http://www.theguardian.com/world/2014/mar/19/us-tech-giants-knew-nsa-data-collection-rajesh-de

US tech giants knew of NSA data collection, agency's top lawyer insists

NSA general counsel Rajesh De says big tech companies like Yahoo and Google provided 'full assistance' in legally mandated collection of data

Spencer Ackerman in Washington

19 March 2014

The senior lawyer for the National Security Agency stated on Wednesday that US technology companies were fully aware of the surveillance agency's widespread collection of data.

Rajesh De, the NSA general counsel, said all communications content and associated metadata harvested by the NSA under a 2008 surveillance law occurred with the knowledge of the companies -- both for the internet collection program known as Prism and for the so-called "upstream" collection of communications moving across the internet.

Asked during a Wednesday hearing of the US government's institutional privacy watchdog if collection under the law, known as Section 702 or the Fisa Amendments Act, occurred with the "full knowledge and assistance of any company from which information is obtained," De replied: "Yes."

When the Guardian [1] and the Washington Post [2] broke the Prism story in June, thanks to documents leaked by whistleblower Edward Snowden, nearly all the companies listed as participating in the program -- Yahoo, Apple, Google, Microsoft, Facebook and AOL -- claimed they did not know [3] about a surveillance practice described as giving NSA vast access to their customers' data. Some, [4] like Apple, said they had "never heard" the term Prism.

De explained: "Prism was an internal government term that as the result of leaks became the public term," De said. "Collection under this program was a compulsory legal process, that any recipient company would receive."

After the hearing, De added that service providers also know and receive legal compulsions surrounding NSA's harvesting of communications data not from companies but directly in transit across the internet under 702 authority.

The disclosure of Prism resulted in a cataclysm in technology circles, with tech giants launching extensive PR campaigns to reassure their customers of data security and successfully [5] pressing the Obama administration to allow them greater leeway to disclose the volume and type of data requests served to them by the government.

Last week, Facebook founder Mark Zuckerberg said [6] he had called US president Barack Obama to voice concern about "the damage the government is creating for all our future." There was no immediate response from the tech companies to De's comments on Wednesday.

It is unclear what sort of legal process the government serves on a company to compel communications content and metadata access under Prism or through upstream collection. Documents leaked from Snowden indicate that the NSA possesses unmediated access to the company data.

The secret Fisa court overseeing US surveillance for the purposes of producing foreign intelligence issues annual authorisations blessing NSA's targeting and associated procedures under Section 702. After winning a transparency battle with the administration in the Fisa court earlier this year, the companies are now permitted to disclose the range of Fisa orders they receive, in bands of 1,000, which presumably include orders under 702.

Passed in 2008, Section 702 retroactively gave cover of law to a post-9/11 effort permitting the NSA to collect phone, email, internet and other communications content when one party to the communication is reasonably believed to be a non-American outside the United States. The NSA stores Prism data for five years and communications taken directly from the internet for two years.

While Section 702 forbids the intentional targeting of Americans or people inside the United States -- a practice known as "reverse targeting" -- significant amounts of Americans' phone calls and emails are swept up in the process of collection.

In 2011, according to a now-declassified Fisa court ruling, the NSA was found to have collected tens of thousands [7] of emails between Americans, which a judge on the court considered a violation of the US constitution and which the NSA says it is technologically incapable of fixing.

Renewed in December 2012 over the objections of senate intelligence committee members Ron Wyden and Mark Udall, Section 702 also permits NSA analysts to search through the collected communications for identifying information about Americans, an amendment to so-called "minimisation" rules revealed by the Guardian in August [8] and termed the "backdoor search loophole" by Wyden.

De and his administration colleagues, testifying before the Privacy and Civil Liberties Oversight Board, strongly rejected suggestions by the panel that a court authorise searches for Americans' information inside the 702 databases. "If you have to go back to court every time you look at the information in your custody, you can imagine that would be quite burdensome," deputy assistant attorney general Brad Wiegmann told the board.

De argued that once the Fisa court permits the collection annually, analysts ought to be free to comb through it, and stated that there were sufficient privacy safeguards for Americans after collection and querying had occurred. "That information is at the government's disposal to review in the first instance," De said.

De also stated that the NSA is not permitted to search for Americans' data from communications taken directly off the internet, citing greater risks to privacy.

Section 702 is not the only legal authority the US government possesses to harvest data transiting the internet.

Neither De nor any other US official discussed data taken from the internet under different legal authorities. Different documents Snowden disclosed, published by the Washington Post, [9] indicated that NSA takes data as it transits between Yahoo and Google data centers, an activity reportedly conducted not under Section 702 but under a seminal executive order known as 12333.

De and his administration colleagues were quick to answer the board that companies were aware of the government's collection of data under 702, which Robert Litt, general counsel for the director of national intelligence, told the board was "one of the most valuable collection tools that we have."

"All 702 collection is pursuant to court directives, so they have to know," De reiterated to the Guardian.

[1] http://www.theguardian.com/world/2013/jun/06/us-tech-giants-nsa-data

[2] http://www.washingtonpost.com/investigations/us-intelligence-mining-data-from-nine-us-internet-companies-in-broad-secret-program/2013/06/06/3a0c0da8-cebf-11e2-8845-d970ccb04497_story.html

[3] http://www.theguardian.com/world/2013/jun/07/google-facebook-prism-surveillance-program

[4] http://googleblog.blogspot.com/2013/06/what.html

[5] http://www.theguardian.com/world/2014/feb/03/microsoft-facebook-google-yahoo-fisa-surveillance-requests

[6] https://www.facebook.com/zuck/posts/10101301165605491

[7] http://www.theguardian.com/world/2013/aug/21/nsa-illegally-collected-thousands-emails-court

[8] http://www.theguardian.com/world/2013/aug/09/nsa-loophole-warrantless-searches-email-calls

[9] http://www.washingtonpost.com/world/national-security/nsa-infiltrates-links-to-yahoo-google-data-centers-worldwide-snowden-documents-say/2013/10/30/e51d661e-4166-11e3-8b74-d89d714ca4dd_story.html