WP: Obama's restrictions on NSA surveillance rely on narrow definition of 'spying'

http://www.washingtonpost.com/world/national-security/obamas-restrictions-on-nsa-surveillance-rely-on-narrow-definition-of-spying/2014/01/17/2478cc02-7fcb-11e3-93c1-0e888170b723_story.html

Obama's restrictions on NSA surveillance rely on narrow definition of 'spying'

By Barton Gellman

1/17/2014

President Obama said Friday, in his first major speech [1] on electronic surveillance, that "the United States is not spying on ordinary people who don't threaten our national security."

Obama placed restrictions on access to domestic phone records collected by the National Security Agency, but the changes he announced will allow it to continue -- or expand -- the collection of personal data from billions of people around the world, Americans and foreign citizens alike.

Obama squares that circle with an unusually narrow definition of "spying." It does not include the ingestion of tens of trillions of records about the telephone calls, e-mails, locations and relationships of people for whom there is no suspicion of relevance to any threat.

In his speech, and an accompanying policy directive, [2] Obama described principles for "restricting the use of this information" -- but not for gathering less of it.

Alongside the invocation of privacy and restraint, Obama gave his plainest endorsement yet of "bulk collection," a term he used more than once and authorized explicitly in Presidential Policy Directive 28. In a footnote, the directive defined the term to mean high-volume collection "without the use of discriminants."

That is perhaps the central feature of "the golden age of signals intelligence," which the NSA celebrates in top-secret documents leaked by former contractor Edward Snowden. Obama for the first time put his own imprimatur on a collection philosophy that one of those documents summarized this way: "Order one of everything from the menu."

As digital communications have multiplied, and NSA capabilities with them, the agency has shifted resources from surveillance of individual targets to the acquisition of communications on a planetary scale. That shift has fed the appetite of Big Data tools, which are designed to find unseen patterns and make connections that NSA analysts don't know to look for.

"It's noteworthy that the president addressed only the bulk collection of call records, but not any of the other bulk collection programs revealed by the media," said Alexander Abdo, an attorney with the ACLU's national security project. "That is a glaring omission. The president needs to embrace structural reforms that will protect us from all forms of bulk collection and that will make future overreach less likely."

In principle, these tools have the potential to reveal unknown associates of known foreign targets, although the intelligence community has struggled to offer examples. But they rely, by definition and intent, on the construction of vast databases filled almost entirely with innocent communications. Obama's view, like the NSA's, is that there is no intrusion on privacy until someone calls up the files and reads them.

Obama focused his speech on surveillance authorized by Congress and overseen by the Foreign Intelligence Surveillance Court. He spoke most concretely about the collection of domestic telephone logs from virtually every American under a provision of the Patriot Act called Section 215.

But fresh assertions of transparency did not resolve other long-standing questions. White House and intelligence spokesmen declined to say whether the NSA has used that authority to collect any other kinds of data about millions of Americans or whether Obama was committed to disclose such collection if he permits it in the future.

Obama avoided almost entirely any discussion of overseas intelligence collection that he authorized on his own, under Executive Order 12333, without legislative or judicial supervision.

The Washington Post has disclosed in recent months, based in part on the Snowden documents, that the NSA is gathering hundreds of millions of e-mail address books, [3] breaking into private networks that link the overseas data centers of Google and Yahoo, and building a database of trillions of location records [4] transmitted by cellphones around the world.

Those operations are sweeping in a large but unknown number of Americans, beginning with the tens of millions who travel and communicate overseas each year. For at least as many Americans, and likely more, the structure of global networks carries their purely domestic communications across foreign switches.

Under the classified rules set forth by the president, the NSA is allowed to presume that any data collected overseas belongs to a foreigner. The "minimization rules" that govern that collection, intended to protect the identities of U.S. citizens and residents, remain classified. The White House and NSA have declined requests to release them.

The NSA term for those high-volume programs is "full take" collection -- the interception of entire data flows from the fiber optic cables that carry telephone calls, e-mails, faxes and video chats around the world at the speed of light.

Unless Obama says otherwise in the classified annex to his directive, those programs will carry on unabated.

Obama's approach is to "take . . . privacy concerns into account" after the collection takes place. In his directive, he defined a set of broad principles for use of the data, without specifying implementing details. In his speech, the president said the NSA is already following those principles.

"The United States does not collect intelligence to suppress criticism or dissent, nor do we collect intelligence to disadvantage people on the basis of their ethnicity, race, gender, sexual orientation or religious beliefs," he said. "And we do not collect intelligence to provide a competitive advantage to U.S. companies or U.S. commercial sectors."

Some of what Obama promised in his speech he seemed to hedge in the directive. He said several times, for example, that the United States conducts surveillance only for legitimate foreign intelligence purposes. In a footnote to the directive, "foreign intelligence" is defined to include not only the capabilities and intentions of governments and terrorists but the "activities of . . . foreign persons."

In another significant footnote, Obama said the limits he ordered "shall not apply to signals intelligence activities undertaken to test or develop signals intelligence capabilities." Signals intelligence development, or "sigdev" in NSA parlance, is the discovery of untapped communication flows and the invention of new surveillance methods to exploit them.

For example, NSA Director Keith Alexander revealed last summer that his agency had collected location data from mobile phones in the United States.

At least for now, while Congress debates its next steps, Obama said he will require that the NSA obtain court approval to search the trillions of domestic call records collected in secret since 2006.

He suggested no such limit on a far more intrusive form of domestic surveillance: the NSA's authority to search for and make use of the content of U.S. communications that are "incidentally" collected in surveillance that is targeted on foreign nationals and stored in the agency's databases.

[1] http://www.washingtonpost.com/wp-apps/say-what/say-what-breaking-down-obamas-address-on-nsa-reforms/

[2] http://apps.washingtonpost.com/g/page/world/president-obamas-policy-directive-on-signals-intelligence-activities/748/

[3] http://www.washingtonpost.com/world/national-security/nsa-collects-millions-of-e-mail-address-books-globally/2013/10/14/8e58b5be-34f9-11e3-80c6-7e6dd8d22d8f_story.html

[4] http://www.washingtonpost.com/world/national-security/nsa-tracking-cellphone-locations-worldwide-snowden-documents-show/2013/12/04/5492873a-5cf2-11e3-bc56-c6ca94801fac_story.html