth amendment, which limits government investigations to those based on probable cause. Historically, the concept of probable cause, or the fair probability that what is sought is relevant to a legitimate prosecution, has placed the burden of proof on the government to justify its suspicion and any privacy intrusions. But bulk data collection, by its very nature, is inherently not limited to any particular investigation — making it impossible for the government to prove relevance. Rather, bulk collection takes the opposite value as its proposition: all data is suspicious, because any piece of information could possibly expose criminal behavior. Effectively, this logic turns all users into suspects.
Bulk collection is also antithetical to the “principles upon which the United States was founded.” Of all the rights afforded by the U.S. Constitution, perhaps the best known is that of its First Amendment: the right to free speech. The history of jurisprudence on freedom of speech has roundly rejected any restraint that would impose a “chilling effect” on expression. The invisible nature of surveillance, however, creates precisely this effect — those being watched internalize the watcher and self-censor.
A close student of history would also recognize the fundamental contradiction between the use of bulk collection and the historical role of ‘general warrants’ in the founding of the United States. General warrants, or warrants that are broad and nonspecific in nature, were used by the British government to seize property or make arrests without clear justification. The regular abuse of these warrants in the colonial Americas helped fuel colonist anger with the U.K., ultimately leading to the American Revolution. As a response, the Fourth Amendment was explicitly written to prohibit the use of these warrants, enshrining the principle of probable cause. Bulk collection is a modern day general warrant, and directly in opposition to Constitutional principles.
It should also be noted that, while not a Constitutional issue, the writings of the U.S. founders make clear their respect for the principles of economic liberty. In this latest revelation, the NSA attacks the very companies that fuel the economy of the United States, and whose services most users rely on daily to conduct business and communicate.
Upstream cables
If individual phone and internet connections are like your home mailbox, the fiber optic cables running across continents and under oceans are more like postal service routes and sorting depots. Through agreements with telecoms and their own technical methods, the NSA has secured access to those cable routes, as well as their landing and exchange points in the US, under programs like STELLAR WIND, BLARNEY, and STORMBREW. Meanwhile, the UK government’s TEMPORA program accesses cable landings with help from BT, Vodafone, and others.
However, those programs differ from the new MUSCULAR program in an important way: they tap public infrastructure, capturing data from many different ISPs. MUSCULAR spies directly on the private networks of individual companies, and the “thousands of miles of fiber optic cables” they “bought or leased … for their own exclusive use.” Continuing the postal metaphor above, MUSCULAR is effectively like inserting an NSA agent on every FedEx plane, who makes a copy of anything that looks interesting, or just everything altogether.
By definition, MUSCULAR exposes and exploits the “trade secrets” of private companies, destroying any semblance of economic liberty and imperiling their business models and practices.
Beyond transparency
Access has referred to upstream data collection programs in blogs and our submission to the US Privacy and Civil Liberties Oversight Board (PCLOB). We believe these practices of upstream collection have been neglected in the post-NSA revelation debate, ignored by Congress and shamefully underreported in the media — despite posing perhaps the greatest threat to users.
Access has supported efforts by internet platforms to enhance their transparency with users. We joined the WeNeedToKnow coalition, signing a letter with companies pushing the US government to allow more disclosures and granular reporting by the companies, as well as the government itself. But now it’s time to move beyond transparency, and push for substantive reform.
Upstream collection is the most indiscriminate, unnecessary and disproportionate tool that intelligence agencies use. Its underlying values are totalitarian, and are unacceptable, whether used against Americans or anyone else.