The NSA Guidelines for Spying on You Are Looser Than You've Been Told

Philip Bump
The NSA Guidelines for Spying on You Are Looser Than You've Been Told

On July 28, 2009, 189 days after Barack Obama became president, Attorney General Eric Holder (himself only six months into office) presented the secret Foreign Intelligence Surveillance Court (FISC) with a list of ways in which the NSA and FBI would try and assure that the data it collected under the Foreign Intelligence Surveillance Act came only from non-Americans. The delineation, released today by The Guardian, includes several ways in which collection of data from Americans is both likely — and allowed.

RELATED: The Government's System of Secrecy Is Broken

The paper's two new documents, one showing how non-Americans are targeted and the other how collection from Americans is "minimized," are almost certainly the latest files to come from the Edward Snowden leak. These documents are particularly significant given the repeated recent insistences that the government does all it can to minimize collection of Americans' data, something which is not legally allowed under FISA. (These documents only apply to collection under FISA, including the provisions of Section 702 that allowed PRISM. Section 215 of the Patriot Act, which allows the sweeping collection of data from phone companies, knowingly and legally collects data about Americans.)

RELATED: Eric Holder Got Off Really Easy at His First Post-Verizon Hearing on the Hill

Members of both the House and the Senate have called for the release of documents that do precisely what these do: outline how and when the NSA might collect domestic data, and how it tries not to. One of the points these documents raise is that, given the breadth of the agency's collection efforts, collecting data from Americans almost necessarily occurs. According to a separate, one-paragraph document The Guardian has seen, however, the FISC found the procedures described by Holder to be "consistent with US law and the fourth amendment."

RELATED: The Senate's Push for a Secret Court's Secrets Can Only Tell Us This Much

The Guardian's Glenn Greenwald provides an overview:

The top secret documents published today detail the circumstances in which data collected on US persons under the foreign intelligence authority must be destroyed, extensive steps analysts must take to try to check targets are outside the US, and reveals how US call records are used to help remove US citizens and residents from data collection.

To avoid including Americans (technically, "US persons") in its sweeps, the NSA asks several questions about a target.

RELATED: Which Tech Company Does the NSA Use Most?

RELATED: NSA Chief: No 'Flip of Switch' to Spy on Americans, but 50 Plots Disrupted

If the person passes that test, the NSA further examines the data it collects for signs that the person might or might not be an American, including checks against known phone numbers and IP address data. Or if the person happens to be a "buddy" of a foreign intelligence official.

Should the data not pass these tests — if, in other words, the NSA believes the data does pertain to an American — it doesn't necessarily have to get rid of the data. Greenwald outlines three examples in which the NSA can keep and use data collected from Americans.

The point about encryption was immediately isolated as significant by observers, like the Electronic Frontier Foundation's Hanni Fakhoury.

And, as attorney Amie Stepanovich noted, the NSA keeps email addresses and phone numbers it knows belong to Americans in order to identify other people as being American or not.

Incidentally, if the NSA can't figure out whether or not a person is an American, it is allowed to assume that the person is not, according to Greenwald.

"In the absence of specific information regarding whether a target is a United States person," it states "a person reasonably believed to be located outside the United States or whose location is not known will be presumed to be a non-United States person unless such person can be positively identified as a United States person."

It is not clear whether or not these are the "minimization procedures" still in effect for the NSA's surveillance systems. The compliance systems appear to comport with what was described by NSA head Keith Alexander and the FBI during a hearing this week. Since a previous FISA document obtained by Snowden apparently came from a batch of training documents, it's possible that these documents were similarly available to train new NSA employees on how and when to use the tools.

Again, the scope of the NSA's authorization means that scooping up data from Americans would be almost unavoidable. That scope is, of course, up for debate. But these two documents also raise significant questions about the repeated assurances that the NSA doesn't intentionally collect information on Americans under Section 702. Maybe not. But the rules as proscribed are much looser than the agency has implied.