NSA mostly collects data on non-target persons — here's why

Over the weekend the Washington Post put out a report detailing what kind of information the National Security Agency stockpiles and from whom. Using Edward Snowden’s cache of NSA data, the Washington Post revealed that nine out of 10 people surveilled were not targets.

As a reference, the Post looked at 160,000 emails and Internet chat conversations as well as 7,900 documents from 11,000 accounts.

[aditude-amp id="flyingcarpet" targeting='{"env":"staging","page_type":"article","post_id":1502636,"post_type":"story","post_chan":"none","tags":null,"ai":false,"category":"none","all_categories":"business,security,","session":"B"}']

That figure is stunning. It means that 90 percent of the IM conversations, chat room discussions, emails, Facebook posts, etc., that the government reviews and stores aren’t from people suspected of committing crimes. What’s more, nearly half of the files collected contained information belonging to American citizens or residents. While the article notes that the NSA tries to “minimize” or mask data that is irrelevant to an investigation, the Washington Post found there were still emails and other information linked to non-target persons in the reports.

Under the Foreign Intelligence Surveillance Act, the NSA is only authorized to target suspicious foreign nationals, but if targets are communicating with U.S. residents or citizens, those conversations can be reviewed and stored.

As Stewart Baker, former counsel to the NSA points out in a follow-up to the Post’s article, it makes sense that so many non-targets would end up in the data pool. “Suppose I become the target of a government investigation. The government gets a warrant and seizes a year’s worth of my email. Looking at my email patterns, that’s about 3,500 messages,” he writes. Then he breaks down the numbers. He estimates that there are roughly 1,000 people he’ll correspond with in that month, with account holders running the gamut between people he’ll only ever hear from once to people he communicates with regularly. “So the criminal investigators seized and stored my messages from me, their investigative target, and 1,000 people who aren’t targets,” he says.

And as James Lewis, a senior fellow at the Center for Strategic and International Studies, said, the notion that the NSA collects too much information about non-targets operates under a flawed assumption. “The basis for the critique [of NSA practices] is an assumption of perfect knowledge – that we know who the terrorists or spies are and therefore can discard anyone else. In real life, you don’t know and therefore don’t discard,” he told VentureBeat via email. “The critique of what allows someone to guess whether someone is foreign and domestic (the story says NSA used foreign IP addresses) also assumes perfect knowledge – how else will you decide if someone is foreign or not? People usual don’t include ‘not a U.S. person’ in their email address,” he said.

The Washington Post closes the article with an anecdote about a woman whose communications were reviewed because her former boyfriend was a suspected terrorist, although he wasn’t ultimately charged criminally. “I’m not against the fact that my privacy was violated in this instance, because he was stupid,” she said. “He wasn’t thinking straight. I don’t agree with what he was doing.” But she wonders why her communications are still being stored if the case against her former beau has been closed.

The NSA usually only stores communications for five years. However communication containing evidence of a crime or information regarding “the conduct of the foreign affairs of the United States” can be held onto indefinitely. Though those terms are broad, as both Lewis and Baker point out, a lot of unknown variables factor into NSA investigations. It’s not inconceivable that investigators may need to backtrack into old communications to see if something was overlooked.

“We need an effective public oversight body and regular public reporting on collection that gives numbers like ‘65,000 collected, 900 not minimized,'” Lewis suggests. “The old argument — that we can’t be transparent because it will tell people what we are doing — is completely nonsensical by now. Then the voters can decide if they like the program or not. So at a minimum, more transparency, less secrecy.”

 

[aditude-amp id="medium1" targeting='{"env":"staging","page_type":"article","post_id":1502636,"post_type":"story","post_chan":"none","tags":null,"ai":false,"category":"none","all_categories":"business,security,","session":"B"}']