NSA strives to plug leaks
July 23, 2006
Siobhan Gorman
WASHINGTON -- The National Security Agency has mounted an increasingly aggressive campaign to root out disclosures to the news media, including a new policy that could require every agency employee to hunt for leaks, current and former intelligence officials said.
"There's been one leak after another, and [intelligence agencies] haven't responded as effectively as they would have liked," said Meredith Fuchs, general counsel for the National Security Archive at George Washington University. "They're trying to set up a system that will be quick-moving, effective and responsive."
Some security analysts and former NSA officials warned that requiring agency employees to regularly search for leaks could divert attention from their regular duties. They also raised concerns that it could place people who pursue information through legitimate channels under suspicion.
NSA spokesman Don Weber characterized NSA's news media policy as "not a new policy" but "a revised [and] updated policy."
The policy, issued March 20, is apparently the first dedicated solely to news media leaks. The last time NSA visited the issue was as a small part of an "annex" to a 1992 directive on information security, which described the information that should be included when assembling a "damage assessment" of a news media disclosure.
A copy of the new policy, which is unclassified but labeled "For Official Use Only," and unclassified portions of the 1992 policy were obtained by The Sun.
Weber said the policy did not represent a stepping-up of anti-leak efforts because "we've always had a strong effort."
"Was it timely?" he added. "Certainly."
Recent disclosures of classified and sensitive information -- including newspaper reports on secret CIA prisons, NSA's warrantless telephone surveillance program, government reviews of financial transactions and NSA's technology failures -- have prompted calls for a crackdown on leaks from the White House and from many congressional Republican leaders, as well as intelligence agency heads. The NSA policy directs agency employees to "actively monitor the media for the purpose of identifying unauthorized disclosures" of classified information. It requires that all divisions within the agency produce annual reports on the number of classified leaks they uncover.
Such directives create pressure to identify more leaks, said Matthew Aid, a former NSA analyst who is writing a multivolume history of the agency.
"Instead of hunting for spies within the agency, now you're hunting for disenchanted employees who may know somebody who knows a reporter," he said.
"It's bound to divert resources and focus."
Some NSA veterans and security analysts said the policy imposes new responsibilities on employees.
"'Actively monitor' means they're supposed to go out, surf the Web and look for classified information, not report it when they find it," said Steven Aftergood, a government secrecy expert at the Federation of American Scientists. "That amounts to a new tasking of every part of the organization to hunt for unauthorized disclosures."
One former NSA official called the directive "bizarre."
"We're going to turn all of NSA into a vast media monitor? That just strikes up these images of people with visors on reading the newspaper," said the official, who spoke on condition of anonymity to protect business relationships. NSA employees "have got to have something better to do."
NSA's Weber said the policy does not amount to a new requirement for employees to search for leaks. "We're just asking employees to be alert," he said. "It doesn't mean put down your headsets and don't do mission."
Under the new policy, when an NSA employee identifies a possible leak, that person must forward it to the agency's information policy and legal offices.
If officials deem the leak of classified information to be "significant" -- jeopardizing lives, intelligence sources, operations or foreign relations -- they must notify the Departments of Justice and Defense and National Intelligence Director John D. Negroponte's office.
Government watchdogs are concerned that the new policy also singles out those who file requests for information under the Freedom of Information Act. They fear those people could come under suspicion as part of a leak investigation and could be accused of acting as an intermediary between the agency and the press.
The internal NSA directive lists a set of questions to help identify unauthorized disclosures, including whether any Freedom of Information requests have been made for the leaked information and, if so, who requested it. The 1992 policy asked whether the information had been requested through official channels, but did not refer to FOIA."It almost makes you think that someone who made an appropriate request is someone they're going to look at if there's a leak, which is a little unsettling," said Fuchs of the National Security Archives, a research institute that collects and publishes declassified documents. "In my organization, we live on FOIA requests."
Weber, however, said the question is merely part of a checklist that NSA investigators use to decide whether a leak is significant -- to make sure the information has not already been officially released to the public.
Some former NSA employees questioned whether the policy could be enforced. Historically, said one, employees have been reluctant to get involved in leak investigations because they do not want to be pulled into protracted legal battles. Aid noted that NSA tries to avoid taking leak cases to court because that risks revealing sources and methods.
Last week, Sen. Charles E. Schumer accused the administration of selectively prosecuting leaks from intelligence agencies and called for Congress to look into the matter. The New York Democrat also wrote to the attorney general and the national spy chief asking for details of the policies by which executive branch departments refer potential leaks for investigation.
This month, House Intelligence Committee Chairman Peter Hoekstra of Michigan announced that the Justice Department would renew its pursuit of leaks. The department has been criticized over the years for failing to successfully prosecute leak cases.
Separately, NSA Director Lt. Gen. Keith B. Alexander has issued four memos to agency employees since the December disclosure of the NSA's warrantless surveillance program, reminding them not to speak with the news media about either classified or unclassified information.
Two memos from December were disclosed earlier this year by the Electronic Privacy Information Center, but the most strongly worded memo, in February, and another in May, right after USA Today reported on an NSA program to collect domestic phone records, were obtained by The Sun and have not previously been made public.
A Feb. 21 memo titled "NSA in the Media -- Media Leaks" warns that commenting on any intelligence operations "is professionally irresponsible and may put Americans or allied personnel in peril."
It also takes a more personal tone than the other memos.
"I share your shock and disbelief regarding the recent unauthorized media disclosures of classified intelligence information attributed to current and former officials," Alexander wrote. "These actions are a source of grave concern to each of us in the intelligence community, and signify a betrayal of the Nation's trust, and a fundamental compromise of the sworn oath we each took as intelligence professionals."
A May 15 memo, "NSA in the Media UPDATE -- Intelligence Gathering Practices," responds directly to the USA Today article and emphasizes the internal legal checks NSA has in place for its programs and NSA's dedication to keeping Congress informed.
"Routinely, they leave impressed with our commitment and results and are supportive of our engagement," Alexander said of the congressional briefings.
He also encouraged NSA employees to remain focused on their jobs "as the national debate on intelligence oversight rages" and reminds them not to speak to the media.
So far, however, security officials at NSA have concluded, based on an analysis of the content of recent articles on the warrantless surveillance program, that "the leaks they really cared about" could not have come from NSA, Aid said.